Latest / The Decision Advantage / Cyber Threats & Critical Infrastructure: The New Era of Civil Defense

Transcript

Cyber Threats & Critical Infrastructure: The New Era of Civil Defense · The Decision Advantage

• Brian: Welcome to the Decision Advantage, a Fusion Intelligence podcast by Fernand Consulting. I'm Brian LeClaire, and today I will be speaking with Don Thomas, the managing director of CNA. Don, welcome to the show. Dawn Thomas: Thanks. Thanks for having me, Brian. Brian: first off we'd like to hear a little bit about yourself and what CNA is. can you tell us a little bit about the organization and and what drew you to it? Dawn Thomas: Yes, so the latter part is easier. What drew it to me is I needed a job really badly. so I had just finished getting my master's degree in Israel at the Hebrew University in terrorism studies, and I had applied to all the three-letter agencies in the United States. And while I was waiting for all that to happen, I did a lot of odd jobs and then decided I really wanted to do something a little bit more in my field than waitressing at legal seafoods. so I had a friend that worked I you know, I know. Well it is Brian: A lot of people have that history though, right? Yeah. Dawn Thomas: it's everyone should be a server at some point in their lives. So a friend of mine had worked here, and so they said, like, we're looking for people. So I came on part-time on call. and I was like, Well, I'm just gonna do this until something else happens, and that was 22 years ago. So that's how I got here. That's my origin story. CNA is an odd little duck as far as an organization goes. So one side is the federally funded research and development center for the Navy and the Marine Corps. So all of its work is kind of a byline in The congressional budget. They are not competitive. They're like RAND is for the Army, CNA is for the Navy and Marine Corps. So that's like two-thirds of our company. And it's been around for 85 years. And then 25 years ago, some folks that work there said, wow, all this operations research that we do is really applicable to public sector. So federal, state, local, foundation, like all not-for-profit kind of public entities, they need the same kind of operations research that we do for the military. So they opened up the Institute for Public Research. So CNA comprises both the institutions. and the FFRDC. And I joined on the Institute for Public Research, but now I kind of work on both sides. Brian: so a lot of your recent focus has been planning around civil defense and and such. What is changing in the United States that necessitates this this shift in in focus on things? Dawn Thomas: Yeah, so I started getting into this topic because of what was going on in the United States and then also what was going on in my work world. So I started supporting the war gaming team. And as you can imagine, a lot of the war games that the military looks like have to do with China and Taiwan. So we were kind of seeing this increased threat from from China and kind of picturing maybe a nation at war. And then also looking at North Korea, Iran. Russia and looking at cyber capabilities, looking at information operations. and it all kind of swirled around this idea for me that, you know, I grew up in global war on terror, GWA, right? My that's my degree. But it was it kind of just all converged that we're not really, that the threat is not as much like one bomb going off in one place, although that absolutely could happen, but that the threat has grown because we're now talking About kind of nation-state adversaries, so peer-to-peer, and that the ability of even countries that don't have like a navy to reach across the oceans and think us if they ever needed to, because of cyber and because of information operations, the threat was real and you could see it now. So it was just over time leaving that GWAT kind of mentality and that kind of planning to a much less larger thinking about not only a nation at war, but a nation even before war at conflict, and and what that might look like for consequence managers who are the folks that I ended up working with a lot. Brian: So you're thinking about things that a lot of people don't want to think about. Dawn Thomas: Yeah, it's the kind of stuff that makes you hide under your bed. I say it all the time, like after we talk, I'm always like, I'm like, but there's things you can do, right? Cause I wanna raise people's spirits. Yeah, it it's it's big stuff that people don't want to talk about. And interestingly, from both sides don't think the public is ready to hear, which I find fascinating. that that there is this threat. Kind of our intelligent community knows it, our military knows it. We've been planning towards kind of nation-state against nation-state within the next 10 years, but we don't talk about it as a society. We certainly don't talk about it as civilians. but it rapidly became my world and kind of my worldview, and trying to bring it over to the civilian side, the consequence managers, the emergency managers, the law enforcement, public health, kind of understanding these nation-state threats are different, and that the consequences are gonna be different, and that I really feel like both sides need to have equal understandings to both. be able to fight a war, but also to deal with the consequences of that war at home. Brian: Right. I I feel like a lot of times that sort of thing gets swept under the rug, but with the recent cyber attacks with on operational technology across like water and waste systems and that sort of thing. Do you think the public is being, you know, more aware of it now? And, you know, what what other vulnerabilities are there out there that we should be worried about? Dawn Thomas: Yeah, so more aware, it's amazing what a short little memory the public has a whole has, right? But I do feel like we're we're kind of at like a nineteen ninety-three scenario where the World Trade Center gets attacked. But nothing tragic happens, right? The loss of our lives, obviously, that is a big deal. And it should have woken us up, but it wasn't tragic like the future 9-11, right? I feel like we're maybe at that same point with nation states with cyber, specifically with cyber attacks and operational technology that runs our water and our electricity and our telecoms. I hoped it would wake us up. Like six months ago, a colleague and I were kind of going throughout the country and saying, like, hey, our water assistance. very vulnerable and if anyone gets mad at us, right, they're kind of well positioned to to to mess around. and now it's happened. so I I I think maybe there's a growing awareness certainly in the utilities, right? The utilities are talking more about this, but the general public, I don't think awareness has necessarily gone up because nothing there was no consequences. Like if you didn't have water for four months because actually something broke as a result of the meddling, the public would absolutely be aware of it. but they stopped it, they kind of turned things off, they did things manually until it was rectified, and so the public could really. remain blissfully unaware. What we should be expecting though, I think it's a function of where we are in any sort of conflict. So right now we're we're between competition and conflict, especially when it comes to Iran. And what is gonna get hit is really based on the phase we are. So if you think about like the first stages of a war, if we ever got to that, you'd want to project force. Right? So the things that we really need to be careful about are those things that support that projection of force. So you think about like ports, right? You think about defest defense industrial base that creates those critical things that go out the door first. You think about the military installations that have things that fly, right? You you think about like what could be done train systems like transportation, things that would keep up delay us, right? They wouldn't keep us forever, but it would certainly delay us getting to the fight. So that would be first. I think if there's anything prolonged after that, then what gets attacked is The will of the people, right? So think information operations, think long-term power outages that aren't necessarily at a military installation, it's just a community, turning off water in a community, those kinds of things that really decrease the will to fight within America and really attacks those cleavages that already exist. Brian: certainly it would make people aware of what's going on. Dawn Thomas: It would. And again, I will emphasize you see little pieces of this already, right? There's there's Brian: Mm-hmm. Dawn Thomas: enough intelligence that you know, Russia doesn't they've gotten lazy because they can't, they don't even need to make things up anymore. They just find the most divisive things within our social media platforms and just promulgate it, right? So it's already happening now. We already know that China's in our systems, that Russia is doing information operations. It's just so low level and it's it's not even at the nuisance level yet for the average American. Brian: Right. So even when all this is going on, it seems like funding is decreasing, which probably makes it harder and harder for local municipalities and businesses to deal with this. Is is there any s solution on the horizon for that? Dawn Thomas: It's it's mind-boggling to me how so when I work with the military and we talk about kind of what they need for mission assurance, right? They I I shorthand it as keep the trains running. They need the civilian side to keep the trains running. And both that means like keeping actual trains running, but also just the continuity of society, right? Like we need to keep going to work. We need to keep producing things. We need to work at our ports, right? And our terminals. We need to keep working. so that's on the military side. on the Consequence management side on the public sector side, even if we're not thinking about war, we're at a time where there's extreme weather, right? And there's aging infrastructure. So no matter, even if we never went to war over Taiwan, emergency management would be in a position, and and police and fire and public health, where they're dealing with, you know, outbreaks, when they're dealing with prolonged outages of services because there's a storm and then that system was just old. Right, water in Flint, well almost water in New Orleans, right? So all of these things are at a point where consequence management is going to become bigger and bigger at the same exact time when funding is shrinking. and while I do believe that you can do the most specific actions and planning and response at the state and local levels, it still requires funding. funding kind of going away as well as a lot of expertise that's gone away on all levels. It's a very, very frightening time for for a nation state threat to be kind of looming as well. So again, I told you I wasn't gonna just make people hide under the bed. So, like what can you Brian: Yeah. Dawn Thomas: do about it? Like I think there's there's things that we can do about it. So some of it is just re shifting the way we do planning, right? You have to do planning anyway, but instead of planning for a for a week long power outage, what does it look like to plan for a four month power outage? Like how does that look different? 'Cause it definitely looks different. Brian: So are organizations doing that now or is it is it mostly on the short term? Yeah. No. Dawn Thomas: No not that I've seen. Not that I've seen. So you know, utilities generally, the bigger utilities have excellent cybersecurity, they've excellent planning, they've excellent response systems. It's the small ones that don't have the funding. Like I we all knew water would be first, right? Because there's a hundred and fifty thousand water providers in our country and many of those are very, very small kind of co op kind of places. And yeah, they don't supply water to a lot of people, but they supply water to people. Right. Brian: These are mostly small communities. Yeah. Dawn Thomas: Yeah, exactly. And the things that are gonna like get cut off, you know, y we all remember the kind of islands that people talked about in North Carolina. It's just up on a hill, right? But if you cut off things for them and you can't get to them, then it creates this island where you can't get resources. So it really frightens me that even though the big organizations, the big youth you know, electricity, water can take care of themselves, the smaller ones can't. And then also I think cybersecurity, it It baffles my mind that we would expect any small water company to be able to withstand attack from like Iran, right? Like a cyber attack. it just it doesn't see it's like David and Goliath, except for in this case, Goliath's gonna win every single time. because Goliath has, you know, way better tools in its toolbox. and that small water company can't protect itself. So I think people just don't see that through Brian: But I assume people just don't see that threat or see it as a threat, right? Like why why would somebody attack a small community, right? Is is is what people were thinking. Dawn Thomas: I I think even the Exactly, right? Is what people are thinking or they don't think it'll be successful or they think, well, we can stop that Or they just really don't think about the consequences. I mean, even a community of five thousand people think, like a very small, small area with no water, that means they have no hospital, they have no firefighting capabilities. It becomes a public health issue very, very quickly. Schools can't run, you can't flush your toilets, right? Like there's a lot of issues that becomes a very big problem, even for a very small community. So I think there's a lot of hand waving about this threat and about the impacts that are that are possible because of the threat. Brian: That's just the question. Dawn Thomas: No, it's a great question. so recently I've been thinking about private sector. I always think about private sector because I know that they're the answer in a lot of ways to a lot of our consequence management problems. but I never thought about them until recently about A solution to our planning issue. Right? So when I think about businesses, businesses, you know, they could be in the public good as well, but they also do need to make money, right? They need to pay their people. So they have a bottom line that they need to protect. And I think how you protect that bottom line, how you keep the trains running, how you keep the economy going and people working, is to make sure that there's a level of preparedness at that. private sector level. Like how do you get every all your employees to be prepared enough so that if you're out of water for four months, they can still come to work. How do you run your company without water for four months? Like what are your solutions gonna be? I think it might be without money going to locals and you know less money going to states. I think there is a really big solution in private sector to be to be altruistic, but also because that's that's the business, right? Their business is to bring in money and to create a service or a or a widget. so I think that the some a lot of the answers might lie in the private sector. I think some other answers probably lie in DOW. I think when we think about mission assurance and how you can make sure that you're getting troops to where they need to go to project force, that there's that there's more that DOW could do. And there are programs right now for helping locals plan in very specific places, and it's an excellent program. but it's limited. It's it's limited in how many people are working it and how much money they have. but that could absolutely help at least some communities that have some defense industrial base or some critical production like you know, IV fluids in Puerto Rico, that kind of example, where in order to keep society going, right, and you do need society to keep going if you're gonna project force and or host a war or you know, hold a war, that that DOW could be helping with some of that planning as well. and and they have Great planners that plan all the time and they have funding. Brian: They just need to work together, right? Dawn Thomas: Yeah, work together. Like, absolutely. Like, DOD has funding. Like, there is no question that they have a lot more funding than any local community I know. So, using that funding and using those planners to work with local communities and being like, okay, community, if you don't have water for four months, if you don't have electricity for four months, like how are you gonna function? Because we DOW. You need you to function. Now that obviously doesn't cover everybody in the United States, but it would at least get at least get a start. Brian: So sounds like working together and businesses having a budget or a line item more than a line item saying, Okay, we need to think about resiliency and and and what what to do here. So Dawn Thomas: government, you know, w government's talked a lot about private sector in like say like the last eight years, right? That's I'm throwing out a number. It's but around there. Like we started talking about whole community, we started about our private sector. And we started down this path of like business EOCs, right? I'm sure a lot of local communities have one or or know of one. But I think we We saw it as like this information sharing space that we would share information with with industry and they would share information with us, which is great. That is a great start. But like my model, I think, relies on a lot more integration in actual planning, right? Because you can't do response and recovery if you didn't do the planning. So planning how your local businesses could help your city or your local community. and you know writing it down as as planned should be. and then Brian: Right. Dawn Thomas: and then being there during response and recovery in a much more practical way than maybe we've talked about for the last X number of years. Brian: is there something you'd want to tell a leader, you know that that say they want to do like a rapid assessment of their organization resiliency. What are like the top couple of things that they should they should look for and and prepare for? Dawn Thomas: So I think the first thing is so most people have a continuity plan or a business continuity plan, right? And they have mission essential functions, right? So they know what it is is at the core of their being. But I would say that one of the first things they can do is look at those mission essential functions and align them with the people, the equipment, the facility, the systems, and the data. that go into that mission essential function happening. It's like a deeper dive into continuity. And I think anyone could do that, right? Just start asking questions. All right, what when we do this mission essential function, what what are we, what are our fingers on? Do we need a computer, right? If we're in a computer, what system are we using? If we're if we're online, what vendors products are we using? what data do our things rely on that are buzzing in the background? that we don't think about, but they're there. what people do we need to do it? So, you know, like COVID, right? Like ha can I do what I do with a twenty-five percent reduction in force because people are staying home with kids because schools are out, right? that's it's a deeper level of continuity planning that I think any organization could do, whether private sector or public sector. And I'd also say that that deeper level can include an element of time, right? So re-looking at mission essential functions and being like, okay, if we're out for one week, what do we need to be able to do? If we're out for two months, what do we need to be able to do? If we're out of whatever it is, like water, electricity, if we're out for four months, Brian: Yeah. Dawn Thomas: What is the really no crap things that we need to be able to keep doing? and then kind of rally the the troops around those things that are like, yeah, we really have to keep doing that. Because in in every scenario I can think of, there's gonna have to be a prioritization process. Right? You can't do everything with less. You can't do it everything with less people, with no electricity, with telecoms being down. and then if those things are like, okay, no, we really have to do those, then what are your backups, what are your backup communications look like? What are your backup processes look like? What are your backup systems look like? What's on-prem, what's off-prem. I would I would frame all of this as like a deeper dive on continuity. not I think like we used to think of continuity as like I can't work in my building anymore. Where am I gonna go and what's gonna be there so that I can keep working and I think that idea of continuity with kind of cyber on the table and with disruption of lifeline services on the table, that continuity is a a little bit old fashioned at this point. So I think this refresh Brian: Yeah. Dawn Thomas: about a deeper dive into what continuity now really looks like is something that any business could do kind of over the next few weeks. Brian: I think it sounds like if companies or municipalities or such made an effort to plan ahead, then maybe this might be a little less scary. Maybe. Dawn Thomas: Right. So I think back to COVID again, right? The solutions that we had for things in the beginning were not the solutions we had for things later. And a lot of that was we didn't understand how long it was gonna last, right? And I think that way when I think about lifeline services too. If you don't have water for two weeks, the solutions that you're gonna use are really different than if you know you're not gonna have water for four months. Right. And so it it flattens the curve of finding solutions and then getting to them. Yeah. Brian: Well, thank you very much for your little deep dive into the civil defense and what's going on. And hopefully we didn't scare too many people. Dawn Thomas: Hopefully we didn't scare them except for in the right way of like thinking about it and being more prepared. Yeah. Brian: Right, right, right. Well, thank you very much, and thank you for tuning in to the decision advantage.