Speaker 1 (00:03):
Welcome to HSDF THE PODCAST, a collection of policy discussions on government technology and homeland security brought to you by the Homeland Security and Defense Forum. Today's program is the first in a three-part discussion with government and industry leaders on improving cyber situational awareness and threats posed by China and Russia. It features Riley Montgomery from the FBI Cyber Division, Jason Kane, Office of Investigations at the US Secret Service, Patrick Flynn, Advanced Programs Group at Trellix Cybersecurity, and David Aguilar, former acting and deputy commissioner at Customs and Border Protection. This program was recorded in conjunction with the HSDF Policy Symposium, the Evolution of Federal Cybersecurity on June 21st, 2023.
David Aguilar (00:52):
I really appreciate it, and that was a great way to end that last panel by thanking the patriots. Today, we have two great patriots still in service. One ex-patriot here, not ex-patriot, ex-in-service patriot, I should say. I couldn't help myself there, man.
Patrick Flynn (01:07):
Oh, yeah. Yeah. I used to work for them a lot, yeah. Yeah.
David Aguilar (01:13):
But it's a great opportunity for the crowd here to hear from these gentlemen here that are heavily involved in protecting our nation. Protecting our nation, there's a physical aspect of it and now there is the cyber aspect of it. Having said that, let me just begin by saying the following. How many of you remember the day, big news that President Clinton said, "There is going to be a computer in every one of our schools and every one of our libraries?" You and I were absolutely mature enough to remember that. Some of you may have been in school without a computer. That was 1996. It's not that long ago.
(01:49):
Very quickly thereafter, it was also, "Internet will be connected in every school, in every library, in every house, and eventually in the hands of every American." We're there. What has happened? It has increased capabilities, it has increased capacity, it has increased efficiency for our nation and nations globally throughout the world. The bad part is it's also done the same thing for the bad guys, capacity, capability, and risk to the way that we live. So, today it's about cyber, it is about what we can do. It is about awareness going forth. What I'm going to ask each one of these individuals is one by one to basically spend about two to three minutes on what it is that they are focused on from an organizational perspective. And then we'll go into a couple of Q&As from myself and then open it up to the audience also. So, with that, please, Jason, would you please take the first...
Jason Kane (02:46):
I'm in charge of basically the Office of Investigations global cyber outreach kind of programs. So, I basically resource, budget and plan for strategically what are the threats, what should we be doing about them? And then how do I better resource my agents scattered around the globe with the resources they need to go after the threats that people, Mr. Pat will discuss, that Riley will discuss, how do we basically go after those bad actors and then attribute to them, and then I say put handcuffs on [inaudible 00:03:19], it's not always possible, but at the end of the day, keep America safer as regards to our infrastructure. So, that's the big parts, but I'll [inaudible 00:03:27] as we kind of hit the questions.
David Aguilar (03:30):
Riley?
Riley Montgomery (03:31):
Hi, my name's Riley Montgomery. I'm a unit chief at the FBI in our Cyber Division. You basically covered everything that I do. So, I just work for the FBI. My job as a unit chief, I'm over the Asia Cyber Operations unit. I coordinate the efforts across the FBI as it relates to nation-state threats that are emanating from Asia. Prior to that, I spent 18 months in the major cybercrimes unit where my job was to coordinate our efforts on ransomware. So, for the last two years, I've been pretty focused on from a strategic perspective, what the FBI is doing on basically the two biggest threats that are facing our country from a cyber perspective.
David Aguilar (04:10):
Thank you. Pat.
Patrick Flynn (04:12):
Hello, everybody. I'm Pat Flynn. I'm the head of commercial threat intelligence for Trellix, an organization that sits within the Advanced Research Center of Trellix. I'm a part of the Threat Intelligence Group and we provide threat intelligence for our customers. My background, I come from the US Navy. I served 23 years between active duty and reserve. I worked as a border patrol agent for Chief Aguilar out of Nogales Station, Tucson Sector. I worked for him again as a staff officer at headquarters when he was selected as chief. And then I worked for him again when he was the acting commissioner and I was-
David Aguilar (04:52):
I'm not a very smart guy-
Patrick Flynn (04:54):
So, I was a GS-15 running within the Joint Wireless Program Office in Charlie Armstrong's former organization. But the last 10 years, I've been running this organization from an intelligence perspective and it's an interesting view on the major cyber threats in the world. And we'll get into that a little bit as we get into the Q&A, but thank you for letting me participate.
David Aguilar (05:22):
There you go. So, let me... I think you're going to present a couple of slides here to begin very quickly. But let me define cyberspace from an elementary knuckle-dragging perspective as I see it. And I actually wrote this down because I did a lot of reading on this. Basically, what is cybersecurity? Security of cyberspace. What is cyberspace? Devices, infrastructure, data, and the users? That is what cybersecurity is. That's what it encompasses. The question I've got from the very top perspective here is how do we build a stronger cybersecurity awareness, a culture of cybersecurity awareness? As an ex-law enforcement officer, situational awareness is absolutely critical in everything that we do in the field. Well, I would put forth, that's the same thing here. So, with that, we agreed that Pat's going to present a couple of slides here to kind of set the situational tone of what we're seeing now as a country, and then get into some questions. Pat.
Patrick Flynn (06:25):
All right. It's an immense, immense problem. Then the second number next to it is once we correlate that against known malicious campaigns across the world, just focus on the US. Go to that next slide, please. This is the verticals within the US that bad actors are primarily focused on according to us and our analysis. What it's ironic, and what I found very surprising was the educational sector was a preeminent focus within the US primarily along with the government and so on and so forth. And then the next one, that's once we get done with our attribution activity, you can see, just like Director Easterly said earlier today, enemy number one is China. If you recognize those numbers, and I won't go in, the top four actors are basically either a criminal or nation-state actor coming out of China. Let's switch gears to another country. That's the malicious telemetry detection timeline across 30 days. That's how hyperactive it is focused on the US. Next slide, Ukraine.
(07:29):
Kinetically, and these numbers were fresh yesterday morning. The numbers are probably going to be a little bit more updated today. 2,916,000 malicious detections against vertical infrastructure within the country of Ukraine against 8,916 malicious campaigns. Now, you take that back to September, there was only 1.8 million malicious detections against 1,816 known malicious campaigns in Ukraine. But since September 14th, the beginning of the counteroffensive in Ukraine, it spiked exponentially and that's where we're at today. Next slide. That's what they're focused on from a vertical perspective. Next slide. That's the attribution, again, the Chinese, Chinese, some Mustang Panda, you'll see some more Russian activity, but back in September is Gamaredon. It's Sandworm, heavy Russian focus, but China is in everybody's chonies, so to speak over the world. And then the last slide. That's the activity level in Ukraine. It's very, very dynamic and it's looked like that ever since September, but that's sets the stage of what we're going to talk about today.
David Aguilar (08:46):
Yeah. So, I guess that backdrop, let me begin with Riley here. Riley, I guess that backdrop we've talked about, and we heard a lot of prior speakers also about building a culture of cybersecurity awareness. Where do you see the biggest challenges? And just as important, probably more importantly, where would you focus that awareness-building for cyberspace security?
Riley Montgomery (09:08):
Sure. So, our number one goal as the FBI is to obviously investigate cybercrime, put bad guys in jail so they can't continue conducting the activity. But as was mentioned before, a lot of these actors are located in places that we can't physically get our hands on them. Places like China, Russia that we can't actually go into, but the activity is condoned or there's a blind eye turned to the activity being conducted against us. And so, it's shifted our perspective from putting bad guys in jail to making it harder for them to operate. So, one of our big goals is putting out information that helps network defenders around the US with indicators of compromise related to specific cybercriminal groups that can help them defend networks and prevent the bad guys from getting in. I would say the biggest challenge with that is that we're only as good as the data that we have from victims.
(09:59):
The only way that we can advance our investigations is from reporting that comes directly from victims of cybercrime. I think the last number I heard was somewhere between 20% and 30%. That's the number of cybercrimes that we're aware of that are reported to us. So, there's 70% to 80% of crime that we're not aware of. So, our ability to get all that data is very limited and it's incredibly difficult to move things along to make the public aware, create that situational awareness with only 20% of the picture. So, when we talk about things like CIRCIA legislation where reporting is becoming mandated, ultimately that's a good thing because that'll give us more information to move our cases along and help inform the public as to what they should be looking out for.
Speaker 1 (10:46):
Thank you for tuning in. You can follow HSDF THE PODCAST on every major podcast platform. Visit hsdf.org to learn more about the Homeland Security and Defense Forum and HSDF THE PODCAST.
Welcome to HSDF THE PODCAST, a collection of policy discussions on government technology and homeland security brought to you by the Homeland Security and Defense Forum. Today's program is the first in a three-part discussion with government and industry leaders on improving cyber situational awareness and threats posed by China and Russia. It features Riley Montgomery from the FBI Cyber Division, Jason Kane, Office of Investigations at the US Secret Service, Patrick Flynn, Advanced Programs Group at Trellix Cybersecurity, and David Aguilar, former acting and deputy commissioner at Customs and Border Protection. This program was recorded in conjunction with the HSDF Policy Symposium, the Evolution of Federal Cybersecurity on June 21st, 2023.
David Aguilar (00:52):
I really appreciate it, and that was a great way to end that last panel by thanking the patriots. Today, we have two great patriots still in service. One ex-patriot here, not ex-patriot, ex-in-service patriot, I should say. I couldn't help myself there, man.
Patrick Flynn (01:07):
Oh, yeah. Yeah. I used to work for them a lot, yeah. Yeah.
David Aguilar (01:13):
But it's a great opportunity for the crowd here to hear from these gentlemen here that are heavily involved in protecting our nation. Protecting our nation, there's a physical aspect of it and now there is the cyber aspect of it. Having said that, let me just begin by saying the following. How many of you remember the day, big news that President Clinton said, "There is going to be a computer in every one of our schools and every one of our libraries?" You and I were absolutely mature enough to remember that. Some of you may have been in school without a computer. That was 1996. It's not that long ago.
(01:49):
Very quickly thereafter, it was also, "Internet will be connected in every school, in every library, in every house, and eventually in the hands of every American." We're there. What has happened? It has increased capabilities, it has increased capacity, it has increased efficiency for our nation and nations globally throughout the world. The bad part is it's also done the same thing for the bad guys, capacity, capability, and risk to the way that we live. So, today it's about cyber, it is about what we can do. It is about awareness going forth. What I'm going to ask each one of these individuals is one by one to basically spend about two to three minutes on what it is that they are focused on from an organizational perspective. And then we'll go into a couple of Q&As from myself and then open it up to the audience also. So, with that, please, Jason, would you please take the first...
Jason Kane (02:46):
I'm in charge of basically the Office of Investigations global cyber outreach kind of programs. So, I basically resource, budget and plan for strategically what are the threats, what should we be doing about them? And then how do I better resource my agents scattered around the globe with the resources they need to go after the threats that people, Mr. Pat will discuss, that Riley will discuss, how do we basically go after those bad actors and then attribute to them, and then I say put handcuffs on [inaudible 00:03:19], it's not always possible, but at the end of the day, keep America safer as regards to our infrastructure. So, that's the big parts, but I'll [inaudible 00:03:27] as we kind of hit the questions.
David Aguilar (03:30):
Riley?
Riley Montgomery (03:31):
Hi, my name's Riley Montgomery. I'm a unit chief at the FBI in our Cyber Division. You basically covered everything that I do. So, I just work for the FBI. My job as a unit chief, I'm over the Asia Cyber Operations unit. I coordinate the efforts across the FBI as it relates to nation-state threats that are emanating from Asia. Prior to that, I spent 18 months in the major cybercrimes unit where my job was to coordinate our efforts on ransomware. So, for the last two years, I've been pretty focused on from a strategic perspective, what the FBI is doing on basically the two biggest threats that are facing our country from a cyber perspective.
David Aguilar (04:10):
Thank you. Pat.
Patrick Flynn (04:12):
Hello, everybody. I'm Pat Flynn. I'm the head of commercial threat intelligence for Trellix, an organization that sits within the Advanced Research Center of Trellix. I'm a part of the Threat Intelligence Group and we provide threat intelligence for our customers. My background, I come from the US Navy. I served 23 years between active duty and reserve. I worked as a border patrol agent for Chief Aguilar out of Nogales Station, Tucson Sector. I worked for him again as a staff officer at headquarters when he was selected as chief. And then I worked for him again when he was the acting commissioner and I was-
David Aguilar (04:52):
I'm not a very smart guy-
Patrick Flynn (04:54):
So, I was a GS-15 running within the Joint Wireless Program Office in Charlie Armstrong's former organization. But the last 10 years, I've been running this organization from an intelligence perspective and it's an interesting view on the major cyber threats in the world. And we'll get into that a little bit as we get into the Q&A, but thank you for letting me participate.
David Aguilar (05:22):
There you go. So, let me... I think you're going to present a couple of slides here to begin very quickly. But let me define cyberspace from an elementary knuckle-dragging perspective as I see it. And I actually wrote this down because I did a lot of reading on this. Basically, what is cybersecurity? Security of cyberspace. What is cyberspace? Devices, infrastructure, data, and the users? That is what cybersecurity is. That's what it encompasses. The question I've got from the very top perspective here is how do we build a stronger cybersecurity awareness, a culture of cybersecurity awareness? As an ex-law enforcement officer, situational awareness is absolutely critical in everything that we do in the field. Well, I would put forth, that's the same thing here. So, with that, we agreed that Pat's going to present a couple of slides here to kind of set the situational tone of what we're seeing now as a country, and then get into some questions. Pat.
Patrick Flynn (06:25):
All right. It's an immense, immense problem. Then the second number next to it is once we correlate that against known malicious campaigns across the world, just focus on the US. Go to that next slide, please. This is the verticals within the US that bad actors are primarily focused on according to us and our analysis. What it's ironic, and what I found very surprising was the educational sector was a preeminent focus within the US primarily along with the government and so on and so forth. And then the next one, that's once we get done with our attribution activity, you can see, just like Director Easterly said earlier today, enemy number one is China. If you recognize those numbers, and I won't go in, the top four actors are basically either a criminal or nation-state actor coming out of China. Let's switch gears to another country. That's the malicious telemetry detection timeline across 30 days. That's how hyperactive it is focused on the US. Next slide, Ukraine.
(07:29):
Kinetically, and these numbers were fresh yesterday morning. The numbers are probably going to be a little bit more updated today. 2,916,000 malicious detections against vertical infrastructure within the country of Ukraine against 8,916 malicious campaigns. Now, you take that back to September, there was only 1.8 million malicious detections against 1,816 known malicious campaigns in Ukraine. But since September 14th, the beginning of the counteroffensive in Ukraine, it spiked exponentially and that's where we're at today. Next slide. That's what they're focused on from a vertical perspective. Next slide. That's the attribution, again, the Chinese, Chinese, some Mustang Panda, you'll see some more Russian activity, but back in September is Gamaredon. It's Sandworm, heavy Russian focus, but China is in everybody's chonies, so to speak over the world. And then the last slide. That's the activity level in Ukraine. It's very, very dynamic and it's looked like that ever since September, but that's sets the stage of what we're going to talk about today.
David Aguilar (08:46):
Yeah. So, I guess that backdrop, let me begin with Riley here. Riley, I guess that backdrop we've talked about, and we heard a lot of prior speakers also about building a culture of cybersecurity awareness. Where do you see the biggest challenges? And just as important, probably more importantly, where would you focus that awareness-building for cyberspace security?
Riley Montgomery (09:08):
Sure. So, our number one goal as the FBI is to obviously investigate cybercrime, put bad guys in jail so they can't continue conducting the activity. But as was mentioned before, a lot of these actors are located in places that we can't physically get our hands on them. Places like China, Russia that we can't actually go into, but the activity is condoned or there's a blind eye turned to the activity being conducted against us. And so, it's shifted our perspective from putting bad guys in jail to making it harder for them to operate. So, one of our big goals is putting out information that helps network defenders around the US with indicators of compromise related to specific cybercriminal groups that can help them defend networks and prevent the bad guys from getting in. I would say the biggest challenge with that is that we're only as good as the data that we have from victims.
(09:59):
The only way that we can advance our investigations is from reporting that comes directly from victims of cybercrime. I think the last number I heard was somewhere between 20% and 30%. That's the number of cybercrimes that we're aware of that are reported to us. So, there's 70% to 80% of crime that we're not aware of. So, our ability to get all that data is very limited and it's incredibly difficult to move things along to make the public aware, create that situational awareness with only 20% of the picture. So, when we talk about things like CIRCIA legislation where reporting is becoming mandated, ultimately that's a good thing because that'll give us more information to move our cases along and help inform the public as to what they should be looking out for.
Speaker 1 (10:46):
Thank you for tuning in. You can follow HSDF THE PODCAST on every major podcast platform. Visit hsdf.org to learn more about the Homeland Security and Defense Forum and HSDF THE PODCAST.
