WEBVTT
00:00:07.559 --> 00:00:19.097
Your brake may fail, and your car is starting to skid out of control because you're going at 65, 70 miles an hour, and your car is starting to fail and you look right, there's a car, you look left, there's a car.
00:00:19.378 --> 00:00:27.542
You can't veer off, This role now of cyber, is a risky role for all of us as a civilization.
00:00:27.602 --> 00:00:30.442
It virtually could disintegrate civilization
00:00:33.002 --> 00:00:36.661
Welcome back to part two of our discussion with Dr.
00:00:36.661 --> 00:00:40.192
Ken Williams on the Engaged by Design podcast.
00:00:40.731 --> 00:00:55.881
In this episode, we move from curriculum design into the future of cybersecurity, AI, and why the human element is going to matter more than ever in, uh, coming months and years.
00:00:56.332 --> 00:01:00.222
So let's rejoin the conversation with Vernon and Ken
00:01:01.688 --> 00:01:04.927
I wanna talk a little bit about what your role is now.
00:01:05.009 --> 00:01:08.088
Uh, you, you also exited American Public University.
00:01:08.188 --> 00:01:08.567
And
00:01:08.623 --> 00:01:08.864
Yes
00:01:08.867 --> 00:01:17.356
about your position, what you're doing, and, uh, some of the, not only the things in your university, but what you've done statewide in Louisiana
00:01:18.149 --> 00:01:19.108
Thanks a lot, Vernon.
00:01:19.188 --> 00:01:36.968
So after exiting American Public, I was able to, uh, to stand, uh, to, to align with a brand-new project to stand up a, a center, uh, an academy training center in Quantico Marine Corps Base, uh, with CyberByte at that point.
00:01:37.009 --> 00:01:50.114
A brand-new concept from the, uh, uh, from the, the board, the supplier, the investors at that point, that they wanted to stand up a, an accredited program outside of Quantico Marine Corps Base.
00:01:50.295 --> 00:01:52.655
So they asked me to, to lead that effort.
00:01:53.135 --> 00:02:01.435
And I accepted that, of course, from all of the, the lessons that I've learned and all the experience that I gained at APUS and working with you, Vernon.
00:02:01.454 --> 00:02:02.935
And again, you're an organizer.
00:02:03.105 --> 00:02:05.215
You're a task designer.
00:02:05.364 --> 00:02:13.245
Um, and, uh, also when I listened to your, to the first broadcast with you and, and Michael, it was there.
00:02:13.685 --> 00:02:15.004
Uh, you know, uh, you...
00:02:15.164 --> 00:02:18.784
As a matter of fact, I, I now use RACI, by the way.
00:02:19.824 --> 00:02:20.223
Do you?
00:02:20.224 --> 00:02:34.544
In every environment, I sell that concept about having right individuals in place, the mentoring in place, uh, and the supporting the team towards an outcome.
00:02:35.025 --> 00:02:44.551
So thank you for allowing us to talk, to introduce and educating me about RACI and how to manage an effective team and build an effective team.
00:02:44.961 --> 00:02:46.072
And that's what I use.
00:02:46.171 --> 00:02:51.081
I took that with me everywhere that I went, including this cyber academy.
00:02:51.592 --> 00:03:00.162
I was able to stand up in a brand-new$10 million dollars building and go through the Virginia certification process SCHEV
00:03:01.106 --> 00:03:01.347
So let's,
00:03:01.391 --> 00:03:02.151
and get approval
00:03:02.326 --> 00:03:04.846
about the, uh, the cyber, you know, this place.
00:03:04.906 --> 00:03:06.805
It's a specialized lab, right?
00:03:06.884 --> 00:03:07.125
It's,
00:03:07.561 --> 00:03:07.941
Yie
00:03:08.104 --> 00:03:14.284
for someone who's not familiar with cybersecurity, are you able to do there that you can't do other places
00:03:14.853 --> 00:03:15.372
Yes
00:03:15.406 --> 00:03:19.625
have this equipment and this, you know, the, the infrastructure that you put in there?
00:03:19.990 --> 00:03:20.810
Thanks a lot, Vernon.
00:03:21.150 --> 00:03:25.930
So with the$10 million, both, that include both the building and this classroom.
00:03:25.969 --> 00:03:28.110
There's was three levels in this building.
00:03:28.129 --> 00:03:49.500
The first floor was a five-classroom, fully outfitted computer with a Cisco telepresence, on site, and, an online capability, that we were able to partner with CompTIA, EC Council, and Cisco to use their,
00:03:49.622 --> 00:03:50.002
Great
00:03:50.219 --> 00:03:51.400
knowledge, yes.
00:03:51.483 --> 00:03:52.122
partners
00:03:52.229 --> 00:03:54.330
And why partner with those individuals?
00:03:54.430 --> 00:04:09.030
Those were the individuals that had the certifications that, uh, CompTIA, EC Council, CISSP, et cetera, that the workforce needed, that, uh, that all, by the way, was mapped back to the knowledge, skills in the center of academic excellence.
00:04:09.610 --> 00:04:30.029
But the special aspect of this were there were individuals in the workforce, especially in the Northern Virginia area, that were already in the workforce working for the federal government, working for employers, who had gone to school without a formal education and knew how to do it on ground, but they were not certified.
00:04:30.629 --> 00:04:42.350
So they wanted to find a way to get certified, and this academy was directly set up in order to get them certified in between five to seven days.
00:04:42.790 --> 00:04:56.769
To get them certification, get them into a boot camp environment that started at eigh- at 8:00 AM in the morning, ended at 5:00, and it was a really intense program that was able to get the individuals who are knowledgeable.
00:04:57.019 --> 00:05:04.089
The good thing about that, they were knowledgeable, they knew it, they were practitioners, seven years, eight years, but they didn't have the certification.
00:05:04.790 --> 00:05:06.110
So we were able to prepare them
00:05:06.593 --> 00:05:07.052
Mm-hmm.
00:05:07.512 --> 00:05:07.853
Mm-hmm
00:05:07.860 --> 00:05:14.482
get them certified and get them out there to the workforce and, um, and get them in an official thing.
00:05:14.581 --> 00:05:23.300
Now, Virginia required that to do any training in Virginia, that you had to be certified to be legitimately certified.
00:05:23.872 --> 00:05:25.072
stamp of approval, right?
00:05:25.321 --> 00:05:25.841
That's right.
00:05:25.980 --> 00:05:27.762
So we were able to go through the process.
00:05:28.262 --> 00:05:42.201
You had to go there and go to a class and, and fill out this huge document, including bonds and pro forma, and they show how the classroom looks, and they come and they verify that you are able to facilitate an academy.
00:05:42.742 --> 00:05:47.781
Uh, and, and that was, that was an awesome experience because I never thought I would go through that neither.
00:05:48.262 --> 00:05:58.201
So I was able to go through the process and get the stamp of approval, Virginia SCHEV certification, and we were able to open the doors,'cause you couldn't open the door to accept a student until you got the SCHEV certification.
00:05:59.122 --> 00:06:10.952
But it was a great, asset for Quantico, the location of the individuals who worked in the, with the Pentagon and all of the defense, industrial-based individuals there who live in that area.
00:06:11.273 --> 00:06:12.713
They were able to come to school.
00:06:12.793 --> 00:06:19.372
They were able to get off of work and get one week of training and certification because their jobs depended on it.
00:06:20.233 --> 00:06:21.312
That's a lot of pressure.
00:06:21.403 --> 00:06:26.533
Ken-- talk a little bit about, you know, take a step back and talk about why this is so critical for national security
00:06:27.480 --> 00:06:29.562
So, as, as those,
00:06:29.701 --> 00:06:30.420
expert at this.
00:06:30.521 --> 00:06:31.002
There's,
00:06:31.180 --> 00:06:32.581
thank you so much, Vernon.
00:06:33.081 --> 00:06:33.521
with this c-
00:06:33.540 --> 00:06:34.120
Thank you.
00:06:34.240 --> 00:06:35.180
Yes, indeed.
00:06:35.382 --> 00:06:35.802
Yes, indeed.
00:06:36.201 --> 00:06:59.430
So, you know, Vernon, as I explained earlier in my career, those soldiers and my com- my, you know, my support individuals in the Marine Corps, Army, Navy, uh, were-- they are the highest, they're the highest skilled, uh, military force in the world, bar none.
00:07:00.048 --> 00:07:00.269
Okay.
00:07:01.189 --> 00:07:02.569
Now, the knowledge and skills,
00:07:02.632 --> 00:07:03.132
Agreed
00:07:03.488 --> 00:07:11.408
yeah, those knowledge and skills are born out of our service academy, of which there are four, uh, four of them: Army, Navy, Marine, and Coast Guard.
00:07:11.619 --> 00:07:14.579
We drill our, our forces through those academy.
00:07:15.298 --> 00:07:17.738
And those academy are boot camp style.
00:07:18.278 --> 00:07:29.918
They're knowledge-based, uh, outcomes, and we take them through six months to a year to get them, get them experts in their field as practitioners.
00:07:30.759 --> 00:07:36.139
Just like a, just like a, a medical professional at the early stage, we introduce them to those concepts.
00:07:36.178 --> 00:07:41.559
And then we send them out there into the, into the work environment to let them become embedded into the knowledge and skills.
00:07:41.579 --> 00:07:47.939
And then, of course, we bring, we bring them back in about seven years or so to get a more at the middle-level expert expertise.
00:07:48.699 --> 00:07:57.059
So to kind of reiterate again, so you get intro- initial introduction to IT skills, cyber skills, uh, AI skills.
00:07:57.119 --> 00:08:02.978
And, you know, you sort of, kind of getting an idea with the vocabulary, with the skills, et cetera.
00:08:03.499 --> 00:08:06.677
Um, and you get out, you graduate, you get your degree, and you go to work.
00:08:06.738 --> 00:08:09.199
Now, when you go to work, you really don't know much.
00:08:09.658 --> 00:08:13.999
You're trying to get everyth- all these knowledge and skills and the cobwebs, and people are there.
00:08:14.059 --> 00:08:17.798
But the good thing about that is you've got mentors.
00:08:18.879 --> 00:08:24.259
You've got people taking you along, answer your questions, uh, you know, take, uh...
00:08:24.519 --> 00:08:35.259
Gradually allowing you to get more hands-on-keyboard, fix things like the network, fix things like the server, practice, eventually solve the cyber issues, patch, uh, systems, et cetera.
00:08:35.658 --> 00:08:37.019
And then you start to get confidence.
00:08:37.058 --> 00:08:41.219
In about two years, three years,"Oh, you know, this is really good.
00:08:41.438 --> 00:08:41.899
I, I can start.
00:08:41.979 --> 00:08:50.938
I'm getting it right now." And all those things you learned earlier on in school, uh, it's starting to,"Oh, yes, we learned about this." You're starting to recall, right?
00:08:51.538 --> 00:08:52.798
And that's the process of learning.
00:08:53.068 --> 00:08:59.318
And we know as academians that you, you, as you start to-- You get the initial introduction to the concepts.
00:08:59.619 --> 00:09:07.808
When you get into an environment like like the interns and, and, and, uh, and like the medical professionals, et cetera, it's, the light bulbs start coming on.
00:09:08.460 --> 00:09:08.879
Right
00:09:08.989 --> 00:09:16.828
n- so now you're now at the seventh year or so, the ninth year, and you're feeling more confidence now.
00:09:16.908 --> 00:09:19.408
You're left alone in order to design things, et cetera.
00:09:19.889 --> 00:09:22.048
And, and then we said,"You know something?
00:09:22.568 --> 00:09:26.408
We need you to go to the, to the next level of, of, of effi-efficiency.
00:09:26.479 --> 00:09:33.149
Now we need for you to connect systems together, manage projects, and train individuals, et cetera.
00:09:33.448 --> 00:09:42.988
So we need you to be re-schooled." Or what, or what industry is called, we need for you to upskill, because learning is a continuous process, right?
00:09:43.438 --> 00:09:45.928
So in order for you to upskill, you got to go back to school
00:09:47.152 --> 00:09:47.451
Yes
00:09:48.316 --> 00:10:00.426
And to go back to school, either you're going into a graduate program and, or you're going, in this case, this academy allows you to go to a higher level now of your skills.
00:10:01.167 --> 00:10:12.546
And your skills, you don't need the full level of learn- of getting the certification, industry certification, because you're already proficient with it, but you're just kind of validating.
00:10:12.667 --> 00:10:23.206
You're validating what you know, and you're getting a certification that tells individuals,"Look, this person is now an expert." You're now an ex- it's like the mechanic, right?
00:10:23.470 --> 00:10:24.409
Yeah, they're legit.
00:10:24.471 --> 00:10:25.070
They're good.
00:10:25.110 --> 00:10:25.269
They
00:10:25.385 --> 00:10:25.426
The...
00:10:25.426 --> 00:10:25.885
That's it.
00:10:26.385 --> 00:10:26.687
That's it.
00:10:26.745 --> 00:10:33.090
So there's a badge of honor, that, look, you have earned this and you are now a practitioner.
00:10:33.909 --> 00:10:38.500
You are now really, really knowledgeable what you know, and so here's your credentials.
00:10:38.538 --> 00:10:42.759
And that is what this academy provides, the training academy provides
00:10:43.254 --> 00:10:46.774
You know, there's a theme I also see here, Ken, and maybe you'll comment on it.
00:10:47.535 --> 00:10:58.855
During the time that I worked with you in the degrees, you recognized this sort of gap between the academic approach and what was actually needed in industry certification.
00:10:59.855 --> 00:11:03.955
and y- I, I'd like to just talk about how, you know, we had this conversation.
00:11:04.054 --> 00:11:16.095
You said,"You know, Vernon, if we really want this to be the best of the best, we need to embed these certifications into our curriculum." Would you talk a little bit about, you know, w- what you did?
00:11:16.923 --> 00:11:17.923
Absolutely.
00:11:17.934 --> 00:11:19.076
course, you're right, and so,
00:11:19.263 --> 00:11:20.743
Absolutely, Vernon.
00:11:21.163 --> 00:11:21.683
Absolutely.
00:11:21.783 --> 00:11:22.283
So when I
00:11:22.754 --> 00:11:23.274
this is important?
00:11:23.315 --> 00:11:30.715
I, and we're getting to the larger issue of not being so far from the real world in academia that you're not doing something that's actually practical.
00:11:31.359 --> 00:11:31.678
Yeah.
00:11:31.719 --> 00:11:32.639
Thank you so much, Vernon.
00:11:32.720 --> 00:11:36.679
So, so two things sort of informed that, uh, Vernon.
00:11:36.720 --> 00:11:43.120
Of course, I, I talked about my vast industry experience of actually doing it, flying drones.
00:11:43.178 --> 00:11:47.719
You know, I was involved with the very first drone project, by the way, called Global Hawk.
00:11:47.778 --> 00:11:50.958
They're still flying out there with the National Intelligence Systems.
00:11:51.038 --> 00:11:51.918
We were underground.
00:11:52.379 --> 00:11:53.538
We had to do it.
00:11:53.599 --> 00:11:56.519
We had to have the most efficient processes in place.
00:11:56.818 --> 00:11:57.958
There were no gaps.
00:11:58.408 --> 00:12:02.309
The emails had to get through, voicemail had to get through, everything had to be done on time, right?
00:12:03.129 --> 00:12:10.448
So when I came into academia, I recognized that the curriculum was not designed for that.
00:12:11.448 --> 00:12:25.443
The curriculum was missing the real world knowledge of this student going to school for four years, three to four years, and learning this and getting this degree that's called cybersecurity.
00:12:25.724 --> 00:12:34.725
And when they get to the industry, um, like for example, one, uh, one, uh, industry, manager, CI- chief information officer said to me, he said,"Dr.
00:12:34.784 --> 00:12:50.565
Williams, you know, when those students come here and I take them to an interview, and I ask them what is a data at rest and a data transit, which is at the first year in s- in freshman that, uh, you're taught in the cybersecurity, or CIA, what is CIA?
00:12:51.186 --> 00:12:54.245
Confidentiality, uh, you know, integrity and availability,
00:12:54.429 --> 00:12:54.769
Mhm
00:12:55.065 --> 00:13:01.302
don't know." And I was like,"Oh my gosh." And that was a wake-up call.
00:13:01.861 --> 00:13:12.500
That was a-- not only was it a wake-up call that this curriculum, this, that we have is so f- is so much not in sync with what industry expect.
00:13:12.780 --> 00:13:18.421
Because the industry individual, they're more passionate about getting this individual to work and doing what they're supposed to do.
00:13:19.120 --> 00:13:20.341
They respect academia.
00:13:20.360 --> 00:13:21.280
They respect us, right?
00:13:21.360 --> 00:13:23.880
Because we are, you know, we've got this role of educating.
00:13:24.822 --> 00:13:32.801
But they demand that we provide to them, upon that interview, someone who understand their business as well.
00:13:33.422 --> 00:13:40.441
We want the individual with the degree, but we also want individuals who are technically competent so we won't have to retrain them.
00:13:41.000 --> 00:13:56.860
So what happened over time was that industries keep on saying,"Well, there, there's a gap between individuals graduating with a cyber degree, IT degree, and those who are industry, and somebody please help us." So what happened was that industry, uh, individuals, they made it themselves.
00:13:57.221 --> 00:13:58.640
CompTIA stood up.
00:13:58.701 --> 00:14:00.681
EC-Council became very relevant.
00:14:01.001 --> 00:14:02.301
Cisco became relevant.
00:14:02.642 --> 00:14:08.561
And there were industry individuals tr- in the training world who said,"You know, w- industry, we're gonna meet your gap.
00:14:08.601 --> 00:14:11.360
We're gonna meet your acts because academia is not doing it.
00:14:12.020 --> 00:14:14.541
We're gonna stand up these certifications." Right?
00:14:14.980 --> 00:14:18.980
And they built the certification, and they got recognized as, uh...
00:14:19.260 --> 00:14:23.422
And, and the Department of Defense, the NICE framework started to recognize that that's what they need.
00:14:23.461 --> 00:14:25.061
There were now knowledge levels that were needed.
00:14:25.142 --> 00:14:26.841
Industry said,"Yes.
00:14:26.900 --> 00:14:29.140
We don't know what we want, but we see what we got.
00:14:29.181 --> 00:14:30.701
We-- That's what we want," right?
00:14:31.480 --> 00:14:34.730
So they built it for industry to accept it and we know it.
00:14:34.791 --> 00:14:40.320
So when I came along and I got into academia, I was like And where is academia now?
00:14:40.859 --> 00:14:41.318
Mhm
00:14:41.419 --> 00:14:42.519
we play in all of this?
00:14:43.100 --> 00:15:10.711
Well, the only way to play in all of this is just adopt now what is, what was built by industry, and embed those certifications into this bachelor's degree, and restructure the degree, and matriculate it because we are, you know, we are empirical individuals, and we are scholars, and we know how to embed knowledge and skills into this new approach to this academia degree.
00:15:11.250 --> 00:15:20.780
So let's kind of map between the course outcomes, the weekly outcomes, the knowledge that these students need, and kind of make the best of both worlds.
00:15:21.260 --> 00:15:35.291
So the best of both worlds is a traditional, uh, you know, a degree with all of the knowledge units and approach to, to general ed approach and critical thinking, along with a practitioner practical knowledge degree.
00:15:35.910 --> 00:15:40.900
And that student now becomes more valuable than someone who, who doesn't have a degree,
00:15:41.725 --> 00:15:42.384
Absolutely
00:15:42.500 --> 00:16:04.201
that student knows now how to manage, do, as they go along in, in their role to become project manager, they understand how to manage a project, they understand how to financially save, they understand how to do risk assessment, they understand how to talk to C-suiters, they understand how to speak to, to stakeholder, all of those things are what we're doing.
00:16:04.561 --> 00:16:17.291
Now, simultaneously, while we were embedding those, uh, certifications to the degree, a project came about, it's funded by the National Science Foundation to, uh, to develop the NICE framework.
00:16:18.551 --> 00:16:21.291
They said,"Look, we've got two constituents here.
00:16:21.311 --> 00:16:28.400
We've got academia, we've got industry, we've got this demand there for both degree and certifications.
00:16:28.500 --> 00:16:36.620
Let's put the two of them together." And I was fortunate to be a part of that group, and let's map the, uh, the knowledge and skills
00:16:36.876 --> 00:16:37.316
Yes
00:16:37.480 --> 00:16:46.087
what a degree should be So we spent about a year mapping and developing this thing, the early version of NICE framework.
00:16:46.148 --> 00:16:49.298
And then when we did that, the NSF funded the, the thing.
00:16:49.359 --> 00:16:51.639
We as academia recognized the value of that.
00:16:52.058 --> 00:16:53.038
We need to be involved.
00:16:53.078 --> 00:16:55.479
If we not involved, then we, uh, we obsolete, right?
00:16:56.058 --> 00:17:06.199
Um, and industry took that and, uh, and then the National Institute of Standards of Technology, the NIST, decided,"You know, this is really good,"
00:17:07.159 --> 00:17:07.558
Yes
00:17:07.598 --> 00:17:08.838
and they took it over.
00:17:09.278 --> 00:17:11.019
And that is a world standard today.
00:17:11.398 --> 00:17:27.578
The NIST, um, is, is a world standard that, that maps the knowledge of the, the work roles, specifically to the certifications, and also talks about the value of the degree in that and all that.
00:17:27.619 --> 00:17:32.577
So this can, this both industry and academia was able to come together and find a synergy.
00:17:32.617 --> 00:17:44.958
So when we got the centers of academic excellence, the students were able to get that certification upon graduation that we give to them to tell them,"Look, you are now accepted.
00:17:44.998 --> 00:17:48.877
You are recognized by industry to be a valuable entity there is."
00:17:49.453 --> 00:17:49.875
That's wonderful.
00:17:49.994 --> 00:17:54.913
Now, those standards, you know, we're talking about quality here, so we're talking about, the three things of the iron triangle, right?
00:17:54.993 --> 00:17:56.874
We're talking about reducing costs,
00:17:57.761 --> 00:17:58.061
Yes
00:17:58.094 --> 00:17:59.255
acceleration with the degree.
00:17:59.314 --> 00:18:01.994
We're talking about, you know, increasing the quality,
00:18:02.605 --> 00:18:03.006
Mm-hmm,
00:18:03.054 --> 00:18:06.730
creating these standards and also boosting the access.
00:18:06.914 --> 00:18:08.854
Ken, when did you work on that framework?
00:18:08.874 --> 00:18:11.713
W- uh, it was it, was it after Quantico that you did that?
00:18:11.794 --> 00:18:12.815
Or where, where did you work on that
00:18:12.998 --> 00:18:20.117
Actually, I worked on it before Quantico when I was with American Public earlier on around 2016, 2017
00:18:20.397 --> 00:18:20.577
Yeah
00:18:20.699 --> 00:18:23.018
was when I was able to work, uh, work on that.
00:18:23.458 --> 00:18:39.358
And, you know, I was also, because I was in, in the industry as an inspector general, finished with as an inspector general, and started to work in, in- inside the industry,'cause I also served as a defense contractor, uh, subsequent to that as well.
00:18:39.939 --> 00:18:45.698
Um, I was invited to the table with a, uh,'cause I have a PhD in cyber and a CISSP in cyber.
00:18:46.138 --> 00:18:50.897
I have got all these years and years of practical experience.
00:18:51.317 --> 00:18:58.243
So I'm one of those individuals, the few individuals with that level of experience and academic, academic experience as well
00:18:58.915 --> 00:18:59.215
Oh yeah.
00:18:59.457 --> 00:19:04.797
Now Ken, I want you to put on that hat, and I want to sort of move a little bit to the future here for a second.
00:19:05.271 --> 00:19:05.531
OK
00:19:05.536 --> 00:19:09.946
And that is, you know, I'm opening up Pandora's box of AI right now.
00:19:10.290 --> 00:19:11.270
Okay, go ahead
00:19:11.446 --> 00:19:18.667
specific for you, and that is, you know, a lot of folks are saying,"Well, you won't need cyber folks anymore." This is...
00:19:18.707 --> 00:19:20.067
I don't believe this, but I'm gonna say it.
00:19:20.287 --> 00:19:25.287
The position is, you know, you don't need that because you're going to have AI that's going to be able to take care of this.
00:19:25.307 --> 00:19:27.346
And so in fact, we have what?
00:19:27.606 --> 00:19:28.767
Claude Mythos, right?
00:19:28.866 --> 00:19:29.287
Mythos.
00:19:29.327 --> 00:19:29.366
I
00:19:29.451 --> 00:19:29.851
Yeah
00:19:29.936 --> 00:19:40.175
Mythos that's, that's coming out, but they didn't even re- release it to the full public because they are worried about, you know, zero day vulnerabilities.
00:19:40.536 --> 00:19:48.816
Could we start with zero day vulnerabilities and explain that to, uh, uh, you know, our listeners here, and then talk a little bit, if you would.
00:19:48.855 --> 00:19:50.476
So let's start with that, and then I'll come back with another
00:19:50.559 --> 00:19:50.819
Yeah.
00:19:50.880 --> 00:19:51.740
Thanks, thanks, Vernon.
00:19:51.840 --> 00:20:02.921
And to be honest, that's probably was the underpinning of what occurred at the cyber infrastructure breach in OHA authorized, yes, that's the Canvas breach.
00:20:03.122 --> 00:20:04.040
That was a zero day.
00:20:04.580 --> 00:20:04.681
Uh,
00:20:05.272 --> 00:20:05.373
So
00:20:05.500 --> 00:20:05.941
and
00:20:06.272 --> 00:20:08.173
that into, in layman's terms that, that folks
00:20:08.401 --> 00:20:16.111
yes, so, you know, we patch and fix vulnerabilities when we know what those vulnerabilities are.
00:20:17.051 --> 00:20:20.070
At least we are expected to patch, and to, to fix the hole.
00:20:20.092 --> 00:20:24.090
You know, if you have a boat and it's leaking, then you patch the boat and stop it from leaking, right?
00:20:24.412 --> 00:20:28.211
If you have a door that the bolt, that their lock is broken, then you fix the door.
00:20:28.301 --> 00:20:32.521
If you get your car out in the parking lot today and you leave the car, you're gonna lock it before you leave, right?
00:20:32.563 --> 00:20:34.122
That, because it's a vulnerability.
00:20:35.481 --> 00:20:43.012
Now, if you're driving a car and, you may or may not notice a light on your dashboard
00:20:45.373 --> 00:20:45.692
Right?
00:20:46.761 --> 00:20:52.381
and, or this faint light on the dashboard, and you maybe ignore it.
00:20:53.442 --> 00:20:55.701
It's not really a zero day, you ignore.
00:20:55.760 --> 00:21:09.260
But, but that, but that inevitable thing of your car that's occurring, such as a failure of some module, et cetera, and you're driving at a very high rate of speed, and all of a sudden the light does come on.
00:21:10.480 --> 00:21:16.361
You may be in a, in a rush hour traffic, you may be in a six-lane highway, um, just your brake failure.
00:21:16.601 --> 00:21:29.520
Your brake may fail, and your car is starting to skid out of control because you're going at 65, 70 miles an hour, and your car is starting to fail at a point, and you look right, there's a car, you look left, there's a car.
00:21:29.800 --> 00:21:31.121
You can't veer off, et cetera.
00:21:31.541 --> 00:21:33.181
You're now in a panic, right?
00:21:33.681 --> 00:21:36.721
Uh, and you can't stop, you can't brake because of the car behind you, right?
00:21:37.601 --> 00:21:38.461
That is zero day.
00:21:39.101 --> 00:21:43.641
That is an unknown, unpredicted emergency.
00:21:44.181 --> 00:21:45.520
It is there in front of you.
00:21:45.641 --> 00:21:45.882
It...
00:21:45.901 --> 00:21:51.881
But the reciprocal to that is that you had this knowl- and, and that's a good i- the g- good analogy.
00:21:52.402 --> 00:21:59.500
Something, a brake light comes on and warning to tell you, you have some low, uh, low brake fluid that could possibly fail.
00:22:00.121 --> 00:22:03.401
Get to a mechanic, get to a shop to get it fixed.
00:22:03.442 --> 00:22:04.541
You probably ignore it, right?
00:22:05.336 --> 00:22:05.477
Yeah.
00:22:05.577 --> 00:22:10.297
Well, if you're s- you know, I, I won't say names, but you know, we've both in our families have probably experienced
00:22:10.614 --> 00:22:10.993
That's right.
00:22:11.913 --> 00:22:13.193
But carefully you'll get it to the...
00:22:13.263 --> 00:22:13.983
And you'll fix that.
00:22:14.094 --> 00:22:17.584
So when you fix that, you've just taken care of the vulnerability.
00:22:18.733 --> 00:22:20.953
So that's a vulnerability that's taken care of.
00:22:20.993 --> 00:22:28.693
But the one where you didn't know about, and you're driving on a road and all of a sudden even a tire blowout, that is a zero day.
00:22:28.794 --> 00:22:33.653
That has happened right away, and that point you weren't prepared for it.
00:22:34.407 --> 00:22:35.807
And that could be small scale.
00:22:35.968 --> 00:22:36.087
It...
00:22:36.208 --> 00:22:44.268
I mean, it could be, let's say, you're in a, you're in a good place where your tire is blow- Like, let's say you've got those run flat tires, right?
00:22:44.708 --> 00:22:47.087
Uh, you probably have those, and you get an indicator.
00:22:47.188 --> 00:22:48.847
I had it by my feet cold.
00:22:49.528 --> 00:22:57.607
And I see, I see the light that says,"Uh, tire pressure's going down, but you're safe to find a safe place." And that was a run flat, flat tire, right?
00:22:57.988 --> 00:23:00.948
I was able to safely get off the road and get my tire changed.
00:23:01.428 --> 00:23:04.708
Or some tires that go poof, and you feel.
00:23:04.788 --> 00:23:14.228
Now, now if you had the time to, to get off the road and get that, mitigate that issue, uh, you know, you, you pretty much have taken care of that.
00:23:14.448 --> 00:23:16.008
That's a low vulnerability.
00:23:16.087 --> 00:23:18.508
That's a low level of vulnerability that you are there.
00:23:18.827 --> 00:23:19.367
But you've...
00:23:19.448 --> 00:23:33.817
If you in this, in this traffic, and you're going high speed, and that, that tire blows out at that point, that's something catastrophic that has just occurred to you right there, and that is what the zero day vulnerability is.
00:23:34.298 --> 00:23:42.097
And, and vulner it's something, you know, to be honest, it's maybe something that we are now gonna live with, especially with AI.
00:23:42.758 --> 00:24:00.458
Especially with AI, because what AI does is AI advance the process where a human would be alerted to this blowout, um, by allowing the hacker or the malicious individual to see it before I do.
00:24:01.917 --> 00:24:05.958
If they're scanning the networks, in this case it was a phishing attempt, you know.
00:24:06.377 --> 00:24:10.156
And we all have phishing, we all have individuals who will fall prey to something, right?
00:24:10.278 --> 00:24:11.428
Um, but
00:24:11.540 --> 00:24:16.000
a friend in Africa that received an inheritance and needs you to help...
00:24:16.121 --> 00:24:16.580
Yes, no.
00:24:16.922 --> 00:24:17.221
Yes.
00:24:17.461 --> 00:24:17.540
not,
00:24:17.641 --> 00:24:17.861
Yeah
00:24:18.000 --> 00:24:20.482
uh, as blatant as those, but it's much more sophisticated.
00:24:20.522 --> 00:24:21.182
We should say that.
00:24:21.461 --> 00:24:29.301
They are much more sophisticated, and with AI, the phishing and the, the other attempts are even more s- you know, complicated, and they're
00:24:29.487 --> 00:24:29.886
yes.
00:24:30.382 --> 00:24:30.542
They're
00:24:30.686 --> 00:24:30.967
Yeah.
00:24:31.586 --> 00:24:38.906
And, and, and, you know, the, the more insidious aspect of this was that we've got this thing now that's called two-factor authentication.
00:24:40.227 --> 00:24:43.507
By now, just about everyone is being two-factor authenticated.
00:24:43.807 --> 00:24:45.527
"Oh, do you trust this browser?
00:24:46.007 --> 00:24:57.497
Could I send a link to you in your, in your known, uh, you know, device for you to put in this code?" And, oh gosh, we've gotten really, really good and trustworthy with this now, right?
00:24:57.527 --> 00:25:05.186
So now we're two-factor authenticated, and we are feeling more confident that whatever we do after we authenticate, guess what?
00:25:05.227 --> 00:25:05.646
It's okay.
00:25:06.366 --> 00:25:27.067
Well, what AI did in this case, and it's continued to do, is that i- once we authenticated our bank account and we're sitting there, uh, doing some transaction in our bank account, this pop-up occ- appears that tells us,"Oh, you know, Mom just emailed this thing to us in case you need some help." And she's in...
00:25:27.606 --> 00:25:29.946
I'm saying Mom, or maybe a friend or maybe something.
00:25:29.998 --> 00:25:30.438
a good one.
00:25:30.538 --> 00:25:30.778
That's the
00:25:30.926 --> 00:25:31.186
yeah.
00:25:31.338 --> 00:25:32.138
Your child, you
00:25:32.298 --> 00:25:36.147
"Could you look at this?" Maybe an alert comes in your phone, uh, you know, it says, uh, this email.
00:25:36.228 --> 00:25:40.948
You look at the email, and that email's got,"Hey, I need some help," for whatever.
00:25:41.057 --> 00:25:44.107
"Can you look at this link?" And you go and you click on that link.
00:25:45.387 --> 00:25:47.228
Could be something as innocuous as that.
00:25:47.468 --> 00:25:54.288
And when you click on that link, and now you're in this secure portal, you're now in this security channel, you've already authenticated.
00:25:55.682 --> 00:25:56.083
Yes.
00:25:56.343 --> 00:25:57.803
You've, you've opened, you've
00:25:57.847 --> 00:25:59.847
you opened the Pandora box already
00:25:59.884 --> 00:26:00.823
the door open
00:26:00.948 --> 00:26:01.907
and left the door open.
00:26:02.028 --> 00:26:06.268
It's like you go into your house and you walk in and someone follows you into that house, right?
00:26:06.948 --> 00:26:10.788
And you're now there, and they're, they're gonna open, they're going to try the closet.
00:26:11.327 --> 00:26:17.887
Uh, a- and, and so what AI does is AI now clone this, make it more appealing.
00:26:17.907 --> 00:26:31.577
"Oh, I, I wanted, you know, you should do this right away because this, you actually, you're not authorized." Let's pretend you're not authorized to be here, and you're now so desperate'cause you need to with- uh, this is a moral day, and you gotta get your money out of the bank, whatever it's gonna be.
00:26:31.597 --> 00:26:39.998
And you're there, and it tells you,"Look, if you don't, if you don't click on this, you're not gonna get your money." So now you've got this intense desire,
00:26:40.105 --> 00:26:42.365
and the psychological aspects,
00:26:42.718 --> 00:26:43.268
Yes, indeed.
00:26:43.484 --> 00:26:43.684
here.
00:26:43.904 --> 00:26:46.645
Socio-psychological parts of the cyber
00:26:46.894 --> 00:26:48.713
Pressure, under pressure.
00:26:49.153 --> 00:26:57.784
So in this case, you know, the, the body, the individuals knew that you're dealing with students, you're dealing with your academia, especially students.
00:26:57.804 --> 00:27:00.834
So where- wherever this came from, and they're easy prey.
00:27:01.433 --> 00:27:09.894
Um, and it's also with AI, it was so eas- it's easy to scan the database and the vulnerabilities that are existed.
00:27:09.913 --> 00:27:11.673
By the way, this is not the first time, right?
00:27:11.703 --> 00:27:20.683
This is not the first time this has occurred, so, um, it's easy to kind of push this out there and find this new target, and you know it's gonna happen.
00:27:20.703 --> 00:27:23.374
This playbook was already in play before, right?
00:27:24.034 --> 00:27:31.196
Um, and in this case, it's application program interface where the keys were swapped out and you never look.
00:27:31.386 --> 00:27:34.365
uh You now have this electronic lock on your door.
00:27:36.146 --> 00:27:48.027
You're out of town and someone has to maybe walk your dog back into your house, um, and, uh, or let your child in from school, and you're on vacation.
00:27:48.086 --> 00:27:48.676
You're like,"Okay.
00:27:48.777 --> 00:27:49.386
All right, fine.
00:27:49.426 --> 00:27:53.767
I'll let this trusted person in." And you unlock that electronically, right?
00:27:53.787 --> 00:28:04.487
The person now in your house The person now in your house, you have a safe with your valuables in there, or maybe your desk drawer with, um, with your keys.
00:28:05.106 --> 00:28:11.007
Uh, let's say that you've got some valuables, and you left that key in that, in that drawer
00:28:11.493 --> 00:28:11.994
Mm-hmm
00:28:12.126 --> 00:28:14.076
got a layer already in your front door, right?
00:28:14.737 --> 00:28:15.596
You're not thinking.
00:28:15.636 --> 00:28:17.116
You've got everyone in the house who trusted.
00:28:17.477 --> 00:28:21.257
You can stack and go into your area to take your wallet or take your valuable, case may be.
00:28:21.757 --> 00:28:29.777
Now, this person's in your house, and the person decided le- to go around a little bit to see what else they could kind of leverage themselves from, of, right?
00:28:30.757 --> 00:28:33.816
And they walk into your office, and there's a key to your safe
00:28:34.779 --> 00:28:35.140
Mhm
00:28:37.703 --> 00:28:38.703
That's what that was.
00:28:38.777 --> 00:28:40.076
there's nothing to prevent them.
00:28:40.544 --> 00:28:41.463
Nothing to prevent them
00:28:42.175 --> 00:28:47.895
uh, sometimes in my mind, tell me if this is correct, Ken, in AI, it's not just one individual you've let in the house.
00:28:48.375 --> 00:28:58.736
Because AI can hit it so many times, millions of iterations, the o- chance of it finding that key has just been exponentially increased
00:28:58.983 --> 00:29:12.365
Yeah, not only that, Vernon, you've got in your home, you've got smart refrigerators, you've got, again, smart cameras, you've got maybe electronically controlled environmental co- control system, and all of these things we are broadcasting out there, by the way.
00:29:12.404 --> 00:29:13.624
They're all un- unencrypted.
00:29:14.243 --> 00:29:27.784
Now, all of that information, by the way, are going out there, and they're in the world, and then these little breadcrumbs are being dropped that are associated with our own, uh, address.
00:29:27.804 --> 00:29:31.263
And if you go there today, you can see that y- today, you...
00:29:31.444 --> 00:29:31.804
it is...
00:29:32.144 --> 00:29:36.307
If you put your name in, or your address, you could, that could, you could be...
00:29:36.426 --> 00:29:37.906
it could know where you live, right?
00:29:38.188 --> 00:29:38.606
That's...
00:29:40.686 --> 00:29:40.787
Oh,
00:29:40.866 --> 00:29:41.446
so AI
00:29:41.707 --> 00:29:43.886
it's maddening in how much information that is out there.
00:29:44.028 --> 00:29:44.507
For example,
00:29:44.626 --> 00:29:45.067
right.
00:29:45.106 --> 00:29:45.467
That's right
00:29:45.826 --> 00:29:50.047
a letter for my son the other day at, at my, uh, address, he
00:29:50.166 --> 00:29:51.567
FRIES
00:29:51.727 --> 00:29:53.406
And it was about a particular thing, I won't say what it was.
00:29:53.787 --> 00:29:56.386
But he said,"I have never given them your address.
00:29:56.428 --> 00:29:57.487
There is no reason why I
00:29:57.499 --> 00:29:57.959
That's right
00:29:57.987 --> 00:29:59.166
Well, how did they do it?
00:29:59.227 --> 00:30:00.406
Well, they went and found the data.
00:30:00.607 --> 00:30:01.338
They found out that he was
00:30:01.465 --> 00:30:01.786
That's right.
00:30:02.306 --> 00:30:02.705
That's right
00:30:02.718 --> 00:30:06.258
they said,"Oh, we will just, like, send this right over to,
00:30:06.286 --> 00:30:06.626
That's right
00:30:06.877 --> 00:30:08.518
par- mom and dad's place
00:30:08.730 --> 00:30:09.130
That's right
00:30:09.159 --> 00:30:13.857
them look at it." And that was, uh, he was not happy about that, and I was not happy about that
00:30:14.018 --> 00:30:14.419
That's right
00:30:14.678 --> 00:30:16.978
it's like, boy, you know, someone's...
00:30:17.718 --> 00:30:21.748
if you, if you think your data's safe out there and no one's looking through it, you gotta, you
00:30:21.948 --> 00:30:22.429
Yeah.
00:30:22.468 --> 00:30:26.627
Well, well, Vernon, your, your data is not s-- uh, I mean, this is not new, to be honest.
00:30:27.067 --> 00:30:35.188
When we de- developed the data repository and databases, and we put thing into those storage, when we wanted to delete them, we removed the primary key.
00:30:35.249 --> 00:30:44.008
We said we are deleting the data, uh, but you may go back there and see the delete, the data are still encoded in your memory, in those memory processes, right?
00:30:44.548 --> 00:30:47.347
And those data lives on forever, forever, right?
00:30:47.827 --> 00:30:56.297
We built AI to find and recreate those linkage between those, those fields and those records.
00:30:56.557 --> 00:30:58.218
That's why we did build data, right?
00:30:58.297 --> 00:30:59.277
Go find all of those.
00:30:59.656 --> 00:31:21.519
And so when you s- when you scroll through the internet and the databases that are out there and the dark web, et cetera, you're gonna bring Vernon back together, even though Vernon tried to separate his association from wherever he used to work, where you grew up, where you, who you befriended, who your friend, childhood friendship were.
00:31:21.900 --> 00:31:25.858
Wherever they were, we're gonna, the model is gonna be able to bring them all back together.
00:31:26.759 --> 00:31:30.558
Your home, your characteristics, your method, your, what time do you leave at home?
00:31:31.679 --> 00:31:33.759
Uh, where you store your devices.
00:31:33.900 --> 00:31:35.299
Let's say you evaluate yourself.
00:31:35.358 --> 00:31:36.699
Again, we was talking about that safe.
00:31:37.119 --> 00:31:46.499
Maybe that safe has got a, an IP address somewhere tied to somewhere else, and the time of day that you lock it and open it, or if you lock it at all, or don't lock it, don't lock it.
00:31:46.538 --> 00:31:54.144
If I'm intentional And I'm in your home now, and I'm able to use all the facial intelligence in some way and get everything about you.
00:31:54.203 --> 00:31:55.824
It's gonna probably tell me you got a vulnerability.
00:31:56.284 --> 00:32:02.371
It's gonna tell me probably where I could probably get some other conf- and what time you're gonna be back home, what do you like to do, what time of the day, etc., etc.
00:32:02.911 --> 00:32:03.990
It's gonna do all of that.
00:32:04.330 --> 00:32:07.431
And I'm not, you know, it's not a human that's gonna be involved with this.
00:32:07.570 --> 00:32:09.580
It's another, uh, you know, uh,
00:32:10.054 --> 00:32:10.134
An
00:32:10.151 --> 00:32:10.861
AI a-
00:32:10.894 --> 00:32:11.054
An
00:32:11.191 --> 00:32:28.851
agent is gonna say,"Hey, this is the most efficient thing that you could do in order to come to this outcome." If I say,"I want to steal some money from this, uh, from this, uh, ou- outcome, a- and how do I do it?" It's gonna get it all together, and it's gonna show me what the most efficient, what the most innocuous way, how to bury the evidence, how to obfuscate myself.
00:32:29.191 --> 00:32:30.191
It's gonna do all of that.
00:32:30.550 --> 00:32:32.971
So that anthropic, um, w- w- you know,
00:32:33.178 --> 00:32:33.978
The M-Mythos,
00:32:34.050 --> 00:32:34.300
devel-
00:32:34.578 --> 00:32:35.377
yeah, Claude Mythos,
00:32:35.550 --> 00:32:40.530
that you were trying to, that you were referring to, oh, oh, man.
00:32:41.391 --> 00:32:49.411
Yeah, so there were, you know, there were some insights about that that, um, that it's troubling because what I do as a human is that I...
00:32:50.601 --> 00:32:53.861
We're starting to get better at identifying these vulnerabilities.
00:32:54.220 --> 00:32:54.579
Mhm
00:32:54.901 --> 00:33:01.020
We don't know what a, we, you don't know what a zero day is if you don't know what a zero day is, but you know what a known vulnerability is.
00:33:01.560 --> 00:33:14.381
Today, we can't even worry about zero days because what we know, it takes us a, a very, very long time to fix because vulnerabilities are available constantly.
00:33:15.080 --> 00:33:21.820
You know, always there's a vulnerability, and we are constantly playing whack-a-mole to try to fix those and plug that hole, right?
00:33:22.641 --> 00:33:24.601
So that takes up a great period of our time.
00:33:25.151 --> 00:33:26.050
And we are humans, right?
00:33:26.131 --> 00:33:29.971
We get weary, we get tired, and we may leave it for tomorrow.
00:33:30.070 --> 00:33:35.901
Well, we're leaving that for tomorrow to fix while there are zero-day vulnerabilities that are coming up right there
00:33:36.596 --> 00:33:36.976
Mhm
00:33:37.346 --> 00:33:41.807
And what we use AI to identify, prioritize what are more important.
00:33:42.307 --> 00:33:47.247
If we get a zero day, we have to put everything aside and address the zero day,
00:33:47.849 --> 00:33:48.190
Mhm
00:33:48.446 --> 00:33:49.666
that's what's gonna really hurt.
00:33:50.027 --> 00:33:55.067
And again, you get, your, your door, your car needs the oil, it needs to be fixed.
00:33:55.086 --> 00:33:59.307
That tire, you're going on a long road, you better have enough air in that tire.
00:33:59.366 --> 00:34:00.267
That's a zero day, right?
00:34:00.866 --> 00:34:03.406
So we're gonna address that before we get on the, uh, on the trip.
00:34:04.086 --> 00:34:09.467
Uh, if we are able to use the artificial intelligence, uh, models in order to help us to do so.
00:34:09.547 --> 00:34:13.646
So it, it's both sides of the fence that are used for good or for bad.
00:34:14.126 --> 00:34:25.666
But it's, it's how quickly we're able to get ahead of each other, and that's where the quantum, this new evolution of this quantum challenges that we are facing.
00:34:25.726 --> 00:34:31.476
And, we were thinking that quantum algorithm, quantum cryptography would've been broken.
00:34:31.556 --> 00:34:33.876
Quantum would've been a major risk.
00:34:34.817 --> 00:34:35.996
That's what we were thinking.
00:34:36.527 --> 00:34:37.456
That once we...
00:34:37.567 --> 00:34:39.806
which is not commercially, available by the way now.
00:34:39.949 --> 00:34:40.210
Right,
00:34:40.556 --> 00:34:42.686
with these altered states of, electrons, et cetera.
00:34:43.126 --> 00:34:45.766
Uh, but here comes AI.
00:34:46.766 --> 00:35:00.797
And AI now have started to be this real concern to kind of figure all of this out in a q- in a, in a, in a f- you can ask a question to, to, to, to Bard right now, and you get an answer in five seconds.
00:35:01.434 --> 00:35:01.693
Mm-hmm.
00:35:01.867 --> 00:35:03.387
Now, it may not be the right answer.
00:35:03.753 --> 00:35:03.954
Right.
00:35:04.454 --> 00:35:05.594
Could you be hallucinating?
00:35:05.653 --> 00:35:05.893
Yes
00:35:06.367 --> 00:35:06.666
Yes.
00:35:07.047 --> 00:35:07.927
But it's not hallucinating.
00:35:07.976 --> 00:35:10.217
But if it turns out, all it takes is one.
00:35:10.257 --> 00:35:10.516
You know?
00:35:10.597 --> 00:35:16.827
All it takes is one, and that's what we say, in our business, that we could patch this hole, we could put up the best defense.
00:35:17.126 --> 00:35:19.617
I know by the way, we talk about a layer of defense, right?
00:35:20.036 --> 00:35:21.516
But all it takes is one to get through.
00:35:21.876 --> 00:35:22.456
Just one.
00:35:22.936 --> 00:35:26.157
Like what happened in, in this, in this infrastructure Campus breach.
00:35:26.677 --> 00:35:28.416
One time, one breach, and that's it.
00:35:28.817 --> 00:35:40.065
And, and you probably know, I don't know if you suspect, uh uh, Vernon, that, that supposedly Campus infrastructure, provided the ransom for them to give them back the data that they breached.
00:35:40.686 --> 00:35:42.985
Well, as you probably recognize
00:35:43.186 --> 00:35:43.865
I, I don't...
00:35:43.965 --> 00:35:46.125
Who, how can you validate that that
00:35:46.233 --> 00:35:46.632
Thank you.
00:35:46.744 --> 00:35:47.364
destroyed?
00:35:47.672 --> 00:35:48.733
Thank you very much.
00:35:48.864 --> 00:35:49.125
These are,
00:35:49.713 --> 00:35:50.373
Thank you very much
00:35:50.465 --> 00:35:51.445
thieves that told you that?
00:35:51.485 --> 00:35:52.485
"Oh, yeah, we got rid of
00:35:52.601 --> 00:35:52.900
Thank you.
00:35:53.085 --> 00:35:54.304
Don't worry about it."
00:35:54.541 --> 00:36:02.121
Yes, and that's the reason why there are probably some class action lawsuits coming against, uh, infrastructure campus right now
00:36:02.268 --> 00:36:08.489
data, data from millions of students, know, with instructors gonna have, this is gonna be ongoing.
00:36:09.045 --> 00:36:09.726
That's right.
00:36:09.766 --> 00:36:10.326
That's right
00:36:10.369 --> 00:36:14.451
know, Ken, going back to your professor cap on here for a second, also,
00:36:14.463 --> 00:36:14.762
Yes
00:36:15.092 --> 00:36:17.990
you know, and also your, your, uh, expertise cap.
00:36:18.552 --> 00:36:22.550
Um, if you're talking to a student that says,"I don't know if I should go into cybersecurity.
00:36:22.590 --> 00:36:22.811
I'm gonna,
00:36:22.891 --> 00:36:23.150
Yes
00:36:23.510 --> 00:36:23.972
I don't know if I...
00:36:24.052 --> 00:36:30.199
There, it's just gonna be taken care of by AI." What would you tell that student that says, I wanna have a job when this is done.
00:36:30.239 --> 00:36:33.199
I wanna have a future, I wanna learn something.
00:36:33.260 --> 00:36:34.639
I wanna become a better person.
00:36:35.139 --> 00:36:41.960
Maybe I shouldn't go into cybersecurity because AI is just gonna take that over." What do you say to that student or that
00:36:42.092 --> 00:36:48.952
Vernon, you know what I would say, I would assume the pleading, the pleading role with the students, with the student.
00:36:49.632 --> 00:36:52.273
That look, I am vulnerable.
00:36:52.833 --> 00:36:56.052
I as an individual, I'm vulnerable because my data is out there.
00:36:56.873 --> 00:36:58.333
My family is vulnerable.
00:36:58.393 --> 00:37:00.932
My son, my daughter got a letter.
00:37:01.373 --> 00:37:02.672
She was 13 years old.
00:37:03.206 --> 00:37:10.726
She opened the letter and it was announcement, announcing of a cybersecurity breach that occurred in, in Office of Personnel Management, OPM.
00:37:12.146 --> 00:37:16.306
She got the notice of the breach before I did, and I work at OPM, right?
00:37:16.706 --> 00:37:17.985
Our information was breached, right?
00:37:18.885 --> 00:37:22.666
And that was when you start to realize the vulnerability that we all have.
00:37:23.226 --> 00:37:40.445
So I would say to that student,"You know, I am pleading with you, similar to the way that I would plead with you for that, uh, you know, for that resident, for that medical residence." Because that medical resident is gonna turn into the doctor who's gonna take care of me, the, my quality of life, right?
00:37:40.925 --> 00:37:42.764
That individual that I prize so much.
00:37:43.106 --> 00:37:51.016
All other disciplines around our society that we need so very, very much, food safety individuals, mechanics that we depend on.
00:37:51.096 --> 00:37:54.635
All these individuals we need are these roles that they serve.
00:37:54.695 --> 00:38:00.155
This role now of cyber is, is a risky role for all of us as a civilization.
00:38:00.215 --> 00:38:09.436
It virtually could disintegrate civilization and cause chaos, especially in our ro- in our environmental critical infrastructure system.
00:38:09.835 --> 00:38:19.076
Uh, we are talking now about the Iranians, um, uh, intercepting the oil tank levels meters.
00:38:19.115 --> 00:38:20.956
I don't know if you're aware of that.
00:38:21.115 --> 00:38:22.385
They're, they're probo-
00:38:22.458 --> 00:38:22.938
about that.
00:38:23.596 --> 00:38:23.835
Yeah,
00:38:23.918 --> 00:38:24.338
So what--
00:38:24.615 --> 00:38:24.715
so
00:38:25.438 --> 00:38:29.059
the Iranians are, have been cyber warriors for a long
00:38:29.195 --> 00:38:30.135
For a long time.
00:38:30.519 --> 00:38:32.019
And so what-- tell, talk about what they're,
00:38:32.175 --> 00:38:32.394
Yeah.
00:38:32.518 --> 00:38:32.739
doing
00:38:32.815 --> 00:38:46.619
So when you drive into the gas station to, to receive your gas, that gas tank or g- gas meter is tied to the lo- to the gas reser- uh, vat that in the ground.
00:38:47.019 --> 00:38:54.400
And that gas vat, uh, has a, a gauge that tells the operator how much, how much fuel is in there.
00:38:54.880 --> 00:38:59.981
The type of fuel that are in there as well, um, it educates them about that.
00:39:00.559 --> 00:39:11.860
So the risk is that you could have that gas gauge that is showing that it's half empty when it's actually a quarter empty, or showing that it's half full when it's quarter full.
00:39:12.440 --> 00:39:19.800
Not only that, it al- it could also have, uh, it also tells if it's clean, if it's non-con- contaminated.
00:39:20.460 --> 00:39:21.420
Just so scary.
00:39:21.460 --> 00:39:26.032
Now you could be filling your vehicle and you've got contaminated gas
00:39:26.512 --> 00:39:26.811
Yeah.
00:39:27.610 --> 00:39:28.851
Uh, it's,
00:39:29.030 --> 00:39:35.711
I mean, there's so many ways that, that are, they're vulnerabilities, and it's, a lot of this is creativity.
00:39:36.070 --> 00:39:38.510
So a student that you say,"Uh, uh, AI's gonna do
00:39:38.630 --> 00:39:39.050
Yeah
00:39:39.090 --> 00:39:42.331
to tell them that,"No, need you
00:39:42.612 --> 00:39:43.791
exactly, Vernon.
00:39:43.931 --> 00:39:45.110
need your creativity
00:39:45.710 --> 00:39:45.951
Yeah
00:39:46.052 --> 00:39:48.871
gotta start thinking about the cr-" Um, I
00:39:49.016 --> 00:39:49.414
and Vernon,
00:39:49.490 --> 00:39:49.731
mic.
00:39:49.775 --> 00:39:50.054
so,
00:39:50.291 --> 00:39:50.490
Yeah
00:39:50.715 --> 00:39:54.476
uh, I was coming back from one of the conferences that you allowed me to go.
00:39:54.534 --> 00:39:57.755
I was sitting in an airplane, uh, Delta I think it was, sitting beside a young man.
00:39:57.835 --> 00:39:58.735
We introduced ourselves.
00:39:58.994 --> 00:39:59.795
He asked me what I do.
00:40:00.135 --> 00:40:06.135
I said,"I'm a cybersecurity director at American APUS." He's like,"Oh," and then we instantly got bonded.
00:40:06.295 --> 00:40:09.275
"So who do you do?""I'm a geneticist.""Okay.
00:40:09.936 --> 00:40:10.375
All right.
00:40:10.516 --> 00:40:12.375
Um, okay.
00:40:12.635 --> 00:40:13.574
We need you, Dr.
00:40:13.615 --> 00:40:14.775
Williams.""You do?
00:40:15.375 --> 00:40:27.094
I don't know anything with gene therapy, ge-" He said,"Yes, you come into the industry because we need secure the gene therapy, the gene me- medium that we're, you know, that we're working with," right?
00:40:27.954 --> 00:40:33.074
Okay, fast-forward today now, I have an administrative assistant that, that is serving me.
00:40:33.474 --> 00:40:44.375
His girlfriend is actually involved in, in, in verifying proper genes for individuals based on, on, on genetic defects.
00:40:45.458 --> 00:40:45.940
Mm-hmm
00:40:46.114 --> 00:40:53.496
And he tells me stories about her, related to the trusted verif- uh, of the, of the ge- gene, et cetera.
00:40:53.554 --> 00:40:55.934
She has to validate all of that and secure it.
00:40:56.235 --> 00:41:09.036
So when you take a blood test, and you've got a, you know, a disease of some sort that needs to be properly treated, you have to get this gene therapy that, validates that you could do, blood transfusion, et cetera, and she's responsible for that.
00:41:09.076 --> 00:41:10.576
Well, it comes to a, a computer
00:41:12.380 --> 00:41:12.760
Yes, it
00:41:12.840 --> 00:41:16.940
Come through the system and that gets corrupted, then we've got a issue.
00:41:17.320 --> 00:41:26.181
So the, so the student leaves the cybersecurity education program and goes to work in any possible industry you could think of.
00:41:26.820 --> 00:41:31.880
Drone, aviation, all enga- uh, you know, critical infra- infrastructure.
00:41:32.481 --> 00:41:33.500
Uh, stoplight.
00:41:33.559 --> 00:41:39.699
You've got a stoplight, it goes out because of some critical- criticality, you've got chaos.
00:41:39.981 --> 00:41:44.539
You've got the student there that are securing the network if they, if there's a, if there's a hack.
00:41:44.800 --> 00:41:49.400
If you got a ransomware that takes out those stop, those stoplights, and then you've got a real issue, right?
00:41:49.440 --> 00:42:03.900
If you've got a ransomware that shuts down all the light in the grid, all the lights in the grid, you need a cyber, cyber educated individual in that team to help to do the incident response in order to help you to understand how to get those computers back on there.
00:42:04.161 --> 00:42:20.340
If you got a storm that comes along, either earthquake or hurricane, and it takes our data centers, our data centers today, by the way, that are really, really surfacing our artificial intelligence network, et cetera, you have to have those individuals that are providing security in those individuals.
00:42:20.880 --> 00:42:26.940
And that volume of individuals, we haven't even touched the surface, uh,
00:42:27.175 --> 00:42:27.717
Mm-hmm
00:42:27.800 --> 00:42:29.019
the workforce today.
00:42:29.360 --> 00:42:30.519
I mean, I'm with NASA.
00:42:30.579 --> 00:42:39.201
Since I've been here, NASA came to me with a unique issue about the Artemis, uh, space program and communicating in space.
00:42:39.880 --> 00:43:04.239
There were the zero, uh, gravity and the need for greater nodes, so you could avoid the latency between nodes to be able to communicate from one path to the next path So a lot of, the huge grant in order to get our students involved to understand what the processes of the NASA and to get them to educate them about security aspects and networking aspects and, e-e-et cetera.
00:43:04.619 --> 00:43:09.259
Um, uh, you know, so, so all of those areas are what our students are working.
00:43:09.398 --> 00:43:18.557
You know, I worked with the CDC, uh, in a project in Washington, DC just about a year before the breakout of the COVID, the SARS virus, right?
00:43:19.418 --> 00:43:29.588
I was actually facilitating that, helping them to manage the network and to help them to understand some of the terminology related to the computing, and they were talking about Ebola.
00:43:29.929 --> 00:43:30.447
Ebola.
00:43:31.384 --> 00:43:31.523
Yeah,
00:43:31.588 --> 00:43:32.228
that point,
00:43:32.483 --> 00:43:33.503
in the news again
00:43:34.027 --> 00:43:35.128
they were talking about Ebola.
00:43:35.168 --> 00:43:38.588
They had some of the SARS COVID terminology, but it wasn't such a threat.
00:43:38.608 --> 00:43:42.686
But I'm in that room, Vernon, and I'm like,"Okay, why am I here?
00:43:43.166 --> 00:43:44.527
I'm a cyber person.
00:43:45.347 --> 00:43:49.067
Um, why am I in this room?" But they couldn't do that.
00:43:49.427 --> 00:43:50.807
That was a role that I served.
00:43:51.246 --> 00:44:01.927
So that student could be in just about any possible thing that you could think of, any place that you could think of, facilitating, protecting the network, making sure that the data is safe.
00:44:02.007 --> 00:44:11.492
And, and as this AI world comes about now, they'll be able to advise the industry about the dangers, the risks associated with that, with what they're, using.
00:44:11.514 --> 00:44:16.483
Because we can't get away from using, without using the network, without using a computer.
00:44:16.523 --> 00:44:17.842
At least not yet, anyway.
00:44:17.922 --> 00:44:19.282
We haven't figured that one out as yet.
00:44:19.824 --> 00:44:23.094
Thanks for listening to part two of our discussion with Dr.
00:44:23.094 --> 00:44:25.574
Ken Williams on the Engaged by Design podcast.
00:44:26.144 --> 00:44:33.594
We hope that you're finding his stories and his experience really helpful as you think about how you lead technology with your organization.
00:44:34.255 --> 00:44:44.195
Next time, in part three, Ken shares what happened when he was asked to build an entirely new cybersecurity program from scratch, from nothing.
00:44:44.474 --> 00:44:54.005
He had to recruit faculty, design curriculum, overcome numerous obstacles, And he had to create opportunities for students across the state of Louisiana.
00:44:54.474 --> 00:44:56.445
So we'll see you in part three.
00:44:57.034 --> 00:45:09.034
In the meantime, please remember to like, subscribe and share this podcast with a friend, so that we can bring more people into this conversation as we all try to engage by design
00:00:07.559 --> 00:00:19.097
Your brake may fail, and your car is starting to skid out of control because you're going at 65, 70 miles an hour, and your car is starting to fail and you look right, there's a car, you look left, there's a car.
00:00:19.378 --> 00:00:27.542
You can't veer off, This role now of cyber, is a risky role for all of us as a civilization.
00:00:27.602 --> 00:00:30.442
It virtually could disintegrate civilization
00:00:33.002 --> 00:00:36.661
Welcome back to part two of our discussion with Dr.
00:00:36.661 --> 00:00:40.192
Ken Williams on the Engaged by Design podcast.
00:00:40.731 --> 00:00:55.881
In this episode, we move from curriculum design into the future of cybersecurity, AI, and why the human element is going to matter more than ever in, uh, coming months and years.
00:00:56.332 --> 00:01:00.222
So let's rejoin the conversation with Vernon and Ken
00:01:01.688 --> 00:01:04.927
I wanna talk a little bit about what your role is now.
00:01:05.009 --> 00:01:08.088
Uh, you, you also exited American Public University.
00:01:08.188 --> 00:01:08.567
And
00:01:08.623 --> 00:01:08.864
Yes
00:01:08.867 --> 00:01:17.356
about your position, what you're doing, and, uh, some of the, not only the things in your university, but what you've done statewide in Louisiana
00:01:18.149 --> 00:01:19.108
Thanks a lot, Vernon.
00:01:19.188 --> 00:01:36.968
So after exiting American Public, I was able to, uh, to stand, uh, to, to align with a brand-new project to stand up a, a center, uh, an academy training center in Quantico Marine Corps Base, uh, with CyberByte at that point.
00:01:37.009 --> 00:01:50.114
A brand-new concept from the, uh, uh, from the, the board, the supplier, the investors at that point, that they wanted to stand up a, an accredited program outside of Quantico Marine Corps Base.
00:01:50.295 --> 00:01:52.655
So they asked me to, to lead that effort.
00:01:53.135 --> 00:02:01.435
And I accepted that, of course, from all of the, the lessons that I've learned and all the experience that I gained at APUS and working with you, Vernon.
00:02:01.454 --> 00:02:02.935
And again, you're an organizer.
00:02:03.105 --> 00:02:05.215
You're a task designer.
00:02:05.364 --> 00:02:13.245
Um, and, uh, also when I listened to your, to the first broadcast with you and, and Michael, it was there.
00:02:13.685 --> 00:02:15.004
Uh, you know, uh, you...
00:02:15.164 --> 00:02:18.784
As a matter of fact, I, I now use RACI, by the way.
00:02:19.824 --> 00:02:20.223
Do you?
00:02:20.224 --> 00:02:34.544
In every environment, I sell that concept about having right individuals in place, the mentoring in place, uh, and the supporting the team towards an outcome.
00:02:35.025 --> 00:02:44.551
So thank you for allowing us to talk, to introduce and educating me about RACI and how to manage an effective team and build an effective team.
00:02:44.961 --> 00:02:46.072
And that's what I use.
00:02:46.171 --> 00:02:51.081
I took that with me everywhere that I went, including this cyber academy.
00:02:51.592 --> 00:03:00.162
I was able to stand up in a brand-new$10 million dollars building and go through the Virginia certification process SCHEV
00:03:01.106 --> 00:03:01.347
So let's,
00:03:01.391 --> 00:03:02.151
and get approval
00:03:02.326 --> 00:03:04.846
about the, uh, the cyber, you know, this place.
00:03:04.906 --> 00:03:06.805
It's a specialized lab, right?
00:03:06.884 --> 00:03:07.125
It's,
00:03:07.561 --> 00:03:07.941
Yie
00:03:08.104 --> 00:03:14.284
for someone who's not familiar with cybersecurity, are you able to do there that you can't do other places
00:03:14.853 --> 00:03:15.372
Yes
00:03:15.406 --> 00:03:19.625
have this equipment and this, you know, the, the infrastructure that you put in there?
00:03:19.990 --> 00:03:20.810
Thanks a lot, Vernon.
00:03:21.150 --> 00:03:25.930
So with the$10 million, both, that include both the building and this classroom.
00:03:25.969 --> 00:03:28.110
There's was three levels in this building.
00:03:28.129 --> 00:03:49.500
The first floor was a five-classroom, fully outfitted computer with a Cisco telepresence, on site, and, an online capability, that we were able to partner with CompTIA, EC Council, and Cisco to use their,
00:03:49.622 --> 00:03:50.002
Great
00:03:50.219 --> 00:03:51.400
knowledge, yes.
00:03:51.483 --> 00:03:52.122
partners
00:03:52.229 --> 00:03:54.330
And why partner with those individuals?
00:03:54.430 --> 00:04:09.030
Those were the individuals that had the certifications that, uh, CompTIA, EC Council, CISSP, et cetera, that the workforce needed, that, uh, that all, by the way, was mapped back to the knowledge, skills in the center of academic excellence.
00:04:09.610 --> 00:04:30.029
But the special aspect of this were there were individuals in the workforce, especially in the Northern Virginia area, that were already in the workforce working for the federal government, working for employers, who had gone to school without a formal education and knew how to do it on ground, but they were not certified.
00:04:30.629 --> 00:04:42.350
So they wanted to find a way to get certified, and this academy was directly set up in order to get them certified in between five to seven days.
00:04:42.790 --> 00:04:56.769
To get them certification, get them into a boot camp environment that started at eigh- at 8:00 AM in the morning, ended at 5:00, and it was a really intense program that was able to get the individuals who are knowledgeable.
00:04:57.019 --> 00:05:04.089
The good thing about that, they were knowledgeable, they knew it, they were practitioners, seven years, eight years, but they didn't have the certification.
00:05:04.790 --> 00:05:06.110
So we were able to prepare them
00:05:06.593 --> 00:05:07.052
Mm-hmm.
00:05:07.512 --> 00:05:07.853
Mm-hmm
00:05:07.860 --> 00:05:14.482
get them certified and get them out there to the workforce and, um, and get them in an official thing.
00:05:14.581 --> 00:05:23.300
Now, Virginia required that to do any training in Virginia, that you had to be certified to be legitimately certified.
00:05:23.872 --> 00:05:25.072
stamp of approval, right?
00:05:25.321 --> 00:05:25.841
That's right.
00:05:25.980 --> 00:05:27.762
So we were able to go through the process.
00:05:28.262 --> 00:05:42.201
You had to go there and go to a class and, and fill out this huge document, including bonds and pro forma, and they show how the classroom looks, and they come and they verify that you are able to facilitate an academy.
00:05:42.742 --> 00:05:47.781
Uh, and, and that was, that was an awesome experience because I never thought I would go through that neither.
00:05:48.262 --> 00:05:58.201
So I was able to go through the process and get the stamp of approval, Virginia SCHEV certification, and we were able to open the doors,'cause you couldn't open the door to accept a student until you got the SCHEV certification.
00:05:59.122 --> 00:06:10.952
But it was a great, asset for Quantico, the location of the individuals who worked in the, with the Pentagon and all of the defense, industrial-based individuals there who live in that area.
00:06:11.273 --> 00:06:12.713
They were able to come to school.
00:06:12.793 --> 00:06:19.372
They were able to get off of work and get one week of training and certification because their jobs depended on it.
00:06:20.233 --> 00:06:21.312
That's a lot of pressure.
00:06:21.403 --> 00:06:26.533
Ken-- talk a little bit about, you know, take a step back and talk about why this is so critical for national security
00:06:27.480 --> 00:06:29.562
So, as, as those,
00:06:29.701 --> 00:06:30.420
expert at this.
00:06:30.521 --> 00:06:31.002
There's,
00:06:31.180 --> 00:06:32.581
thank you so much, Vernon.
00:06:33.081 --> 00:06:33.521
with this c-
00:06:33.540 --> 00:06:34.120
Thank you.
00:06:34.240 --> 00:06:35.180
Yes, indeed.
00:06:35.382 --> 00:06:35.802
Yes, indeed.
00:06:36.201 --> 00:06:59.430
So, you know, Vernon, as I explained earlier in my career, those soldiers and my com- my, you know, my support individuals in the Marine Corps, Army, Navy, uh, were-- they are the highest, they're the highest skilled, uh, military force in the world, bar none.
00:07:00.048 --> 00:07:00.269
Okay.
00:07:01.189 --> 00:07:02.569
Now, the knowledge and skills,
00:07:02.632 --> 00:07:03.132
Agreed
00:07:03.488 --> 00:07:11.408
yeah, those knowledge and skills are born out of our service academy, of which there are four, uh, four of them: Army, Navy, Marine, and Coast Guard.
00:07:11.619 --> 00:07:14.579
We drill our, our forces through those academy.
00:07:15.298 --> 00:07:17.738
And those academy are boot camp style.
00:07:18.278 --> 00:07:29.918
They're knowledge-based, uh, outcomes, and we take them through six months to a year to get them, get them experts in their field as practitioners.
00:07:30.759 --> 00:07:36.139
Just like a, just like a, a medical professional at the early stage, we introduce them to those concepts.
00:07:36.178 --> 00:07:41.559
And then we send them out there into the, into the work environment to let them become embedded into the knowledge and skills.
00:07:41.579 --> 00:07:47.939
And then, of course, we bring, we bring them back in about seven years or so to get a more at the middle-level expert expertise.
00:07:48.699 --> 00:07:57.059
So to kind of reiterate again, so you get intro- initial introduction to IT skills, cyber skills, uh, AI skills.
00:07:57.119 --> 00:08:02.978
And, you know, you sort of, kind of getting an idea with the vocabulary, with the skills, et cetera.
00:08:03.499 --> 00:08:06.677
Um, and you get out, you graduate, you get your degree, and you go to work.
00:08:06.738 --> 00:08:09.199
Now, when you go to work, you really don't know much.
00:08:09.658 --> 00:08:13.999
You're trying to get everyth- all these knowledge and skills and the cobwebs, and people are there.
00:08:14.059 --> 00:08:17.798
But the good thing about that is you've got mentors.
00:08:18.879 --> 00:08:24.259
You've got people taking you along, answer your questions, uh, you know, take, uh...
00:08:24.519 --> 00:08:35.259
Gradually allowing you to get more hands-on-keyboard, fix things like the network, fix things like the server, practice, eventually solve the cyber issues, patch, uh, systems, et cetera.
00:08:35.658 --> 00:08:37.019
And then you start to get confidence.
00:08:37.058 --> 00:08:41.219
In about two years, three years,"Oh, you know, this is really good.
00:08:41.438 --> 00:08:41.899
I, I can start.
00:08:41.979 --> 00:08:50.938
I'm getting it right now." And all those things you learned earlier on in school, uh, it's starting to,"Oh, yes, we learned about this." You're starting to recall, right?
00:08:51.538 --> 00:08:52.798
And that's the process of learning.
00:08:53.068 --> 00:08:59.318
And we know as academians that you, you, as you start to-- You get the initial introduction to the concepts.
00:08:59.619 --> 00:09:07.808
When you get into an environment like like the interns and, and, and, uh, and like the medical professionals, et cetera, it's, the light bulbs start coming on.
00:09:08.460 --> 00:09:08.879
Right
00:09:08.989 --> 00:09:16.828
n- so now you're now at the seventh year or so, the ninth year, and you're feeling more confidence now.
00:09:16.908 --> 00:09:19.408
You're left alone in order to design things, et cetera.
00:09:19.889 --> 00:09:22.048
And, and then we said,"You know something?
00:09:22.568 --> 00:09:26.408
We need you to go to the, to the next level of, of, of effi-efficiency.
00:09:26.479 --> 00:09:33.149
Now we need for you to connect systems together, manage projects, and train individuals, et cetera.
00:09:33.448 --> 00:09:42.988
So we need you to be re-schooled." Or what, or what industry is called, we need for you to upskill, because learning is a continuous process, right?
00:09:43.438 --> 00:09:45.928
So in order for you to upskill, you got to go back to school
00:09:47.152 --> 00:09:47.451
Yes
00:09:48.316 --> 00:10:00.426
And to go back to school, either you're going into a graduate program and, or you're going, in this case, this academy allows you to go to a higher level now of your skills.
00:10:01.167 --> 00:10:12.546
And your skills, you don't need the full level of learn- of getting the certification, industry certification, because you're already proficient with it, but you're just kind of validating.
00:10:12.667 --> 00:10:23.206
You're validating what you know, and you're getting a certification that tells individuals,"Look, this person is now an expert." You're now an ex- it's like the mechanic, right?
00:10:23.470 --> 00:10:24.409
Yeah, they're legit.
00:10:24.471 --> 00:10:25.070
They're good.
00:10:25.110 --> 00:10:25.269
They
00:10:25.385 --> 00:10:25.426
The...
00:10:25.426 --> 00:10:25.885
That's it.
00:10:26.385 --> 00:10:26.687
That's it.
00:10:26.745 --> 00:10:33.090
So there's a badge of honor, that, look, you have earned this and you are now a practitioner.
00:10:33.909 --> 00:10:38.500
You are now really, really knowledgeable what you know, and so here's your credentials.
00:10:38.538 --> 00:10:42.759
And that is what this academy provides, the training academy provides
00:10:43.254 --> 00:10:46.774
You know, there's a theme I also see here, Ken, and maybe you'll comment on it.
00:10:47.535 --> 00:10:58.855
During the time that I worked with you in the degrees, you recognized this sort of gap between the academic approach and what was actually needed in industry certification.
00:10:59.855 --> 00:11:03.955
and y- I, I'd like to just talk about how, you know, we had this conversation.
00:11:04.054 --> 00:11:16.095
You said,"You know, Vernon, if we really want this to be the best of the best, we need to embed these certifications into our curriculum." Would you talk a little bit about, you know, w- what you did?
00:11:16.923 --> 00:11:17.923
Absolutely.
00:11:17.934 --> 00:11:19.076
course, you're right, and so,
00:11:19.263 --> 00:11:20.743
Absolutely, Vernon.
00:11:21.163 --> 00:11:21.683
Absolutely.
00:11:21.783 --> 00:11:22.283
So when I
00:11:22.754 --> 00:11:23.274
this is important?
00:11:23.315 --> 00:11:30.715
I, and we're getting to the larger issue of not being so far from the real world in academia that you're not doing something that's actually practical.
00:11:31.359 --> 00:11:31.678
Yeah.
00:11:31.719 --> 00:11:32.639
Thank you so much, Vernon.
00:11:32.720 --> 00:11:36.679
So, so two things sort of informed that, uh, Vernon.
00:11:36.720 --> 00:11:43.120
Of course, I, I talked about my vast industry experience of actually doing it, flying drones.
00:11:43.178 --> 00:11:47.719
You know, I was involved with the very first drone project, by the way, called Global Hawk.
00:11:47.778 --> 00:11:50.958
They're still flying out there with the National Intelligence Systems.
00:11:51.038 --> 00:11:51.918
We were underground.
00:11:52.379 --> 00:11:53.538
We had to do it.
00:11:53.599 --> 00:11:56.519
We had to have the most efficient processes in place.
00:11:56.818 --> 00:11:57.958
There were no gaps.
00:11:58.408 --> 00:12:02.309
The emails had to get through, voicemail had to get through, everything had to be done on time, right?
00:12:03.129 --> 00:12:10.448
So when I came into academia, I recognized that the curriculum was not designed for that.
00:12:11.448 --> 00:12:25.443
The curriculum was missing the real world knowledge of this student going to school for four years, three to four years, and learning this and getting this degree that's called cybersecurity.
00:12:25.724 --> 00:12:34.725
And when they get to the industry, um, like for example, one, uh, one, uh, industry, manager, CI- chief information officer said to me, he said,"Dr.
00:12:34.784 --> 00:12:50.565
Williams, you know, when those students come here and I take them to an interview, and I ask them what is a data at rest and a data transit, which is at the first year in s- in freshman that, uh, you're taught in the cybersecurity, or CIA, what is CIA?
00:12:51.186 --> 00:12:54.245
Confidentiality, uh, you know, integrity and availability,
00:12:54.429 --> 00:12:54.769
Mhm
00:12:55.065 --> 00:13:01.302
don't know." And I was like,"Oh my gosh." And that was a wake-up call.
00:13:01.861 --> 00:13:12.500
That was a-- not only was it a wake-up call that this curriculum, this, that we have is so f- is so much not in sync with what industry expect.
00:13:12.780 --> 00:13:18.421
Because the industry individual, they're more passionate about getting this individual to work and doing what they're supposed to do.
00:13:19.120 --> 00:13:20.341
They respect academia.
00:13:20.360 --> 00:13:21.280
They respect us, right?
00:13:21.360 --> 00:13:23.880
Because we are, you know, we've got this role of educating.
00:13:24.822 --> 00:13:32.801
But they demand that we provide to them, upon that interview, someone who understand their business as well.
00:13:33.422 --> 00:13:40.441
We want the individual with the degree, but we also want individuals who are technically competent so we won't have to retrain them.
00:13:41.000 --> 00:13:56.860
So what happened over time was that industries keep on saying,"Well, there, there's a gap between individuals graduating with a cyber degree, IT degree, and those who are industry, and somebody please help us." So what happened was that industry, uh, individuals, they made it themselves.
00:13:57.221 --> 00:13:58.640
CompTIA stood up.
00:13:58.701 --> 00:14:00.681
EC-Council became very relevant.
00:14:01.001 --> 00:14:02.301
Cisco became relevant.
00:14:02.642 --> 00:14:08.561
And there were industry individuals tr- in the training world who said,"You know, w- industry, we're gonna meet your gap.
00:14:08.601 --> 00:14:11.360
We're gonna meet your acts because academia is not doing it.
00:14:12.020 --> 00:14:14.541
We're gonna stand up these certifications." Right?
00:14:14.980 --> 00:14:18.980
And they built the certification, and they got recognized as, uh...
00:14:19.260 --> 00:14:23.422
And, and the Department of Defense, the NICE framework started to recognize that that's what they need.
00:14:23.461 --> 00:14:25.061
There were now knowledge levels that were needed.
00:14:25.142 --> 00:14:26.841
Industry said,"Yes.
00:14:26.900 --> 00:14:29.140
We don't know what we want, but we see what we got.
00:14:29.181 --> 00:14:30.701
We-- That's what we want," right?
00:14:31.480 --> 00:14:34.730
So they built it for industry to accept it and we know it.
00:14:34.791 --> 00:14:40.320
So when I came along and I got into academia, I was like And where is academia now?
00:14:40.859 --> 00:14:41.318
Mhm
00:14:41.419 --> 00:14:42.519
we play in all of this?
00:14:43.100 --> 00:15:10.711
Well, the only way to play in all of this is just adopt now what is, what was built by industry, and embed those certifications into this bachelor's degree, and restructure the degree, and matriculate it because we are, you know, we are empirical individuals, and we are scholars, and we know how to embed knowledge and skills into this new approach to this academia degree.
00:15:11.250 --> 00:15:20.780
So let's kind of map between the course outcomes, the weekly outcomes, the knowledge that these students need, and kind of make the best of both worlds.
00:15:21.260 --> 00:15:35.291
So the best of both worlds is a traditional, uh, you know, a degree with all of the knowledge units and approach to, to general ed approach and critical thinking, along with a practitioner practical knowledge degree.
00:15:35.910 --> 00:15:40.900
And that student now becomes more valuable than someone who, who doesn't have a degree,
00:15:41.725 --> 00:15:42.384
Absolutely
00:15:42.500 --> 00:16:04.201
that student knows now how to manage, do, as they go along in, in their role to become project manager, they understand how to manage a project, they understand how to financially save, they understand how to do risk assessment, they understand how to talk to C-suiters, they understand how to speak to, to stakeholder, all of those things are what we're doing.
00:16:04.561 --> 00:16:17.291
Now, simultaneously, while we were embedding those, uh, certifications to the degree, a project came about, it's funded by the National Science Foundation to, uh, to develop the NICE framework.
00:16:18.551 --> 00:16:21.291
They said,"Look, we've got two constituents here.
00:16:21.311 --> 00:16:28.400
We've got academia, we've got industry, we've got this demand there for both degree and certifications.
00:16:28.500 --> 00:16:36.620
Let's put the two of them together." And I was fortunate to be a part of that group, and let's map the, uh, the knowledge and skills
00:16:36.876 --> 00:16:37.316
Yes
00:16:37.480 --> 00:16:46.087
what a degree should be So we spent about a year mapping and developing this thing, the early version of NICE framework.
00:16:46.148 --> 00:16:49.298
And then when we did that, the NSF funded the, the thing.
00:16:49.359 --> 00:16:51.639
We as academia recognized the value of that.
00:16:52.058 --> 00:16:53.038
We need to be involved.
00:16:53.078 --> 00:16:55.479
If we not involved, then we, uh, we obsolete, right?
00:16:56.058 --> 00:17:06.199
Um, and industry took that and, uh, and then the National Institute of Standards of Technology, the NIST, decided,"You know, this is really good,"
00:17:07.159 --> 00:17:07.558
Yes
00:17:07.598 --> 00:17:08.838
and they took it over.
00:17:09.278 --> 00:17:11.019
And that is a world standard today.
00:17:11.398 --> 00:17:27.578
The NIST, um, is, is a world standard that, that maps the knowledge of the, the work roles, specifically to the certifications, and also talks about the value of the degree in that and all that.
00:17:27.619 --> 00:17:32.577
So this can, this both industry and academia was able to come together and find a synergy.
00:17:32.617 --> 00:17:44.958
So when we got the centers of academic excellence, the students were able to get that certification upon graduation that we give to them to tell them,"Look, you are now accepted.
00:17:44.998 --> 00:17:48.877
You are recognized by industry to be a valuable entity there is."
00:17:49.453 --> 00:17:49.875
That's wonderful.
00:17:49.994 --> 00:17:54.913
Now, those standards, you know, we're talking about quality here, so we're talking about, the three things of the iron triangle, right?
00:17:54.993 --> 00:17:56.874
We're talking about reducing costs,
00:17:57.761 --> 00:17:58.061
Yes
00:17:58.094 --> 00:17:59.255
acceleration with the degree.
00:17:59.314 --> 00:18:01.994
We're talking about, you know, increasing the quality,
00:18:02.605 --> 00:18:03.006
Mm-hmm,
00:18:03.054 --> 00:18:06.730
creating these standards and also boosting the access.
00:18:06.914 --> 00:18:08.854
Ken, when did you work on that framework?
00:18:08.874 --> 00:18:11.713
W- uh, it was it, was it after Quantico that you did that?
00:18:11.794 --> 00:18:12.815
Or where, where did you work on that
00:18:12.998 --> 00:18:20.117
Actually, I worked on it before Quantico when I was with American Public earlier on around 2016, 2017
00:18:20.397 --> 00:18:20.577
Yeah
00:18:20.699 --> 00:18:23.018
was when I was able to work, uh, work on that.
00:18:23.458 --> 00:18:39.358
And, you know, I was also, because I was in, in the industry as an inspector general, finished with as an inspector general, and started to work in, in- inside the industry,'cause I also served as a defense contractor, uh, subsequent to that as well.
00:18:39.939 --> 00:18:45.698
Um, I was invited to the table with a, uh,'cause I have a PhD in cyber and a CISSP in cyber.
00:18:46.138 --> 00:18:50.897
I have got all these years and years of practical experience.
00:18:51.317 --> 00:18:58.243
So I'm one of those individuals, the few individuals with that level of experience and academic, academic experience as well
00:18:58.915 --> 00:18:59.215
Oh yeah.
00:18:59.457 --> 00:19:04.797
Now Ken, I want you to put on that hat, and I want to sort of move a little bit to the future here for a second.
00:19:05.271 --> 00:19:05.531
OK
00:19:05.536 --> 00:19:09.946
And that is, you know, I'm opening up Pandora's box of AI right now.
00:19:10.290 --> 00:19:11.270
Okay, go ahead
00:19:11.446 --> 00:19:18.667
specific for you, and that is, you know, a lot of folks are saying,"Well, you won't need cyber folks anymore." This is...
00:19:18.707 --> 00:19:20.067
I don't believe this, but I'm gonna say it.
00:19:20.287 --> 00:19:25.287
The position is, you know, you don't need that because you're going to have AI that's going to be able to take care of this.
00:19:25.307 --> 00:19:27.346
And so in fact, we have what?
00:19:27.606 --> 00:19:28.767
Claude Mythos, right?
00:19:28.866 --> 00:19:29.287
Mythos.
00:19:29.327 --> 00:19:29.366
I
00:19:29.451 --> 00:19:29.851
Yeah
00:19:29.936 --> 00:19:40.175
Mythos that's, that's coming out, but they didn't even re- release it to the full public because they are worried about, you know, zero day vulnerabilities.
00:19:40.536 --> 00:19:48.816
Could we start with zero day vulnerabilities and explain that to, uh, uh, you know, our listeners here, and then talk a little bit, if you would.
00:19:48.855 --> 00:19:50.476
So let's start with that, and then I'll come back with another
00:19:50.559 --> 00:19:50.819
Yeah.
00:19:50.880 --> 00:19:51.740
Thanks, thanks, Vernon.
00:19:51.840 --> 00:20:02.921
And to be honest, that's probably was the underpinning of what occurred at the cyber infrastructure breach in OHA authorized, yes, that's the Canvas breach.
00:20:03.122 --> 00:20:04.040
That was a zero day.
00:20:04.580 --> 00:20:04.681
Uh,
00:20:05.272 --> 00:20:05.373
So
00:20:05.500 --> 00:20:05.941
and
00:20:06.272 --> 00:20:08.173
that into, in layman's terms that, that folks
00:20:08.401 --> 00:20:16.111
yes, so, you know, we patch and fix vulnerabilities when we know what those vulnerabilities are.
00:20:17.051 --> 00:20:20.070
At least we are expected to patch, and to, to fix the hole.
00:20:20.092 --> 00:20:24.090
You know, if you have a boat and it's leaking, then you patch the boat and stop it from leaking, right?
00:20:24.412 --> 00:20:28.211
If you have a door that the bolt, that their lock is broken, then you fix the door.
00:20:28.301 --> 00:20:32.521
If you get your car out in the parking lot today and you leave the car, you're gonna lock it before you leave, right?
00:20:32.563 --> 00:20:34.122
That, because it's a vulnerability.
00:20:35.481 --> 00:20:43.012
Now, if you're driving a car and, you may or may not notice a light on your dashboard
00:20:45.373 --> 00:20:45.692
Right?
00:20:46.761 --> 00:20:52.381
and, or this faint light on the dashboard, and you maybe ignore it.
00:20:53.442 --> 00:20:55.701
It's not really a zero day, you ignore.
00:20:55.760 --> 00:21:09.260
But, but that, but that inevitable thing of your car that's occurring, such as a failure of some module, et cetera, and you're driving at a very high rate of speed, and all of a sudden the light does come on.
00:21:10.480 --> 00:21:16.361
You may be in a, in a rush hour traffic, you may be in a six-lane highway, um, just your brake failure.
00:21:16.601 --> 00:21:29.520
Your brake may fail, and your car is starting to skid out of control because you're going at 65, 70 miles an hour, and your car is starting to fail at a point, and you look right, there's a car, you look left, there's a car.
00:21:29.800 --> 00:21:31.121
You can't veer off, et cetera.
00:21:31.541 --> 00:21:33.181
You're now in a panic, right?
00:21:33.681 --> 00:21:36.721
Uh, and you can't stop, you can't brake because of the car behind you, right?
00:21:37.601 --> 00:21:38.461
That is zero day.
00:21:39.101 --> 00:21:43.641
That is an unknown, unpredicted emergency.
00:21:44.181 --> 00:21:45.520
It is there in front of you.
00:21:45.641 --> 00:21:45.882
It...
00:21:45.901 --> 00:21:51.881
But the reciprocal to that is that you had this knowl- and, and that's a good i- the g- good analogy.
00:21:52.402 --> 00:21:59.500
Something, a brake light comes on and warning to tell you, you have some low, uh, low brake fluid that could possibly fail.
00:22:00.121 --> 00:22:03.401
Get to a mechanic, get to a shop to get it fixed.
00:22:03.442 --> 00:22:04.541
You probably ignore it, right?
00:22:05.336 --> 00:22:05.477
Yeah.
00:22:05.577 --> 00:22:10.297
Well, if you're s- you know, I, I won't say names, but you know, we've both in our families have probably experienced
00:22:10.614 --> 00:22:10.993
That's right.
00:22:11.913 --> 00:22:13.193
But carefully you'll get it to the...
00:22:13.263 --> 00:22:13.983
And you'll fix that.
00:22:14.094 --> 00:22:17.584
So when you fix that, you've just taken care of the vulnerability.
00:22:18.733 --> 00:22:20.953
So that's a vulnerability that's taken care of.
00:22:20.993 --> 00:22:28.693
But the one where you didn't know about, and you're driving on a road and all of a sudden even a tire blowout, that is a zero day.
00:22:28.794 --> 00:22:33.653
That has happened right away, and that point you weren't prepared for it.
00:22:34.407 --> 00:22:35.807
And that could be small scale.
00:22:35.968 --> 00:22:36.087
It...
00:22:36.208 --> 00:22:44.268
I mean, it could be, let's say, you're in a, you're in a good place where your tire is blow- Like, let's say you've got those run flat tires, right?
00:22:44.708 --> 00:22:47.087
Uh, you probably have those, and you get an indicator.
00:22:47.188 --> 00:22:48.847
I had it by my feet cold.
00:22:49.528 --> 00:22:57.607
And I see, I see the light that says,"Uh, tire pressure's going down, but you're safe to find a safe place." And that was a run flat, flat tire, right?
00:22:57.988 --> 00:23:00.948
I was able to safely get off the road and get my tire changed.
00:23:01.428 --> 00:23:04.708
Or some tires that go poof, and you feel.
00:23:04.788 --> 00:23:14.228
Now, now if you had the time to, to get off the road and get that, mitigate that issue, uh, you know, you, you pretty much have taken care of that.
00:23:14.448 --> 00:23:16.008
That's a low vulnerability.
00:23:16.087 --> 00:23:18.508
That's a low level of vulnerability that you are there.
00:23:18.827 --> 00:23:19.367
But you've...
00:23:19.448 --> 00:23:33.817
If you in this, in this traffic, and you're going high speed, and that, that tire blows out at that point, that's something catastrophic that has just occurred to you right there, and that is what the zero day vulnerability is.
00:23:34.298 --> 00:23:42.097
And, and vulner it's something, you know, to be honest, it's maybe something that we are now gonna live with, especially with AI.
00:23:42.758 --> 00:24:00.458
Especially with AI, because what AI does is AI advance the process where a human would be alerted to this blowout, um, by allowing the hacker or the malicious individual to see it before I do.
00:24:01.917 --> 00:24:05.958
If they're scanning the networks, in this case it was a phishing attempt, you know.
00:24:06.377 --> 00:24:10.156
And we all have phishing, we all have individuals who will fall prey to something, right?
00:24:10.278 --> 00:24:11.428
Um, but
00:24:11.540 --> 00:24:16.000
a friend in Africa that received an inheritance and needs you to help...
00:24:16.121 --> 00:24:16.580
Yes, no.
00:24:16.922 --> 00:24:17.221
Yes.
00:24:17.461 --> 00:24:17.540
not,
00:24:17.641 --> 00:24:17.861
Yeah
00:24:18.000 --> 00:24:20.482
uh, as blatant as those, but it's much more sophisticated.
00:24:20.522 --> 00:24:21.182
We should say that.
00:24:21.461 --> 00:24:29.301
They are much more sophisticated, and with AI, the phishing and the, the other attempts are even more s- you know, complicated, and they're
00:24:29.487 --> 00:24:29.886
yes.
00:24:30.382 --> 00:24:30.542
They're
00:24:30.686 --> 00:24:30.967
Yeah.
00:24:31.586 --> 00:24:38.906
And, and, and, you know, the, the more insidious aspect of this was that we've got this thing now that's called two-factor authentication.
00:24:40.227 --> 00:24:43.507
By now, just about everyone is being two-factor authenticated.
00:24:43.807 --> 00:24:45.527
"Oh, do you trust this browser?
00:24:46.007 --> 00:24:57.497
Could I send a link to you in your, in your known, uh, you know, device for you to put in this code?" And, oh gosh, we've gotten really, really good and trustworthy with this now, right?
00:24:57.527 --> 00:25:05.186
So now we're two-factor authenticated, and we are feeling more confident that whatever we do after we authenticate, guess what?
00:25:05.227 --> 00:25:05.646
It's okay.
00:25:06.366 --> 00:25:27.067
Well, what AI did in this case, and it's continued to do, is that i- once we authenticated our bank account and we're sitting there, uh, doing some transaction in our bank account, this pop-up occ- appears that tells us,"Oh, you know, Mom just emailed this thing to us in case you need some help." And she's in...
00:25:27.606 --> 00:25:29.946
I'm saying Mom, or maybe a friend or maybe something.
00:25:29.998 --> 00:25:30.438
a good one.
00:25:30.538 --> 00:25:30.778
That's the
00:25:30.926 --> 00:25:31.186
yeah.
00:25:31.338 --> 00:25:32.138
Your child, you
00:25:32.298 --> 00:25:36.147
"Could you look at this?" Maybe an alert comes in your phone, uh, you know, it says, uh, this email.
00:25:36.228 --> 00:25:40.948
You look at the email, and that email's got,"Hey, I need some help," for whatever.
00:25:41.057 --> 00:25:44.107
"Can you look at this link?" And you go and you click on that link.
00:25:45.387 --> 00:25:47.228
Could be something as innocuous as that.
00:25:47.468 --> 00:25:54.288
And when you click on that link, and now you're in this secure portal, you're now in this security channel, you've already authenticated.
00:25:55.682 --> 00:25:56.083
Yes.
00:25:56.343 --> 00:25:57.803
You've, you've opened, you've
00:25:57.847 --> 00:25:59.847
you opened the Pandora box already
00:25:59.884 --> 00:26:00.823
the door open
00:26:00.948 --> 00:26:01.907
and left the door open.
00:26:02.028 --> 00:26:06.268
It's like you go into your house and you walk in and someone follows you into that house, right?
00:26:06.948 --> 00:26:10.788
And you're now there, and they're, they're gonna open, they're going to try the closet.
00:26:11.327 --> 00:26:17.887
Uh, a- and, and so what AI does is AI now clone this, make it more appealing.
00:26:17.907 --> 00:26:31.577
"Oh, I, I wanted, you know, you should do this right away because this, you actually, you're not authorized." Let's pretend you're not authorized to be here, and you're now so desperate'cause you need to with- uh, this is a moral day, and you gotta get your money out of the bank, whatever it's gonna be.
00:26:31.597 --> 00:26:39.998
And you're there, and it tells you,"Look, if you don't, if you don't click on this, you're not gonna get your money." So now you've got this intense desire,
00:26:40.105 --> 00:26:42.365
and the psychological aspects,
00:26:42.718 --> 00:26:43.268
Yes, indeed.
00:26:43.484 --> 00:26:43.684
here.
00:26:43.904 --> 00:26:46.645
Socio-psychological parts of the cyber
00:26:46.894 --> 00:26:48.713
Pressure, under pressure.
00:26:49.153 --> 00:26:57.784
So in this case, you know, the, the body, the individuals knew that you're dealing with students, you're dealing with your academia, especially students.
00:26:57.804 --> 00:27:00.834
So where- wherever this came from, and they're easy prey.
00:27:01.433 --> 00:27:09.894
Um, and it's also with AI, it was so eas- it's easy to scan the database and the vulnerabilities that are existed.
00:27:09.913 --> 00:27:11.673
By the way, this is not the first time, right?
00:27:11.703 --> 00:27:20.683
This is not the first time this has occurred, so, um, it's easy to kind of push this out there and find this new target, and you know it's gonna happen.
00:27:20.703 --> 00:27:23.374
This playbook was already in play before, right?
00:27:24.034 --> 00:27:31.196
Um, and in this case, it's application program interface where the keys were swapped out and you never look.
00:27:31.386 --> 00:27:34.365
uh You now have this electronic lock on your door.
00:27:36.146 --> 00:27:48.027
You're out of town and someone has to maybe walk your dog back into your house, um, and, uh, or let your child in from school, and you're on vacation.
00:27:48.086 --> 00:27:48.676
You're like,"Okay.
00:27:48.777 --> 00:27:49.386
All right, fine.
00:27:49.426 --> 00:27:53.767
I'll let this trusted person in." And you unlock that electronically, right?
00:27:53.787 --> 00:28:04.487
The person now in your house The person now in your house, you have a safe with your valuables in there, or maybe your desk drawer with, um, with your keys.
00:28:05.106 --> 00:28:11.007
Uh, let's say that you've got some valuables, and you left that key in that, in that drawer
00:28:11.493 --> 00:28:11.994
Mm-hmm
00:28:12.126 --> 00:28:14.076
got a layer already in your front door, right?
00:28:14.737 --> 00:28:15.596
You're not thinking.
00:28:15.636 --> 00:28:17.116
You've got everyone in the house who trusted.
00:28:17.477 --> 00:28:21.257
You can stack and go into your area to take your wallet or take your valuable, case may be.
00:28:21.757 --> 00:28:29.777
Now, this person's in your house, and the person decided le- to go around a little bit to see what else they could kind of leverage themselves from, of, right?
00:28:30.757 --> 00:28:33.816
And they walk into your office, and there's a key to your safe
00:28:34.779 --> 00:28:35.140
Mhm
00:28:37.703 --> 00:28:38.703
That's what that was.
00:28:38.777 --> 00:28:40.076
there's nothing to prevent them.
00:28:40.544 --> 00:28:41.463
Nothing to prevent them
00:28:42.175 --> 00:28:47.895
uh, sometimes in my mind, tell me if this is correct, Ken, in AI, it's not just one individual you've let in the house.
00:28:48.375 --> 00:28:58.736
Because AI can hit it so many times, millions of iterations, the o- chance of it finding that key has just been exponentially increased
00:28:58.983 --> 00:29:12.365
Yeah, not only that, Vernon, you've got in your home, you've got smart refrigerators, you've got, again, smart cameras, you've got maybe electronically controlled environmental co- control system, and all of these things we are broadcasting out there, by the way.
00:29:12.404 --> 00:29:13.624
They're all un- unencrypted.
00:29:14.243 --> 00:29:27.784
Now, all of that information, by the way, are going out there, and they're in the world, and then these little breadcrumbs are being dropped that are associated with our own, uh, address.
00:29:27.804 --> 00:29:31.263
And if you go there today, you can see that y- today, you...
00:29:31.444 --> 00:29:31.804
it is...
00:29:32.144 --> 00:29:36.307
If you put your name in, or your address, you could, that could, you could be...
00:29:36.426 --> 00:29:37.906
it could know where you live, right?
00:29:38.188 --> 00:29:38.606
That's...
00:29:40.686 --> 00:29:40.787
Oh,
00:29:40.866 --> 00:29:41.446
so AI
00:29:41.707 --> 00:29:43.886
it's maddening in how much information that is out there.
00:29:44.028 --> 00:29:44.507
For example,
00:29:44.626 --> 00:29:45.067
right.
00:29:45.106 --> 00:29:45.467
That's right
00:29:45.826 --> 00:29:50.047
a letter for my son the other day at, at my, uh, address, he
00:29:50.166 --> 00:29:51.567
FRIES
00:29:51.727 --> 00:29:53.406
And it was about a particular thing, I won't say what it was.
00:29:53.787 --> 00:29:56.386
But he said,"I have never given them your address.
00:29:56.428 --> 00:29:57.487
There is no reason why I
00:29:57.499 --> 00:29:57.959
That's right
00:29:57.987 --> 00:29:59.166
Well, how did they do it?
00:29:59.227 --> 00:30:00.406
Well, they went and found the data.
00:30:00.607 --> 00:30:01.338
They found out that he was
00:30:01.465 --> 00:30:01.786
That's right.
00:30:02.306 --> 00:30:02.705
That's right
00:30:02.718 --> 00:30:06.258
they said,"Oh, we will just, like, send this right over to,
00:30:06.286 --> 00:30:06.626
That's right
00:30:06.877 --> 00:30:08.518
par- mom and dad's place
00:30:08.730 --> 00:30:09.130
That's right
00:30:09.159 --> 00:30:13.857
them look at it." And that was, uh, he was not happy about that, and I was not happy about that
00:30:14.018 --> 00:30:14.419
That's right
00:30:14.678 --> 00:30:16.978
it's like, boy, you know, someone's...
00:30:17.718 --> 00:30:21.748
if you, if you think your data's safe out there and no one's looking through it, you gotta, you
00:30:21.948 --> 00:30:22.429
Yeah.
00:30:22.468 --> 00:30:26.627
Well, well, Vernon, your, your data is not s-- uh, I mean, this is not new, to be honest.
00:30:27.067 --> 00:30:35.188
When we de- developed the data repository and databases, and we put thing into those storage, when we wanted to delete them, we removed the primary key.
00:30:35.249 --> 00:30:44.008
We said we are deleting the data, uh, but you may go back there and see the delete, the data are still encoded in your memory, in those memory processes, right?
00:30:44.548 --> 00:30:47.347
And those data lives on forever, forever, right?
00:30:47.827 --> 00:30:56.297
We built AI to find and recreate those linkage between those, those fields and those records.
00:30:56.557 --> 00:30:58.218
That's why we did build data, right?
00:30:58.297 --> 00:30:59.277
Go find all of those.
00:30:59.656 --> 00:31:21.519
And so when you s- when you scroll through the internet and the databases that are out there and the dark web, et cetera, you're gonna bring Vernon back together, even though Vernon tried to separate his association from wherever he used to work, where you grew up, where you, who you befriended, who your friend, childhood friendship were.
00:31:21.900 --> 00:31:25.858
Wherever they were, we're gonna, the model is gonna be able to bring them all back together.
00:31:26.759 --> 00:31:30.558
Your home, your characteristics, your method, your, what time do you leave at home?
00:31:31.679 --> 00:31:33.759
Uh, where you store your devices.
00:31:33.900 --> 00:31:35.299
Let's say you evaluate yourself.
00:31:35.358 --> 00:31:36.699
Again, we was talking about that safe.
00:31:37.119 --> 00:31:46.499
Maybe that safe has got a, an IP address somewhere tied to somewhere else, and the time of day that you lock it and open it, or if you lock it at all, or don't lock it, don't lock it.
00:31:46.538 --> 00:31:54.144
If I'm intentional And I'm in your home now, and I'm able to use all the facial intelligence in some way and get everything about you.
00:31:54.203 --> 00:31:55.824
It's gonna probably tell me you got a vulnerability.
00:31:56.284 --> 00:32:02.371
It's gonna tell me probably where I could probably get some other conf- and what time you're gonna be back home, what do you like to do, what time of the day, etc., etc.
00:32:02.911 --> 00:32:03.990
It's gonna do all of that.
00:32:04.330 --> 00:32:07.431
And I'm not, you know, it's not a human that's gonna be involved with this.
00:32:07.570 --> 00:32:09.580
It's another, uh, you know, uh,
00:32:10.054 --> 00:32:10.134
An
00:32:10.151 --> 00:32:10.861
AI a-
00:32:10.894 --> 00:32:11.054
An
00:32:11.191 --> 00:32:28.851
agent is gonna say,"Hey, this is the most efficient thing that you could do in order to come to this outcome." If I say,"I want to steal some money from this, uh, from this, uh, ou- outcome, a- and how do I do it?" It's gonna get it all together, and it's gonna show me what the most efficient, what the most innocuous way, how to bury the evidence, how to obfuscate myself.
00:32:29.191 --> 00:32:30.191
It's gonna do all of that.
00:32:30.550 --> 00:32:32.971
So that anthropic, um, w- w- you know,
00:32:33.178 --> 00:32:33.978
The M-Mythos,
00:32:34.050 --> 00:32:34.300
devel-
00:32:34.578 --> 00:32:35.377
yeah, Claude Mythos,
00:32:35.550 --> 00:32:40.530
that you were trying to, that you were referring to, oh, oh, man.
00:32:41.391 --> 00:32:49.411
Yeah, so there were, you know, there were some insights about that that, um, that it's troubling because what I do as a human is that I...
00:32:50.601 --> 00:32:53.861
We're starting to get better at identifying these vulnerabilities.
00:32:54.220 --> 00:32:54.579
Mhm
00:32:54.901 --> 00:33:01.020
We don't know what a, we, you don't know what a zero day is if you don't know what a zero day is, but you know what a known vulnerability is.
00:33:01.560 --> 00:33:14.381
Today, we can't even worry about zero days because what we know, it takes us a, a very, very long time to fix because vulnerabilities are available constantly.
00:33:15.080 --> 00:33:21.820
You know, always there's a vulnerability, and we are constantly playing whack-a-mole to try to fix those and plug that hole, right?
00:33:22.641 --> 00:33:24.601
So that takes up a great period of our time.
00:33:25.151 --> 00:33:26.050
And we are humans, right?
00:33:26.131 --> 00:33:29.971
We get weary, we get tired, and we may leave it for tomorrow.
00:33:30.070 --> 00:33:35.901
Well, we're leaving that for tomorrow to fix while there are zero-day vulnerabilities that are coming up right there
00:33:36.596 --> 00:33:36.976
Mhm
00:33:37.346 --> 00:33:41.807
And what we use AI to identify, prioritize what are more important.
00:33:42.307 --> 00:33:47.247
If we get a zero day, we have to put everything aside and address the zero day,
00:33:47.849 --> 00:33:48.190
Mhm
00:33:48.446 --> 00:33:49.666
that's what's gonna really hurt.
00:33:50.027 --> 00:33:55.067
And again, you get, your, your door, your car needs the oil, it needs to be fixed.
00:33:55.086 --> 00:33:59.307
That tire, you're going on a long road, you better have enough air in that tire.
00:33:59.366 --> 00:34:00.267
That's a zero day, right?
00:34:00.866 --> 00:34:03.406
So we're gonna address that before we get on the, uh, on the trip.
00:34:04.086 --> 00:34:09.467
Uh, if we are able to use the artificial intelligence, uh, models in order to help us to do so.
00:34:09.547 --> 00:34:13.646
So it, it's both sides of the fence that are used for good or for bad.
00:34:14.126 --> 00:34:25.666
But it's, it's how quickly we're able to get ahead of each other, and that's where the quantum, this new evolution of this quantum challenges that we are facing.
00:34:25.726 --> 00:34:31.476
And, we were thinking that quantum algorithm, quantum cryptography would've been broken.
00:34:31.556 --> 00:34:33.876
Quantum would've been a major risk.
00:34:34.817 --> 00:34:35.996
That's what we were thinking.
00:34:36.527 --> 00:34:37.456
That once we...
00:34:37.567 --> 00:34:39.806
which is not commercially, available by the way now.
00:34:39.949 --> 00:34:40.210
Right,
00:34:40.556 --> 00:34:42.686
with these altered states of, electrons, et cetera.
00:34:43.126 --> 00:34:45.766
Uh, but here comes AI.
00:34:46.766 --> 00:35:00.797
And AI now have started to be this real concern to kind of figure all of this out in a q- in a, in a, in a f- you can ask a question to, to, to, to Bard right now, and you get an answer in five seconds.
00:35:01.434 --> 00:35:01.693
Mm-hmm.
00:35:01.867 --> 00:35:03.387
Now, it may not be the right answer.
00:35:03.753 --> 00:35:03.954
Right.
00:35:04.454 --> 00:35:05.594
Could you be hallucinating?
00:35:05.653 --> 00:35:05.893
Yes
00:35:06.367 --> 00:35:06.666
Yes.
00:35:07.047 --> 00:35:07.927
But it's not hallucinating.
00:35:07.976 --> 00:35:10.217
But if it turns out, all it takes is one.
00:35:10.257 --> 00:35:10.516
You know?
00:35:10.597 --> 00:35:16.827
All it takes is one, and that's what we say, in our business, that we could patch this hole, we could put up the best defense.
00:35:17.126 --> 00:35:19.617
I know by the way, we talk about a layer of defense, right?
00:35:20.036 --> 00:35:21.516
But all it takes is one to get through.
00:35:21.876 --> 00:35:22.456
Just one.
00:35:22.936 --> 00:35:26.157
Like what happened in, in this, in this infrastructure Campus breach.
00:35:26.677 --> 00:35:28.416
One time, one breach, and that's it.
00:35:28.817 --> 00:35:40.065
And, and you probably know, I don't know if you suspect, uh uh, Vernon, that, that supposedly Campus infrastructure, provided the ransom for them to give them back the data that they breached.
00:35:40.686 --> 00:35:42.985
Well, as you probably recognize
00:35:43.186 --> 00:35:43.865
I, I don't...
00:35:43.965 --> 00:35:46.125
Who, how can you validate that that
00:35:46.233 --> 00:35:46.632
Thank you.
00:35:46.744 --> 00:35:47.364
destroyed?
00:35:47.672 --> 00:35:48.733
Thank you very much.
00:35:48.864 --> 00:35:49.125
These are,
00:35:49.713 --> 00:35:50.373
Thank you very much
00:35:50.465 --> 00:35:51.445
thieves that told you that?
00:35:51.485 --> 00:35:52.485
"Oh, yeah, we got rid of
00:35:52.601 --> 00:35:52.900
Thank you.
00:35:53.085 --> 00:35:54.304
Don't worry about it."
00:35:54.541 --> 00:36:02.121
Yes, and that's the reason why there are probably some class action lawsuits coming against, uh, infrastructure campus right now
00:36:02.268 --> 00:36:08.489
data, data from millions of students, know, with instructors gonna have, this is gonna be ongoing.
00:36:09.045 --> 00:36:09.726
That's right.
00:36:09.766 --> 00:36:10.326
That's right
00:36:10.369 --> 00:36:14.451
know, Ken, going back to your professor cap on here for a second, also,
00:36:14.463 --> 00:36:14.762
Yes
00:36:15.092 --> 00:36:17.990
you know, and also your, your, uh, expertise cap.
00:36:18.552 --> 00:36:22.550
Um, if you're talking to a student that says,"I don't know if I should go into cybersecurity.
00:36:22.590 --> 00:36:22.811
I'm gonna,
00:36:22.891 --> 00:36:23.150
Yes
00:36:23.510 --> 00:36:23.972
I don't know if I...
00:36:24.052 --> 00:36:30.199
There, it's just gonna be taken care of by AI." What would you tell that student that says, I wanna have a job when this is done.
00:36:30.239 --> 00:36:33.199
I wanna have a future, I wanna learn something.
00:36:33.260 --> 00:36:34.639
I wanna become a better person.
00:36:35.139 --> 00:36:41.960
Maybe I shouldn't go into cybersecurity because AI is just gonna take that over." What do you say to that student or that
00:36:42.092 --> 00:36:48.952
Vernon, you know what I would say, I would assume the pleading, the pleading role with the students, with the student.
00:36:49.632 --> 00:36:52.273
That look, I am vulnerable.
00:36:52.833 --> 00:36:56.052
I as an individual, I'm vulnerable because my data is out there.
00:36:56.873 --> 00:36:58.333
My family is vulnerable.
00:36:58.393 --> 00:37:00.932
My son, my daughter got a letter.
00:37:01.373 --> 00:37:02.672
She was 13 years old.
00:37:03.206 --> 00:37:10.726
She opened the letter and it was announcement, announcing of a cybersecurity breach that occurred in, in Office of Personnel Management, OPM.
00:37:12.146 --> 00:37:16.306
She got the notice of the breach before I did, and I work at OPM, right?
00:37:16.706 --> 00:37:17.985
Our information was breached, right?
00:37:18.885 --> 00:37:22.666
And that was when you start to realize the vulnerability that we all have.
00:37:23.226 --> 00:37:40.445
So I would say to that student,"You know, I am pleading with you, similar to the way that I would plead with you for that, uh, you know, for that resident, for that medical residence." Because that medical resident is gonna turn into the doctor who's gonna take care of me, the, my quality of life, right?
00:37:40.925 --> 00:37:42.764
That individual that I prize so much.
00:37:43.106 --> 00:37:51.016
All other disciplines around our society that we need so very, very much, food safety individuals, mechanics that we depend on.
00:37:51.096 --> 00:37:54.635
All these individuals we need are these roles that they serve.
00:37:54.695 --> 00:38:00.155
This role now of cyber is, is a risky role for all of us as a civilization.
00:38:00.215 --> 00:38:09.436
It virtually could disintegrate civilization and cause chaos, especially in our ro- in our environmental critical infrastructure system.
00:38:09.835 --> 00:38:19.076
Uh, we are talking now about the Iranians, um, uh, intercepting the oil tank levels meters.
00:38:19.115 --> 00:38:20.956
I don't know if you're aware of that.
00:38:21.115 --> 00:38:22.385
They're, they're probo-
00:38:22.458 --> 00:38:22.938
about that.
00:38:23.596 --> 00:38:23.835
Yeah,
00:38:23.918 --> 00:38:24.338
So what--
00:38:24.615 --> 00:38:24.715
so
00:38:25.438 --> 00:38:29.059
the Iranians are, have been cyber warriors for a long
00:38:29.195 --> 00:38:30.135
For a long time.
00:38:30.519 --> 00:38:32.019
And so what-- tell, talk about what they're,
00:38:32.175 --> 00:38:32.394
Yeah.
00:38:32.518 --> 00:38:32.739
doing
00:38:32.815 --> 00:38:46.619
So when you drive into the gas station to, to receive your gas, that gas tank or g- gas meter is tied to the lo- to the gas reser- uh, vat that in the ground.
00:38:47.019 --> 00:38:54.400
And that gas vat, uh, has a, a gauge that tells the operator how much, how much fuel is in there.
00:38:54.880 --> 00:38:59.981
The type of fuel that are in there as well, um, it educates them about that.
00:39:00.559 --> 00:39:11.860
So the risk is that you could have that gas gauge that is showing that it's half empty when it's actually a quarter empty, or showing that it's half full when it's quarter full.
00:39:12.440 --> 00:39:19.800
Not only that, it al- it could also have, uh, it also tells if it's clean, if it's non-con- contaminated.
00:39:20.460 --> 00:39:21.420
Just so scary.
00:39:21.460 --> 00:39:26.032
Now you could be filling your vehicle and you've got contaminated gas
00:39:26.512 --> 00:39:26.811
Yeah.
00:39:27.610 --> 00:39:28.851
Uh, it's,
00:39:29.030 --> 00:39:35.711
I mean, there's so many ways that, that are, they're vulnerabilities, and it's, a lot of this is creativity.
00:39:36.070 --> 00:39:38.510
So a student that you say,"Uh, uh, AI's gonna do
00:39:38.630 --> 00:39:39.050
Yeah
00:39:39.090 --> 00:39:42.331
to tell them that,"No, need you
00:39:42.612 --> 00:39:43.791
exactly, Vernon.
00:39:43.931 --> 00:39:45.110
need your creativity
00:39:45.710 --> 00:39:45.951
Yeah
00:39:46.052 --> 00:39:48.871
gotta start thinking about the cr-" Um, I
00:39:49.016 --> 00:39:49.414
and Vernon,
00:39:49.490 --> 00:39:49.731
mic.
00:39:49.775 --> 00:39:50.054
so,
00:39:50.291 --> 00:39:50.490
Yeah
00:39:50.715 --> 00:39:54.476
uh, I was coming back from one of the conferences that you allowed me to go.
00:39:54.534 --> 00:39:57.755
I was sitting in an airplane, uh, Delta I think it was, sitting beside a young man.
00:39:57.835 --> 00:39:58.735
We introduced ourselves.
00:39:58.994 --> 00:39:59.795
He asked me what I do.
00:40:00.135 --> 00:40:06.135
I said,"I'm a cybersecurity director at American APUS." He's like,"Oh," and then we instantly got bonded.
00:40:06.295 --> 00:40:09.275
"So who do you do?""I'm a geneticist.""Okay.
00:40:09.936 --> 00:40:10.375
All right.
00:40:10.516 --> 00:40:12.375
Um, okay.
00:40:12.635 --> 00:40:13.574
We need you, Dr.
00:40:13.615 --> 00:40:14.775
Williams.""You do?
00:40:15.375 --> 00:40:27.094
I don't know anything with gene therapy, ge-" He said,"Yes, you come into the industry because we need secure the gene therapy, the gene me- medium that we're, you know, that we're working with," right?
00:40:27.954 --> 00:40:33.074
Okay, fast-forward today now, I have an administrative assistant that, that is serving me.
00:40:33.474 --> 00:40:44.375
His girlfriend is actually involved in, in, in verifying proper genes for individuals based on, on, on genetic defects.
00:40:45.458 --> 00:40:45.940
Mm-hmm
00:40:46.114 --> 00:40:53.496
And he tells me stories about her, related to the trusted verif- uh, of the, of the ge- gene, et cetera.
00:40:53.554 --> 00:40:55.934
She has to validate all of that and secure it.
00:40:56.235 --> 00:41:09.036
So when you take a blood test, and you've got a, you know, a disease of some sort that needs to be properly treated, you have to get this gene therapy that, validates that you could do, blood transfusion, et cetera, and she's responsible for that.
00:41:09.076 --> 00:41:10.576
Well, it comes to a, a computer
00:41:12.380 --> 00:41:12.760
Yes, it
00:41:12.840 --> 00:41:16.940
Come through the system and that gets corrupted, then we've got a issue.
00:41:17.320 --> 00:41:26.181
So the, so the student leaves the cybersecurity education program and goes to work in any possible industry you could think of.
00:41:26.820 --> 00:41:31.880
Drone, aviation, all enga- uh, you know, critical infra- infrastructure.
00:41:32.481 --> 00:41:33.500
Uh, stoplight.
00:41:33.559 --> 00:41:39.699
You've got a stoplight, it goes out because of some critical- criticality, you've got chaos.
00:41:39.981 --> 00:41:44.539
You've got the student there that are securing the network if they, if there's a, if there's a hack.
00:41:44.800 --> 00:41:49.400
If you got a ransomware that takes out those stop, those stoplights, and then you've got a real issue, right?
00:41:49.440 --> 00:42:03.900
If you've got a ransomware that shuts down all the light in the grid, all the lights in the grid, you need a cyber, cyber educated individual in that team to help to do the incident response in order to help you to understand how to get those computers back on there.
00:42:04.161 --> 00:42:20.340
If you got a storm that comes along, either earthquake or hurricane, and it takes our data centers, our data centers today, by the way, that are really, really surfacing our artificial intelligence network, et cetera, you have to have those individuals that are providing security in those individuals.
00:42:20.880 --> 00:42:26.940
And that volume of individuals, we haven't even touched the surface, uh,
00:42:27.175 --> 00:42:27.717
Mm-hmm
00:42:27.800 --> 00:42:29.019
the workforce today.
00:42:29.360 --> 00:42:30.519
I mean, I'm with NASA.
00:42:30.579 --> 00:42:39.201
Since I've been here, NASA came to me with a unique issue about the Artemis, uh, space program and communicating in space.
00:42:39.880 --> 00:43:04.239
There were the zero, uh, gravity and the need for greater nodes, so you could avoid the latency between nodes to be able to communicate from one path to the next path So a lot of, the huge grant in order to get our students involved to understand what the processes of the NASA and to get them to educate them about security aspects and networking aspects and, e-e-et cetera.
00:43:04.619 --> 00:43:09.259
Um, uh, you know, so, so all of those areas are what our students are working.
00:43:09.398 --> 00:43:18.557
You know, I worked with the CDC, uh, in a project in Washington, DC just about a year before the breakout of the COVID, the SARS virus, right?
00:43:19.418 --> 00:43:29.588
I was actually facilitating that, helping them to manage the network and to help them to understand some of the terminology related to the computing, and they were talking about Ebola.
00:43:29.929 --> 00:43:30.447
Ebola.
00:43:31.384 --> 00:43:31.523
Yeah,
00:43:31.588 --> 00:43:32.228
that point,
00:43:32.483 --> 00:43:33.503
in the news again
00:43:34.027 --> 00:43:35.128
they were talking about Ebola.
00:43:35.168 --> 00:43:38.588
They had some of the SARS COVID terminology, but it wasn't such a threat.
00:43:38.608 --> 00:43:42.686
But I'm in that room, Vernon, and I'm like,"Okay, why am I here?
00:43:43.166 --> 00:43:44.527
I'm a cyber person.
00:43:45.347 --> 00:43:49.067
Um, why am I in this room?" But they couldn't do that.
00:43:49.427 --> 00:43:50.807
That was a role that I served.
00:43:51.246 --> 00:44:01.927
So that student could be in just about any possible thing that you could think of, any place that you could think of, facilitating, protecting the network, making sure that the data is safe.
00:44:02.007 --> 00:44:11.492
And, and as this AI world comes about now, they'll be able to advise the industry about the dangers, the risks associated with that, with what they're, using.
00:44:11.514 --> 00:44:16.483
Because we can't get away from using, without using the network, without using a computer.
00:44:16.523 --> 00:44:17.842
At least not yet, anyway.
00:44:17.922 --> 00:44:19.282
We haven't figured that one out as yet.
00:44:19.824 --> 00:44:23.094
Thanks for listening to part two of our discussion with Dr.
00:44:23.094 --> 00:44:25.574
Ken Williams on the Engaged by Design podcast.
00:44:26.144 --> 00:44:33.594
We hope that you're finding his stories and his experience really helpful as you think about how you lead technology with your organization.
00:44:34.255 --> 00:44:44.195
Next time, in part three, Ken shares what happened when he was asked to build an entirely new cybersecurity program from scratch, from nothing.
00:44:44.474 --> 00:44:54.005
He had to recruit faculty, design curriculum, overcome numerous obstacles, And he had to create opportunities for students across the state of Louisiana.
00:44:54.474 --> 00:44:56.445
So we'll see you in part three.
00:44:57.034 --> 00:45:09.034
In the meantime, please remember to like, subscribe and share this podcast with a friend, so that we can bring more people into this conversation as we all try to engage by design
