WEBVTT
00:00:03.279 -->
00:00:04.080A couple things.
00:00:04.240 -->
00:00:06.400One, I wanted to say thanks for hanging in there.
00:00:06.480 -->
00:00:08.800It's been an action-packed day, that's for sure.
00:00:09.279 -->
00:00:18.079Two, I will make sure that we budget a little bit of time at the end because we want to make sure that you all have an opportunity to ask some questions.
00:00:18.719 -->
00:00:23.440And then we'll wrap it up with some final thoughts from the panel members.
00:00:24.399 -->
00:00:26.399Dustin, I'm going to start with you.
00:00:27.519 -->
00:00:29.440And this is an age-old issue.
00:00:29.519 -->
00:00:34.240It's a challenge that I know you've been facing and trying to get your arms around it, both you and Rob.
00:00:34.719 -->
00:00:37.920And that's this age-old issue about technical debt, right?
00:00:38.000 -->
00:00:43.520You've every CIO incorporates and adopts some technical debt that you're trying to work through.
00:00:43.600 -->
00:00:58.320And there's this delicate balance of trying to move forward and deliver capability and then have to make sure you're managing your current environment, your legacy environment, let's call it, and making sure all that stays secure, right?
00:00:58.399 -->
00:00:59.920From the top to the bottom.
00:01:00.159 -->
00:01:03.439Can you walk us through the thought process and how that's going?
00:01:04.159 -->
00:01:05.439It's not fast enough.
00:01:08.159 -->
00:01:09.760By the way, good afternoon, everyone.
00:01:10.000 -->
00:01:13.599I usually will say something along those lines early on, and I apologize.
00:01:13.840 -->
00:01:29.200Yes, like legacy applications, modern applications, from OCIO's perspective, we're trying to treat them all the same and give them the care, love, and feeding that they need to ensure that our officers and agents have a secure and reliable platform, regardless of the device or where they're at.
00:01:29.439 -->
00:01:41.599There are inherent risks with a lot of the legacy applications that we're trying to address, but step one in doing that is really understanding and identifying what technologies and applications we have out in our ecosystems.
00:01:41.840 -->
00:01:47.359So recently we came out with Shadow IT memo, where we're trying to catalog, identify and catalog all of our IT.
00:01:47.519 -->
00:01:54.000And then from there, we'll work in with the program offices to understand what's the what's the future for the application?
00:01:54.239 -->
00:02:00.959Will it be sunseted with new capabilities that we have coming online through our other platforms, or do we really have to sustain this?
00:02:01.040 -->
00:02:08.319And if in which case we'll work with them to really modernize the application to ensure that it meets cybersecurity compliance.
00:02:08.960 -->
00:02:14.879We are trying to limit the number of custom applications that we have coming into our infrastructure.
00:02:15.039 -->
00:02:20.000So where possible, we're going to try to point them to existing platforms and infrastructures.
00:02:20.159 -->
00:02:22.960But our requirements all start with programs.
00:02:23.360 -->
00:02:29.919And if you're out there talking to the programs, which I encourage you to do, but do it with partnership of OCIO.
00:02:30.240 -->
00:02:32.639Understand that we're trying to consolidate our applications.
00:02:32.800 -->
00:02:37.520We're in platforms, we're trying to continue to deliver reliable applications.
00:02:37.680 -->
00:02:40.319And there's or trying to standardize across the board.
00:02:40.400 -->
00:02:42.879So just work with us as you bring ideas to bear.
00:02:43.120 -->
00:02:46.000We're open to hearing them and we want to hear them.
00:02:46.080 -->
00:02:50.479But sometimes we have limiting factors that we're thinking about not only today, but in the future.
00:02:51.360 -->
00:02:53.439Thank you very much for the way in here, please.
00:02:53.520 -->
00:02:54.479We know he's going to have to do that.
00:02:54.639 -->
00:02:55.360Well, you know, I always do.
00:02:55.439 -->
00:02:57.360When my boss is here, I've got to jump in as well.
00:02:57.439 -->
00:03:05.599And from a security perspective, one of the things when we look at our legacy applications, sometimes we say, hey, we got to fix them, but we don't always have to fix them.
00:03:05.680 -->
00:03:07.759So what a lot of these have vulnerabilities to them.
00:03:07.840 -->
00:03:15.759So one of the things that we weigh often is, hey, what's the cost to get these legacy apps fix fixed versus what are some of the compensated controls that we can put in place?
00:03:15.840 -->
00:03:24.800So sometimes if it's working and it's getting the job done, you just leave it as is and you invest in other areas until you can swing back around and maybe solve some of those vulnerabilities in the end.
00:03:24.960 -->
00:03:26.240Yeah, invest your way out of that.
00:03:26.319 -->
00:03:27.280So I appreciate that.
00:03:27.360 -->
00:03:29.759And a good old wrapper seems to work sometimes, right?
00:03:30.000 -->
00:03:30.319Yeah.
00:03:30.560 -->
00:03:31.599I appreciate that.
00:03:31.919 -->
00:03:34.719Thomas, I appreciate you coming out here.
00:03:34.800 -->
00:03:38.879And we know that the uh the deputy scissors are the ones doing the heavy lifting.
00:03:39.039 -->
00:03:43.039And I think about CBP, it's this freaking aircraft carrier out there.
00:03:43.360 -->
00:03:46.800A lot of moving parts around a lot of IoT, et cetera.
00:03:46.960 -->
00:03:51.280And you've got this sort of position of originally of this passive, right?
00:03:51.360 -->
00:03:55.120We're gonna we're gonna try to keep this environment stabilized.
00:03:55.199 -->
00:04:00.719And now you're really into more sophisticated instrumentation, really active metering.
00:04:01.120 -->
00:04:14.319And just how does one go from that sort of stable environment to really getting aggressive and getting in front of these adversaries and putting yourself in a position where you can do that properly and keep the mission running?
00:04:15.120 -->
00:04:16.879Thank you for the question and thank you all for being here.
00:04:16.959 -->
00:04:21.279So I think the biggest thing is changing the mindset from that reactive approach.
00:04:21.519 -->
00:04:30.800We're gonna have our security operations, we're gonna set triggers, we're gonna set tripwires, we're gonna set alerting, and we're just gonna wait for something to happen into a more proactive mindset.
00:04:31.199 -->
00:04:46.480So it's working with our forward-thinking cyber threat intelligence teams, finding what the adversaries are doing, and then positioning ourselves as an organization in order to be prepared when they use those tactics, techniques, and procedures to attack against us.
00:04:46.800 -->
00:04:54.480One of the things we did early on with our cyber threat intelligence program was identify goals and priorities that were very specific to the organization.
00:04:54.639 -->
00:05:02.879So we're looking at actors that are interested in our actual mission and we're looking at how they can actually impact our mission.
00:05:02.959 -->
00:05:13.120And then we're communicating that from the cyber threat intelligence team, from our SOC, through our SOC, up to leadership to make sure that they are aware of these actors and the capabilities.
00:05:13.279 -->
00:05:19.519But then as we're doing that, we're taking a proactive approach to go out and look for these actors within our environment.
00:05:19.759 -->
00:05:27.040Because the way that we've seen things happen over the past couple of years, it's not if you're breached, it's when you're breached and how can you find them.
00:05:27.360 -->
00:05:32.079We have a cyber threat hunt team that actively goes out and searches for campaigns.
00:05:32.240 -->
00:05:35.839We find the different techniques that these specific actors are doing.
00:05:36.000 -->
00:05:40.399We find the different indicators of compromise, and then we span across the network.
00:05:40.560 -->
00:05:48.000We look at the different high-value assets that we have to identify if we see any of those techniques being executed within those areas.
00:05:48.240 -->
00:05:50.000And then we validate.
00:05:50.240 -->
00:05:55.199The thing that comes from threat hunting that is kind of challenging is it's a negative.
00:05:55.279 -->
00:05:56.560You can't really prove a negative.
00:05:56.639 -->
00:05:59.040Oh, we didn't see anybody in the environment.
00:05:59.279 -->
00:06:02.079We're taking this proactive approach, but we didn't find anything.
00:06:02.160 -->
00:06:03.120So, what do you do?
00:06:03.360 -->
00:06:07.680What we've done to caveat that is we find configuration flaws.
00:06:07.759 -->
00:06:13.279We find things that are going on in the actual environment that adversaries would be able to take advantage of.
00:06:13.439 -->
00:06:14.639And then we report on those.
00:06:14.800 -->
00:06:29.920We work with the system teams, we work with the different individuals within the organization to make sure that they can fix the actual vulnerabilities within the systems prior to an adversary being able to attack them and being able to exploit them.
00:06:30.079 -->
00:06:41.199So it's really shifting that culture from, hey, we're going to sit back and wait to we're going to actively go out, find the adversary, we're going to actively go out, find what they're doing, and then we're going to take action against that.
00:06:41.279 -->
00:06:48.959And then enabling the organization to follow along with us as we do that to take preventative actions prior to being exploited.
00:06:49.279 -->
00:06:53.199And no doubt with some sophisticated instrumentation that you're doing there.
00:06:53.279 -->
00:06:57.519So we really appreciate you laying the framework out as to describing that.
00:06:57.680 -->
00:07:03.279I don't want to say offensive posture because that doesn't sound right, but being in a situation where you're getting out in front of it.
00:07:03.600 -->
00:07:11.279Chris, and this is not to meant to be pull a pin out and roll a grenade across, but I think these type of questions are important here.
00:07:11.519 -->
00:07:17.360And this is about the biggest thing the federal government fundamentally misunderstands, right?
00:07:17.600 -->
00:07:29.120Misunderstands in your eyes, and you can speak on behalf of the industry about commercial providers and how they manage cyber risk and the new national strategy.
00:07:29.360 -->
00:07:30.639What's your perspective of that?
00:07:30.959 -->
00:07:36.160Getting to speak for the entire industry, apparently, and representing the entire federal government's position.
00:07:36.319 -->
00:07:37.839I guess I'll be a little broad with this answer.
00:07:38.079 -->
00:07:39.839I feel first of all, thanks for having me here as well.
00:07:40.000 -->
00:07:41.279A little bit of fish out of water.
00:07:41.360 -->
00:07:43.759I'm a Department of Defense, Department of War guy.
00:07:43.920 -->
00:07:46.160So the DHS stuff is not my forte.
00:07:46.480 -->
00:07:49.360But you did use the word aircraft carrier at one point, naval officer.
00:07:49.439 -->
00:07:50.879So I'll use some of these moving forwards.
00:07:51.040 -->
00:07:58.639Having been just in the Department of War as the CISO for the Department of the Navy and then the principal cyber advisor, looking at these levels, things were a much higher level.
00:07:58.800 -->
00:08:08.160And one of the things I've always felt bad for all the CIOs and all the CISOs is at the end of the day, it's an enablement function to whatever your core business is, right?
00:08:08.240 -->
00:08:12.959At the end of the day, it's not the core function of any of our organizations to provide an information system.
00:08:13.040 -->
00:08:14.480It's something that we all depend on.
00:08:14.639 -->
00:08:22.000So in the Navy, all our big dollars go to aircraft carriers and munition consumptions and the Columbia class submarine or the things the Marine Corps are trying to do.
00:08:22.399 -->
00:08:26.720Cybersecurity, all of those things are things that sort of get what's left over, right?
00:08:26.800 -->
00:08:30.319And a lot of times those become billpayers for things that we've got to go do in the Navy.
00:08:30.399 -->
00:08:34.159And I'm sure that exists, that same problem exists in each of your organizations.
00:08:34.399 -->
00:08:36.480So what is industry's perspective on this?
00:08:36.559 -->
00:08:39.279Now, I say this next piece to be somewhat controversial.
00:08:39.440 -->
00:08:41.279The reporters in the room, don't get me in trouble.
00:08:41.440 -->
00:08:45.120When I would talk about the Department of War, I'd say, what's our core mission?
00:08:45.360 -->
00:08:48.080And fundamentally, the Department of War exists for two reasons.
00:08:48.159 -->
00:08:50.960It's to deliver lethality or prevent lethality being delivered on us.
00:08:51.039 -->
00:08:53.039That's fundamentally is what the Department of War does.
00:08:53.200 -->
00:08:55.120So what's industry's core mission?
00:08:55.279 -->
00:08:59.679And I would say industry's core mission is to find people with money and make that money your money, right?
00:08:59.840 -->
00:09:02.559And I would imagine most people in this room represent industry.
00:09:02.720 -->
00:09:06.879And I would say the most of the people, and some of you have come from governments, right?
00:09:06.960 -->
00:09:08.000And now have done the job.
00:09:08.080 -->
00:09:11.679And now you're on the industry side, which we will all end there one day.
00:09:11.759 -->
00:09:13.840Eventually you'll transition from that side to this side.
00:09:14.000 -->
00:09:22.159And the question is so it's this interesting perpetual cycle that we play of trying to come up with a product or a service that is something that you can get the attention of.
00:09:22.399 -->
00:09:30.240But what I think the government has realized is in very few instances, everything the government uses comes from industry.
00:09:31.279 -->
00:09:32.879Again, I'll use the Navy as an example.
00:09:33.039 -->
00:09:34.879The Navy does not make anything.
00:09:35.120 -->
00:09:40.000They buy everything shoelaces, munitions, ships, fuel, all of that comes from industry.
00:09:40.159 -->
00:09:44.399And a lot of the workforce that enables that, particularly in the DC, comes from the contractor side.
00:09:44.639 -->
00:09:51.279So when you say is what is industry's biggest thing that government doesn't understand, is industry's in this to ultimately make money.
00:09:51.600 -->
00:09:54.960It sounds cold, but you could say it's a cold mission of why does ICE exist?
00:09:55.120 -->
00:09:56.399Why does customer board protection exist?
00:09:56.559 -->
00:09:57.600Why does the Navy exist?
00:09:57.759 -->
00:09:59.519And those are the games that we play.
00:09:59.679 -->
00:10:07.840But acknowledging that, I think, is important because when it comes to some of the capabilities that the government's looking for, we're going to get into answer the question you want to answer, right?
00:10:07.919 -->
00:10:08.559Is the thing.
00:10:08.879 -->
00:10:16.480As more requirements come into industry to build things that are more secure, particularly the last panel talking about mythos, there's a cost associated with that.
00:10:16.639 -->
00:10:18.000And I would always make the example.
00:10:18.159 -->
00:10:22.879The reason an Arleigh Burke destroyer costs$3 billion is not to make it float, right?
00:10:22.960 -->
00:10:26.480That it's to keep it floating when somebody's trying to put a weapon in it.
00:10:26.799 -->
00:10:28.480That's why it costs$3 billion.
00:10:28.799 -->
00:10:32.559Because I can go buy a merchant ship and put a whistle launcher on it at a much reduced cost.
00:10:32.879 -->
00:10:42.480But to make something that, and really the conversation we get in all of these systems is when you want to move something from being secure to resilient, and the new word is survivable.
00:10:43.120 -->
00:10:54.960If I have a dedicated, sophisticated, well-resourced adversary trying to apply their table against my problem set, how do I go to build something that is now survivable?
00:10:55.200 -->
00:10:58.240And then have government recognize the cost associated with that.
00:10:58.320 -->
00:11:01.360Because the government doesn't balk because a destroyer costs three and a half.
00:11:01.440 -->
00:11:03.360Actually, it's like it's three and a half billion dollars now.
00:11:03.519 -->
00:11:04.799That's why it costs that.
00:11:05.039 -->
00:11:08.799And I think you could take that and apply it against a lot of different mission sets in the government.
00:11:08.960 -->
00:11:13.360And it's that acknowledgement back and forth, I think, is where the conversation gets a little more interesting.
00:11:14.080 -->
00:11:17.120Appreciate that perspective, Rob, I'm gonna toss it over to you.
00:11:17.440 -->
00:11:26.639Think about the level of activity in regards to data being collected at these various remote locations, right?
00:11:26.879 -->
00:11:29.840Very sensitive data, biometrics data, et cetera.
00:11:30.159 -->
00:11:32.240Very sophisticated equipment.
00:11:32.879 -->
00:11:46.159And I'm curious to know as you're securing that environment to make sure that it's protected, what's the balance about I'll say oversecuring it to the point where the officer can't do their damn job, right?
00:11:46.320 -->
00:11:56.240So tell me about how that works and how that is working and what you might be thinking about to make that even better, particularly as you start talking about this mobile environment, et cetera, et cetera.
00:11:56.480 -->
00:11:56.639Yeah.
00:11:56.720 -->
00:11:56.879Yeah.
00:11:56.960 -->
00:11:58.799No, that's just that's a great question.
00:11:58.879 -->
00:12:01.039And something that we're challenged with every day.
00:12:01.279 -->
00:12:04.159I used to say, how do I protect my network?
00:12:04.320 -->
00:12:08.480But actually now I'm saying how do I continuously assess device trust?
00:12:08.720 -->
00:12:12.559How do I trust an identity or validate an identity?
00:12:12.639 -->
00:12:15.039And then how do I protect data that's everywhere?
00:12:15.279 -->
00:12:21.519And so what we've done is, like most people with our zero trust journey, of course, most are aware, we've moved away from that primary security model.
00:12:21.679 -->
00:12:29.919But really, what we're focused on now is more of that data and identity security model and focused on on both the data and identity.
00:12:30.159 -->
00:12:33.600So what we've done is we started to push down a couple of things we've done.
00:12:33.759 -->
00:12:37.120So we started to push down security to the data level.
00:12:37.279 -->
00:12:43.519So what we're looking at here is data classification labels, DLP, attribute-based security control.
00:12:44.000 -->
00:12:44.960On the mobile devices.
00:12:45.279 -->
00:12:48.080Not there yet on the mobile device, but yeah, on the on the mobile devices.
00:12:48.480 -->
00:12:49.679Maybe there's an opportunity out there.
00:12:50.000 -->
00:12:50.320We have there.
00:12:50.879 -->
00:12:51.039Okay.
00:12:51.440 -->
00:12:52.080Sorry about that.
00:12:52.240 -->
00:12:52.480Go ahead.
00:12:52.799 -->
00:12:58.399So on the endpoint devices, on our mobile devices, we do have MDM device management.
00:12:58.480 -->
00:13:00.399We have our EDR capabilities.
00:13:00.639 -->
00:13:06.320Something that we're really pushing now is to continuously assess our device posture.
00:13:06.559 -->
00:13:13.440So looking at patch levels and seeing, hey, should we allow this device on the network or should they have these capabilities?
00:13:13.679 -->
00:13:20.879And then the other thing that we're doing, I know that AI has been a big topic here, specifically Methos and some of the concerns there.
00:13:21.440 -->
00:13:29.679We're pushing patches, more automating patching at this point, not testing as much, or at least we're headed in that direction to say how can we get out patching quicker.
00:13:29.919 -->
00:13:38.399And then finally, when we look across the board, we see moving forward, identity is really going to be our core, the cornerstone of our security program.
00:13:38.559 -->
00:13:46.960So this is focusing on things like multi-factor authentication, risk-based authentication, policies specific to devices that we need to set.
00:13:47.120 -->
00:14:05.200Really, what we're trying to do, Luke, is we're trying to move away from saying, hey, the reliance on the network, the trust on the network, and move away from having to trust that location of the network and pushing it down to the data and it's so the network is uh you're everywhere now, so to speak, from a mobile perspective.
00:14:05.360 -->
00:14:10.720So you really got to get away from that guard gates unlocks type of phenomenon.
00:14:10.879 -->
00:14:12.639So we really appreciate that.
00:14:12.960 -->
00:14:26.080Dustin, we've talked about some levels of sophistication around some of this technology that you're trying to insert and do it very quickly, as you I think started out there trying to get it done as fast as you can.
00:14:26.559 -->
00:14:34.399And I know that you're interested in some of these non-traditional, we'll call them, methods of acquiring goods and services.
00:14:34.639 -->
00:14:39.759And I know there's been a lot of conversation, at least I think there has been, with your your acquisition shop.
00:14:40.000 -->
00:14:48.320You want to talk about that, maybe tease the audience on some of these things that you're thinking about in regards to some of these non-traditional ways of acquiring goods and services.
00:14:48.480 -->
00:14:49.679Don't want to put words in your mouth.
00:14:49.759 -->
00:14:52.480Maybe it's just doing what you do today, but do it a lot faster.
00:14:52.559 -->
00:14:53.279But yeah.
00:14:53.360 -->
00:14:54.000Yeah, absolutely.
00:14:54.320 -->
00:15:03.039So that is one of our big challenges right now is trying to figure work with industry and figure out the complex engine of acquisition for government.
00:15:03.279 -->
00:15:05.440We I'm preaching to the choir.
00:15:05.519 -->
00:15:10.080I used to sit on your side, so I suffered your pain in going through the government acquisition process.
00:15:10.159 -->
00:15:14.720I'm doubling down now because I'm sitting on this side and I want to see things done faster.
00:15:14.879 -->
00:15:19.200The 18 months, 24 months acquisition cycle, it's just entirely too long.
00:15:19.360 -->
00:15:22.320The technology changes before we even get it out into the operations.
00:15:22.720 -->
00:15:44.320What we're trying to do is work with industry to come up with different acquisition models, more IDIQs, smaller task orders that are delivery-based on a specific function or capability set, proof of value, proof of concept are going to be, I think, game changer source as we start to look more towards proving capabilities before we even start that acquisition capability.
00:15:44.399 -->
00:15:51.919That way we know where we're going to get at the end of that, and also just do more of agile type development on services and capabilities.
00:15:52.080 -->
00:16:00.399We're not looking at developing that larger application and keeping everyone on board, staffing up on for 18 months.
00:16:00.559 -->
00:16:01.600It's just that's not there.
00:16:01.759 -->
00:16:11.360We'd rather bring small work groups in, get a completed task, uh, get a task issued, get them on, get it done, and then start managing the application from that point forward.
00:16:11.600 -->
00:16:14.000Of course, all the while talking about DevSecOps.
00:16:14.159 -->
00:16:20.639So hopefully that goes without saying Rob is, I don't want him to kill me later for not mentioning security operations.
00:16:20.799 -->
00:16:24.639But yeah, just to put a cap on that, it takes a lot of partnership.
00:16:24.799 -->
00:16:33.279For those of you that have heard me in panels talk before, the one things I one of the things I always harp on is how much of a reliance I put on the partnership with industry.
00:16:33.360 -->
00:16:35.519And that takes open and honest communication.
00:16:35.679 -->
00:16:41.440We don't want to say no to ideas, so we want to hear them and just talk through some of the concepts of that and ideas that you have.
00:16:41.679 -->
00:16:46.159So please let's just sit down, have a cup of coffee and talk about it, and let's see where it goes from there.
00:16:46.240 -->
00:16:49.840I'm always open for those types of communication, those conversations.
00:16:50.720 -->
00:16:56.559OTAs and SIBRs is that uh kind of conversation going on in the building?
00:16:56.720 -->
00:16:58.159Is there a desire to do that?
00:16:58.240 -->
00:17:00.799An appetite, or is it OTAs not so much right now?
00:17:01.840 -->
00:17:04.079We lost our SIBR authority for a few months.
00:17:04.240 -->
00:17:10.160We've recently got it back, and so we're trying to figure out, we're working with OAQ to see how we can best leverage that.
00:17:10.400 -->
00:17:12.559That's definitely back on the table.
00:17:13.279 -->
00:17:16.319Looking forward to hearing more about that for sure.
00:17:16.640 -->
00:17:20.079Tom, you're a big proponent of software by design.
00:17:20.319 -->
00:17:23.440So was the prior director of SISA, right?
00:17:23.599 -->
00:17:30.160And I always felt when I was in service, we would have some really sophisticated vendors in there doing sophisticated work for us.
00:17:30.240 -->
00:17:31.680Something wouldn't go right.
00:17:32.160 -->
00:17:34.160I just didn't feel real good about answering.
00:17:34.240 -->
00:17:38.240We got them in there, we paid them a lot of money to do this, and that seems like now we're paying them in here to fix it.
00:17:38.559 -->
00:17:39.359What's going on here?
00:17:39.839 -->
00:17:42.319And I know you've done a lot of work with C CARM.
00:17:42.400 -->
00:17:45.920So give us some lessons learned, what you found out about, what's the drive behind that?
00:17:46.079 -->
00:17:47.039What is it?
00:17:47.440 -->
00:17:52.319And how can we keep making that better so that we get way to the left of this issue?
00:17:52.559 -->
00:17:53.359Yeah, absolutely.
00:17:53.519 -->
00:17:55.119So you mentioned the term C CARM.
00:17:55.200 -->
00:17:57.920So what that is, it's cyber acquisition risk management.
00:17:58.160 -->
00:18:09.039What we've done is we've tried to integrate the cybersecurity component that we have with the acquisition side of the house so that we're starting to talk about cyber during the mission needs phase.
00:18:09.200 -->
00:18:14.799When they're starting to define what we need for the mission, we're there with them talking about cybersecurity.
00:18:15.039 -->
00:18:26.319And what we intend to do, and what we have done with that, is start to get the program managers to think about that, starting to get our industry partners to understand, hey, these are the requirements that we have from a cyber perspective.
00:18:26.480 -->
00:18:28.400So they're already baked into the products.
00:18:28.480 -->
00:18:34.240Because what we've seen a lot of is again, we get so far down the road, and then the requirements just aren't there.
00:18:34.319 -->
00:18:36.880And from the cybersecurity side, we're the no guys.
00:18:36.960 -->
00:18:39.599Oh, you can't do that because it doesn't have cyber baked in it.
00:18:39.759 -->
00:18:41.279So just take a step back.
00:18:41.440 -->
00:18:44.160If we're there from the beginning, we define the requirements.
00:18:44.319 -->
00:18:54.000We say, this is what you need to do in order to be successful in this environment, to be able to deploy whatever it is that you're building, to be able to acquire whatever it is you're acquiring.
00:18:54.160 -->
00:18:55.200This is how you do it.
00:18:55.359 -->
00:18:58.160This is what we can do with you in order to get you there.
00:18:58.400 -->
00:18:59.519That's what we've started doing.
00:18:59.599 -->
00:19:02.319And then holding their hands and walking with them through that process.
00:19:02.480 -->
00:19:07.119So understanding not just from the cyber side, but also building out the threats, right?
00:19:07.200 -->
00:19:09.680What are the threats to this specific mission set?
00:19:09.839 -->
00:19:11.680What are the threats that we need to be aware of?
00:19:11.839 -->
00:19:22.240So as they're building this, it's not just being built to be cyber secure, it's being built to be cyber resilient so that we know when we get it there, we've considered what these different actors can do.
00:19:22.319 -->
00:19:24.880We've considered the vulnerabilities that we need to account for.
00:19:25.039 -->
00:19:39.200And we are trying to get one step ahead so that when we actually deploy into production, we're not deploying something that's full of holes and having to fall back and start patching and start nailing things on after the fact because we were there and considering it with them from the beginning.
00:19:39.359 -->
00:19:43.680And that's something that has been very successful with the different programs.
00:19:43.839 -->
00:20:05.599And honestly, it's also helped us to identify Shadow IT within the organization because we're tapped in to the actual acquisition lifestyle from the lifecycle from the cyber side, but also being able to work with our invent teams and other teams that are trying to deploy things quickly, being able to understand or have them understand what those requirements are early on in the acquisition lifecycle.
00:20:05.680 -->
00:20:12.079So you don't go out and purchase something, get the ability to start moving forward with something that just won't work in the end.
00:20:12.319 -->
00:20:14.880So I think that's been really successful for us.
00:20:15.039 -->
00:20:28.799And again, the biggest thing is just being able to integrate with the programs as they start looking at the mission needs, what they're actually going to procure, what is going to go through the acquisition lifecycle, and what they're going to end up with in the end state.
00:20:29.119 -->
00:20:31.200And do you feel like you're getting the right cooperation?
00:20:31.359 -->
00:20:33.119You've got a bunch of industry folks here.
00:20:33.200 -->
00:20:34.400Have they gotten the message?
00:20:34.559 -->
00:20:36.480Obviously, you're delivering it today.
00:20:36.720 -->
00:20:39.519But do you feel like you're getting the right cooperation from them?
00:20:39.599 -->
00:20:46.880Is there anything that is there an ask out there for them to make sure you fulfill the things that you're trying to do here in this effort?
00:20:47.440 -->
00:20:59.519The biggest thing is just the collaboration and having them understand and working with us to make sure that we can get you to where you need to be successful with us because ultimately you're the ones that are going to make us successful in the end.
00:20:59.680 -->
00:21:01.599And we want to be able to provide the requirements.
00:21:01.759 -->
00:21:13.519We want you to be able to use those requirements to further what you're doing so that when you bring it to us, it's something that we can use, we can provide out, we can give it out to our mission stakeholders, and they can take it and field it.
00:21:13.680 -->
00:21:21.839Because if you don't do that, we're going to end up saying no when you try to field it with our program managers, and that's going to wind up not being good for anybody.
00:21:21.920 -->
00:21:30.160So just really that collaboration and working with us to ensure that you're integrating what you need to, that you're securing the way you need to, and then we can move forward.
00:21:30.400 -->
00:21:30.799Excellent.
