Latest / Bloomberg Intelligence / FBI's Hart on Cyber Threats: Companies Are Not Prepared (Audio)

Transcript

FBI's Hart on Cyber Threats: Companies Are Not Prepared (Audio) · Bloomberg Intelligence

• 0:03
  Speaker 1: Global business news twenty four hours a day at Bloomberg
• 0:06
  Speaker 1: dot com, the Radio plus Mobile Act and on your radio.
• 0:09
  Speaker 1: This is a Bloomberg Business Flash from Bloomberg World Headquarters.
• 0:14
  Speaker 1: I'm Charlie Pellet. The Dow, the SMP, NEZDAC all advancing
• 0:18
  Speaker 1: stocks posting the strongest to day rally in nearly three months,
• 0:22
  Speaker 1: as signs of a stronger economy spur speculation it can
• 0:25
  Speaker 1: withstand higher interest rates. The SMP five hundred indecks up
• 0:29
  Speaker 1: fourteen to two thousand ninety again of seven tenths of
• 0:32
  Speaker 1: one percent, as stack up thirty three points again also
• 0:36
  Speaker 1: of seven tenths of one percent down. Industrials up one
• 0:39
  Speaker 1: forty five points again of eight tenths of one percent.
• 0:42
  Speaker 1: Gold down four to twelve twenty four a dropped, There
• 0:46
  Speaker 1: are four tenths of one percent. Crude oil closing it
• 0:49
  Speaker 1: on fifty dollars of arrow forty nine sixty eight on
• 0:52
  Speaker 1: West Texas Intermediate of a dollar six again there of
• 0:55
  Speaker 1: two point two percent. I'm Charlie Pellet, and that's a
• 0:58
  Speaker 1: Bloomberg Business Flash. Sure taking stock with Kathleen on Bloomberg Radio.
• 1:06
  Speaker 1: We're broadcasting line today from the Bloomberg Breakaway Sonnet. It's
• 1:10
  Speaker 1: a two day conference bringing together top executives leading high
• 1:14
  Speaker 1: growth companies. But no matter how fast your company grows
• 1:17
  Speaker 1: or how top level you are, something that you have
• 1:19
  Speaker 1: to keep running to catch up with is cyber security.
• 1:23
  Speaker 1: And someone who is intimately involved with that now is
• 1:25
  Speaker 1: joining us from the Bloomberg Breakaway Summit. Are that Heart.
• 1:28
  Speaker 1: She's chief Information Security Officer at the FBI. She's usually
• 1:33
  Speaker 1: in Washington, d C. But she's here in New York
• 1:35
  Speaker 1: City fest today. Welcome, thank you, thank you for having me.
• 1:37
  Speaker 1: So first of all, what does the chief Information Security
• 1:41
  Speaker 1: Officer of the Federal Bureau of Investigation do? What do
• 1:44
  Speaker 1: you in charge up? We make sure that the Federal
• 1:47
  Speaker 1: Bureau of Investigations data and capabilit and electronic capabilities are secure.
• 1:52
  Speaker 1: So make sure that the cybersecurity protections are in place,
• 1:55
  Speaker 1: that we have the right defensive posture. And we we
• 1:58
  Speaker 1: both look at the extra and the insider threat. So
• 2:01
  Speaker 1: we make sure that we have protections and we are
• 2:03
  Speaker 1: guarding the bureaus information. And I would imagine that a
• 2:07
  Speaker 1: lot of people, bad guys, bad bad people would like
• 2:10
  Speaker 1: to hack you if they could, They would They try
• 2:13
  Speaker 1: often every day it's like, yes, we we have a
• 2:17
  Speaker 1: very aggressive approach to cybersecurity at the Bureau, and we
• 2:21
  Speaker 1: definitely are on the defense all the time, but we
• 2:23
  Speaker 1: also make sure that we are enabling the mission also.
• 2:27
  Speaker 1: This is a critical component. A lot of times people
• 2:30
  Speaker 1: talk in terms of cybersecurity, it's like, oh, well, that's
• 2:32
  Speaker 1: getting in the way. We can't get in the way.
• 2:34
  Speaker 1: We have to make sure that the mission itself is
• 2:36
  Speaker 1: enabled all the time, because that's more critical than the
• 2:39
  Speaker 1: the the mission be enabled by security with the right
• 2:43
  Speaker 1: levels of security in place. It's security from many of
• 2:47
  Speaker 1: the people you talk to, an after effect in other
• 2:50
  Speaker 1: which something bad happens and then they go back and
• 2:53
  Speaker 1: they try to, you know, put the toothpaste back in
• 2:56
  Speaker 1: the tube. It just it doesn't work. Can't start there, correct, Well,
• 3:00
  Speaker 1: you have to start somewhere, so better there than not
• 3:03
  Speaker 1: starting at all. It is hard to put that genie
• 3:05
  Speaker 1: back in the bottle or the toothpaste back in the tube,
• 3:07
  Speaker 1: but you really do need to go down the path.
• 3:09
  Speaker 1: So after an incident and from an incident response perspective, again,
• 3:12
  Speaker 1: I'm on the defense side of the bureau. I'm not
• 3:15
  Speaker 1: on the defense. I'm not in the cyber division, which
• 3:17
  Speaker 1: does the investigation of external threats. But nevertheless, everybody's in
• 3:21
  Speaker 1: the same position. We have to be able to react
• 3:24
  Speaker 1: to incidents and make sure that so we don't have
• 3:27
  Speaker 1: all the toothpaste out of the bottle out of the tube,
• 3:29
  Speaker 1: so we can contain the breach. We can make sure
• 3:32
  Speaker 1: that we have as low impact as possible, and that
• 3:34
  Speaker 1: also means finding it quickly, so it's not just a
• 3:37
  Speaker 1: matter of um, okay, well that would happened a long
• 3:40
  Speaker 1: time ago, but making sure that you have the right
• 3:42
  Speaker 1: view in place, and for corporations this is really critically important.
• 3:47
  Speaker 1: Make sure that you can see if something is happening
• 3:50
  Speaker 1: that is not right and take action on it. These
• 3:53
  Speaker 1: things need to be discussed at the board level by
• 3:56
  Speaker 1: c e O S, your incident response PM needs to
• 3:59
  Speaker 1: reach your ex ecutive management. They need to know because
• 4:02
  Speaker 1: there's a breach is going to have a material impact
• 4:05
  Speaker 1: on an organization at a point in time, and that
• 4:07
  Speaker 1: needs to be established. So what is the gap. Because
• 4:11
  Speaker 1: everybody's talking about cybersecurity and cyber risk. We've seen Target
• 4:16
  Speaker 1: get hacked, We've seen JP Morgan with hundreds of technology
• 4:21
  Speaker 1: and cyber risk experts in place, get hacked and they
• 4:24
  Speaker 1: didn't even know it for months. So what is it
• 4:26
  Speaker 1: that big sophistic big sophisticated companies and executives are missing
• 4:35
  Speaker 1: the idea that this is a risk. I think I
• 4:37
  Speaker 1: think it's starting to dawn on people. I mean, the
• 4:39
  Speaker 1: fact that you've invited me here today is I am
• 4:42
  Speaker 1: truly pleased about that. And the idea that cybersecurity is
• 4:45
  Speaker 1: being discussed in this kind of venue is really important.
• 4:49
  Speaker 1: And I think the idea that it can happen to
• 4:52
  Speaker 1: you is what's missing. Because everyone looks at this and say, well, yeah,
• 4:56
  Speaker 1: I'm sure somebody else is going to get hacked. I
• 4:58
  Speaker 1: mean the four people at home depot right after the
• 5:00
  Speaker 1: target thing. And and I'm not throwing rocks at anybody.
• 5:03
  Speaker 1: Everybody who is in this business is scrambling hard all
• 5:07
  Speaker 1: the time, and I know they were scrambling hard to
• 5:10
  Speaker 1: get done before they could get breached. And that's you know,
• 5:13
  Speaker 1: when you realize that it's in your sector, then your
• 5:17
  Speaker 1: eyes are opened wider. But I think the idea that
• 5:20
  Speaker 1: it could happen to you and not just you, um
• 5:23
  Speaker 1: your vendors, the people who you're working with, their externalities
• 5:27
  Speaker 1: to your organization. That also need to be considered in
• 5:29
  Speaker 1: this mix. Um, And if you're going to do like
• 5:32
  Speaker 1: a merger or something like that, what is the cybersecurity
• 5:35
  Speaker 1: posture of the organization that you're bringing in are you
• 5:39
  Speaker 1: are you walling them off? What happens if something happens
• 5:41
  Speaker 1: to their data while you're buying them and what's your
• 5:43
  Speaker 1: risk to those to that data and to the people
• 5:47
  Speaker 1: who own that data or who are um you know,
• 5:50
  Speaker 1: if you if it's a p I I question or
• 5:52
  Speaker 1: something like that, let's p I personally identifiable information thank you?
• 5:56
  Speaker 1: Um yeah, if it's information about human beings and that
• 5:59
  Speaker 1: gets lost while you're in the middle of a merger,
• 6:01
  Speaker 1: it's like you can't say, oh, that's not me, that
• 6:03
  Speaker 1: was the other guy. It's you, and making sure you know.
• 6:06
  Speaker 1: And if you put your data into a cloud or
• 6:09
  Speaker 1: someplace else, and I'm entirely in flavor in favor of
• 6:11
  Speaker 1: clouds and places that can really secure data properly, but
• 6:15
  Speaker 1: if you are putting your data there and you think, oh,
• 6:18
  Speaker 1: they're going to take responsibility for it, you can't transfer
• 6:21
  Speaker 1: that particular risk. You still have that risk. You are
• 6:24
  Speaker 1: still responsible for that data because you've trusted with that data.
• 6:28
  Speaker 1: Speak if you can, about what individuals can and cannot
• 6:31
  Speaker 1: do in order to hance their enhance their own security.
• 6:35
  Speaker 1: Given that so much information is now being put into
• 6:37
  Speaker 1: smartphones and so much commerce is being transacted online, so
• 6:44
  Speaker 1: an individual cyber footprint tends to be much larger than
• 6:49
  Speaker 1: I think they think it is. UM. I mean, you've
• 6:52
  Speaker 1: all heard about the Facebook pieces. You know, don't tell
• 6:54
  Speaker 1: people when you go on vacation or where you're going,
• 6:57
  Speaker 1: and things like that. That I think is, you know,
• 7:00
  Speaker 1: basic information. And I think the other things that people
• 7:04
  Speaker 1: need to start thinking about are when they're using their phone,
• 7:07
  Speaker 1: are they in a protected environment? And by protected, I
• 7:10
  Speaker 1: mean do you understand what the protections are? Do we
• 7:13
  Speaker 1: understand how that is being encrypted? So if you're on
• 7:16
  Speaker 1: a closed network, okay, if you own that closed network, although,
• 7:20
  Speaker 1: make sure okay, change your passwords on your routers. You
• 7:23
  Speaker 1: know you buy those things, you put them in your house.
• 7:25
  Speaker 1: Make sure that you have a password on there that's
• 7:27
  Speaker 1: not the one that came with the router. Everybody can
• 7:30
  Speaker 1: do that, UM, make sure that you have passwords on
• 7:33
  Speaker 1: your computers. And thank you very much, our heart chief
• 7:38
  Speaker 1: Information Security officer for the f B. I think we're
• 7:42
  Speaker 1: gonna keep going here with our let we are. Oh,
• 7:45
  Speaker 1: I beg your pardon. We're gonna have more time. Yes,
• 7:47
  Speaker 1: we haven't been haven't been breached. Gis a chance I'm
• 7:51
  Speaker 1: gonna ask you a question or lett about the crime
• 7:54
  Speaker 1: side of this. I think one reason people or companies
• 7:56
  Speaker 1: don't feel vulnerable as they think who would care? Right,
• 7:59
  Speaker 1: They're gonna