Latest / Success Story with Scott Clary / Lessons - She Protected the White House From Hackers. Here's What Companies Keep Getting Wrong. | Theresa Payton - First Female White House CIO

Transcript

Lessons - She Protected the White House From Hackers. Here's What Companies Keep Getting Wrong. | Theresa Payton - First Female White House CIO · Success Story with Scott Clary

• 0:00
  In this lessons episode, discover why cybersecurity threats are far more constant and far-reaching than most people realize, understand how attackers target critical infrastructure and intellectual property, explore why digital systems and quantum computing create emerging risks, and uncover why preparing for the next wave of cyber threats requires thinking several steps ahead.
• 0:26
  I want to ask you some more questions about some of your time in the White House because I find that fascinating.
• 0:33
  Obviously, you speak about what you can speak about and don't get yourself in trouble.
• 0:37
  But I am curious about some of the ...
• 0:41
  When you walk into the White House, you say the general public is not aware of ...
• 0:47
  really the threats that are going on.
• 0:49
  So what are some things that the public should know about that they're kind of oblivious to?
• 0:55
  Like, what is coming at the U.S.?
• 0:57
  Why are we in trouble?
• 1:00
  I think you mentioned at some point, it's not unicorns and rainbows when it comes to cybersecurity.
• 1:07
  And people know about...
• 1:09
  other nation states and they understand that, you know, China exists and Iran exists and Russia to an extent exists.
• 1:16
  And but maybe a little bit more clear as to what is actually happening that we have no clue or we don't pay attention to.
• 1:24
  Yeah, well, I mean, for example, uh.
• 1:31
  Cyber criminals, especially nation states, and then people who are loosely affiliated, because for the record, China, Russia, Iran, and North Korea say they don't have nation state operatives hacking into American infrastructure.
• 1:45
  So they say that.
• 1:46
  So I'm just going to give that disclaimer from them.
• 1:51
  But...
• 1:52
  What's interesting is they first primarily focused on what's referred to as the defense industrial base.
• 2:01
  They would go after the U.S. government, U.S. military, departments and agencies, White House.
• 2:07
  Then they'd go after the vendors, the big vendors that provide airplanes or weapons or anything else to the government.
• 2:17
  But then they realized...
• 2:20
  You know, they might be leaving money on the table.
• 2:22
  Maybe we should steal, I don't know, intellectual property, trade secrets, and then reverse engineer and manufacture our own stuff and compete with the U.S. You know, kind of even the playing field.
• 2:33
  We'll just steal their R&D.
• 2:35
  We'll skip that process and we'll just reverse engineer it and produce it here.
• 2:39
  And China, for one, is really good at doing that.
• 2:42
  And so that was something that was very eye-opening to me at that time, because that wasn't really being discussed.
• 2:51
  And if any companies at that time were falling victim to that, they weren't talking about it because they were worried their competitors would take advantage of it.
• 3:01
  So I think that's something that was a big aha moment for me.
• 3:06
  You know, many people may not realize this.
• 3:08
  I'm sure most people assume attacks against White House are constants, a constant barrage.
• 3:16
  And that is correct.
• 3:17
  But what's interesting is, is like I learned, for example, because we have WhiteHouse.gov and WhiteHouse.gov is not connected like to anything like there's not.
• 3:28
  like, hey, the president's secret briefing is just right behind whitehouse.gov.
• 3:33
  Like it's really just meant to be sort of a, here's where the executive orders are.
• 3:38
  And like, hey, look at President Bush's dogs, Barney and Miss Beasley, and watch Barney run around the White House.
• 3:46
  One of the favorite videos of my kids was Barney at Christmas time.
• 3:51
  watching things get decorated and running around with a little Barney cam on.
• 3:55
  Probably the Peyton household was the biggest consumer of Barney, but the president's dog.
• 4:02
  And it's really meant for that, but for whatever reason.
• 4:07
  If there was like a visiting head of state from another country who had a beef with somebody else or different things that were going on, we would sometimes, according to our vendors and routers and our own monitoring, be the most attacked website in the world on certain days.
• 4:27
  Now, if the website goes down, it's incredibly embarrassing, but the website isn't like where people get money.
• 4:34
  And the website's not like, it's not connected to classified systems or anything like that.
• 4:39
  But for whatever reason, that was a kind of a digital representation, a public face, if you will, of the White House.
• 4:47
  So a vitally important page to not have commandeered and defaced, which was a very popular thing at that time.
• 4:56
  Let's take over this department and agency's webpage and put, you know, long liver on or, you know, something like that.
• 5:02
  So those are, you know, some of the, a little bit of an inside ball without giving too much away of, you know, the types of things that you have to think about and deal with that shape my thinking when I work with companies and people today.
• 5:15
  That's interesting.
• 5:16
  I actually, I had a few people on that spoke about this, but Dmitry Alperovitch, who spoke about, yeah, so he spoke about some of the work that he did with Google and McAfee when he realized that nation states were actually targeting the US.
• 5:34
  I think that was, I can't remember the name of the, there was like an instance and I am blanking on it now.
• 5:39
  I didn't write it.
• 5:40
  Yes, that's it.
• 5:41
  Yeah, exactly.
• 5:43
  So it's just very, it's very interesting what, how constant we are bombarded.
• 5:50
  And I don't know if everybody really thinks about that, that it's like a daily thing.
• 5:53
  I think most people think that intermittently there will be attacks, not just constant attacks, which is a little bit, it's a little bit stressful when you think about, you think about your role and what you had to, what you had to, what you had to sort of handle.
• 6:12
  So there's always these attacks happening, whether or not they're on WhiteHouse.gov, which are obviously the ones that could be embarrassing or the ones that are more serious that are targeting actual mission-critical systems like you mentioned.
• 6:25
  Is there, in your mind, is there a concern, because we always speak about nuclear war and the concern about nuclear war.
• 6:33
  Are you just as concerned about a nuclear war version of a cyber attack or a cyber war?
• 6:41
  Absolutely.
• 6:42
  The question would be, why would they want to do it?
• 6:49
  So you always have to think about motive, opportunity, and then are they prepared for the repercussions?
• 6:56
  And when I think about...
• 6:59
  the mayhem that can be created by a nation state or a cyber criminal syndicate.
• 7:05
  It can be pretty significant.
• 7:07
  And it doesn't just have to be the systems that we think about.
• 7:11
  It can be space, too.
• 7:13
  A lot of our internet connectivity is dependent upon space.
• 7:18
  It's not just undersea cables, although those are really important to protect, too.
• 7:23
  So you've got
• 7:25
  You've got multi-layered levels of opportunity for infrastructure to be impacted.
• 7:33
  But at the same time...
• 7:36
  that's multi layers of connectivity and digital, that it would be hard to attack them all at this time.
• 7:44
  I'm not saying impossible, but you'd have to have a pretty well orchestrated attack to go after the undersea cables, the satellite and broadband cables to take out all internet.
• 8:01
  But the question is, is a nation state
• 8:06
  who decides to play the long game, you know, they might be thinking about opportunities like that.
• 8:12
  So to me, I do think about war in the sense of, you know, coming from a military family, there's land, air, and sea.
• 8:24
  There's the digital realm, but there's also space.
• 8:29
  I think that if you think about the most alarming cybersecurity opportunities, you think about internet, obviously that's connectivity.
• 8:39
  You think about a power grid, like you mentioned before.
• 8:43
  You could also think about nuclear launches as a potential, not an opportunity, but a target, excuse me.
• 8:53
  But obviously the systems and protections in all of these circumstances are so extensive.
• 9:00
  What would be something that you think going forward outside of just space would be another target for malicious actors that eventually we're going to have to pay more attention to?
• 9:16
  Leveraging quantum computing to break all of our encryption.
• 9:22
  How far are we away from that?
• 9:24
  It's a race.
• 9:26
  We're not going to know until we know who wins.
• 9:29
  That's very scary because they have quantum computing already.
• 9:32
  Yeah, it's not like commercially available yet.
• 9:36
  And there are really smart people working on post-quantum computing encryption.
• 9:40
  And for laypeople...
• 9:43
  Here's what I want you to take away about quantum computing.
• 9:46
  So today's computing, even though it looks cool and sexy like your mobile app you might be using behind the scenes, it's just ones and zeros on a computer.
• 9:55
  So everything's just ones and zeros.
• 9:57
  And today's computers, I can add more memory.
• 10:00
  I can add more storage.
• 10:02
  You can kind of tweak the programming to leverage everything that's there.
• 10:07
  But at the end of the day, you're flipping ones and zeros to make the program work.
• 10:12
  Quantum computing is stateless computing.
• 10:17
  So nothing is a zero or one, there's no flipping zeros and ones.
• 10:20
  So you can have an instruction go out and instead of being a linear set of instructions across like multiple memory, soft memory, software memory and hardware memory and disk space, et cetera, quantum computing is stateless.
• 10:37
  So you can process mathematical instructions
• 10:42
  and to handle mathematical calculations at a speed and scale we've never seen before.
• 10:47
  And right now there's some quantum computing, but the scale of the power that it needs for cooling, electricity, the processing power, we're still in our infancy stages for quantum computing.
• 11:07
  But once it becomes generally available and something that's scalable, isn't environmentally as harmful as it is today with the energy that it needs to consume...
• 11:19
  It's just going to basically run mathematical calculations at a speed and scale we've never seen before.
• 11:27
  Encryption of your passwords, of your data, of systems, is nothing but a big old math problem.
• 11:34
  So quantum computing with today's encryption can unlock these mathematical problems at a speed and scale we haven't seen before, which is why we need post-quantum computing encryption.
• 11:49
  So the question is, is who wins the battle first?
• 11:51
  Who figures out post-quantum computing encryption so it's ready when it comes, or who figures out
• 11:59
  busting encryption and getting quantum computing in the hands of evildoers before that happens.
• 12:06
  And then even if post-quantum computing encryption is available, it may not be simple and easy to implement.
• 12:15
  So how long will it take everybody to get it implemented before it's in the hands of cyber criminals to use quantum computing?
• 12:23
  That's the race we're under.
• 12:25
  And you've got...
• 12:26
  Really smart, good people working on this issue.
• 12:28
  And you've got, sadly, smart evildoers working on their set of priorities.