Transcription complète de Broadcasting from the 9/11 Memorial & Museum Summit on Security

for us to communicate. But in a week we did it by every everybody bonding together and and and being able to raise the flag on that day. And the cyber war goes on today and you know this is this is a place we love here, uh, the ninal of the Memorial, and it's a great place to have a securities something well, And Frank, as I was mentioning at the at the top of the show, I mean, it has been fascinating to take part in some of these conversations today because there is it feels like, even given that we weren't thinking about this back then, a real sense of urgency. Right now you are, you know, at the crux of global commerce, your company is um What do you see out there in terms of preparedness and what is the tone of the conversation as we think about how to protect ourselves going forward. Well, the tone of the conversation is ramp up, ramp up, ramp up. You know, there's nobody there. There's no room to walk in that people feel that they're actually doing enough. Uh, And people have done a ton over the past ten years. But urgency matters, preparedness matters. I think the public and private have come together very well around this subject, and I'm proud of what's happened here by that collaboration. And I think that collaboration ultimately will help us long term. And we learned a lot before and we're acting better today. I think collaboration is such a keyword, Alice, because I also think about when I walk around here, it is it's become kind of a global memorial, right because if you go around the world, everybody has had instances, unfortunately of terrorism, and this is a moment where I think everybody comes together, no question. And in fact, you know nine eleven is a quintessential example. This was an attack that happened here, but it actually was a global moment. And everything is so interconnected. And when we talk about cyber you know, everybody is connected in one way or another, so systems can go down in one place, but it goes global in terms of its impact. Well, and Alice, you know that to that point of collaboration, you know we should mention that. You know, our boss, Mike Bloomberry is the chairman of this memorial and you and I think having you and Frank sitting here, I mean, is a real illustration of the collaboration that happened between public and private for this very for this very site, in this very memorial. How do you keep that collaboration going? I think with the kinds of programming that we're doing today, you know that if you invite people to come here, we can convene the conversation and in the process of having representatives of the government. We've had generals, you know, we have people from we just had Secretary Nielsen from Homeland Security. But with people like Frank, people who are in the private sector running companies, companies with global customers, global base. Um, everybody has to work together to ensure the security of all Frank. You know, one of the conversations we're gonna play later on in the show

that I was able to have earlier with one of the speakers, UM, the CEO of afford a List, you know, talked about kinda she gave some advices to you know, how do you prepare if you're a leader of a company, how do you prepare for for what's uh, sort of around the corner. What do you hear from your customers that you take back and say, Okay, this is the best practice. Now, well, I think it's important. Uh. First of all, the surround yourself with more talent than you can imagine, and to talk every day to people. UM. I think also practicing, you have to practice. And it's not I said it yesterday, I said every day. It's not a tabletop practice. It's a real, live practice. You have to learn from your mistakes, and then you have to be prepared to be nimble on the day of reckoning UM. And on that day, leadership matters more than anything else. You better be out in front, you better lead, and you better listen UM. So you know, it's it's relentless pursuit. When you think about what's to come for the museum and the types of UM events that you will be doing here like this summit, tell me what you're thinking, Well, I think nine eleven was an event that happened, but it's legacy is ongoing, and so for this museum to UM make a contribution going forward, we have to be at the forefront of these kinds of conversations. And you know you talked about collaboration, and you know, nine eleven was that moment when the world literally came together and Frank and I were actually talking about this at lunch. You know, people stop what they were doing, they ran to help that. The first question was what can I do to help? And I think if we could generate that level of consciousness in the world about we share a common threat, we're in it together, let's work together to solve it. You are listening to Bloomberg Business Week I'm Jason Kelly with Carol Master. We are here live at the nine eleven Memorial and Museum Summit on Security, presented by First Data, and delighted at the moment to be joined by retired General Keith Alexander. He is now President and chief executive Officer of iron Net Cybersecurity General Alexander. Really nice to be with him. Thanks Jason, nice to be here. So you did made a really nice presentation, really provocative presentation, I should say, UM to the group or earlier, tell us a little bit about sort of the state of cyber security. You obviously have an unbelievably keen uh set of insights into physical security. You've worked all over the world for the U. S Government, uh Ran, the n s A obviously. UH. Where are we at this moment in terms of preparedness as a country when it comes to cyber I think we have a long ways to go, mainly in terms of looking at the public private interface. So when we look at countries that could attack us, UM, like Iran, we aren't prepared. The government is not prepared to defend the nation because they can't really see what's going on. We can talk about the non nons those things. Those threats that we see out there. What we don't see are all the threats that are hitting industry until it's too late. So we have to come up with a mechanism where industry can identify anomalies and share it with the government. It's not personally identifiable information. It doesn't impact our civilities and privacy, but it does impact our security. So we've got to come up with a mechanism. The Site to Act authorizes something like that where industry can share with companies within a sector collective security that gets better. Think of it as the neighborhood watch approach, and then share that with the government so the government can do something to stop an attack. And that has to occur at network speed. We don't do that today. We share what we know after we're sure that we don't have a liability in it and that we don't have reputational risk. This has to be done at speed for the good of not only that company, the sector, but our nation general. Alexander, are there certain industries in particular that are at risk at this point? Well, I think the industries that are at risk the critical infrastructure and when you think energy, utility, energy utility, and you know, they actually are forward leaning my experience with the energy sector, they're moving out front. They're doing a great job. I think they're really pushing the envelope. But you look at the energy sector, financial sector, healthcare sector, I would throw the defense industrial base, and then you're gonna look at the telecom sector and government. How do you start to build this together as a collective framework that operates a network speed. We've got to get really good at that. Today. What we do is we find a vulnerability, or we find a piece of malware, we create a signature, and then we passed that like a patchwork quipped. I feel like, and all they have to do the threat is changed or modify that, and it's like a bar code on the bottle, and they change the bar code they get through. So why haven't we had some disasters? I mean, I know the stuff has happened. I bet there's things we don't even know about as the general public. But why haven't hasn't a major utility grid gone down? Is it fear of retribution you know of the US on another country. Why hasn't it happened yet? Well, I think it's not only retribution I think it's when do you want to use your cyber capabilities. Um, you're not going to use them willy nilly. With cyber is now an element of national power. They're going to use it as part of their political will to make our country change the way it's doing something, or at least attempt to do that. So up to this point, it's not in their interest to attack us, not only because of what we could do back, but it doesn't achieve any political objectives. So if you think about nation states, I think political objectives. If you think about UH trans criminal organizations, they have different objectives, and theirs is to stay below the radar and steal as much as they can. So you have all of these

different UH objectives going on in cyber China. Steal intellectual property, try to get out in front. We've got to come up with a collective way to secure country, and I think that's foremost sharing between government and industry. And how is that sharing going because I feel like that has been a key theme here. And are there mechanisms either that are in place or could easily be put in place to to really facilitate that? From your estimation, Well, so there's two types of sharing. I think we're sharing as best we can that which we know, and that goes to a process that the IACS have set up. What I'm talking about is sharing what we don't know. We'll call this uh ISSACS being the the you know, the sharing the information sharing agencies that we have for every kind of our critical infrastructure elements. They share. So the financial services ISAAC shares between the financial services. They share what they know and they do a really good job. In fact, the fs ISSAC, the Financial Sector Sharing uh Advisory Committee, is really good, but they share what they know. Imagine if we could share all the events that are hitting the companies that which we know, and that's what we don't know. The ones that we don't know are the ones that get us because we don't know about the issue. Is that's tough, that's hard. That's a new step, and that's a step I think as a country we have to take. It's interesting, though, and I think about how many conversations Jason, we've had, specially about some of the major tech companies that have so much information it includes them correct that they need to be involved in all of this. Just got about forty seconds left. Yeah, so you know. I think as you as you look at it, this is something that can be done. It's hard, I think from my perspective. The energy sectors moving out, they recognize they are at greatest risk for our country and have done a great job on it. More to be done, but we've got to bring this collective security together. Fascinating, fascinating stuff. Retired General Keith Alexander, now President and CEO of iron Net Cybersecurity, joining us here at the nine eleven Memorial and Museum Summit on Security, presented by First Data. You are listening to Bloomberg businessweet Carol Master along with Jason Kelly, live from the nine eleven Memorial and Museum Summit on Security. As I mentioned, our next guest has seen security threats, understands the risks demands first hand. He is former Deputy Commissioner of counter Terrorism of the New York City Police Department. Richard Falcon Wrath is Chief Security Officer Bridgewater Associates. Of course, the Investment Management firmanis with us here on site. UM, so nice to see you again. Nice to see you, car We have talked a lot over the years. Take us back because I said to you, I walked onto the site. You've just spend so much time downtown, not as much, but every time I come here, it's like it takes me back. I can remember nine eleven like it was yesterday. Yes, it's quite emotional to come back. My first visit to the site after nine eleven, I wasn't working in the White House at the time and came up a few months after the event, and I was still a pile and there were still human remains in the pile. It was smoking, it was still a hell hazard and it wasn't a very very moving experience to see fast forward for for me five six years. I've then am Deputy Commissioner of the NYPD for counter Terrorism, and at that time this was a hole in the ground. Um, there was no the buildings hadn't been rebuilt, they were just in plan. The plans had actually just been unveiled. And it had already been attacked twice once and again in two thousand one, and so we were very worried that it could be attacked again. That it had acquired such symbolic significance in addition to its economic significance, that we spent a lot of time with then Mayor Michlenburg. UM and Ray Kelly, my boss, making sure that this site had a state of the art security envelope around it um, which it does now. Um and it's very well protected site is also very functional site and um for me to come back here, uh, it just brings back a lot of memories of that time, of all the people who worked here, who lost their lives here. Uh. And and continue to make it such a vibrant, interesting place. Well and Richard, and you, especially given that backdrop, I think understand maybe better than anyone, especially given your current job. You know, the new sort of countours of threat uh and sort of danger and how complicated it is. What have you taken away from you know, the conversations here and and how do you feel about our general preparedness when it comes to the cyber world? Well, um, first, the general point is it's it's a reminder, I mean, this site, this memorial, in this museum, the reminder not just of how many lives are lost in this terrible crime that was committed, an attack that was committed against our country, but also the need to be ready for very remote possibilities that have truly catastrophic consequences. So vernacular, you'd call that a tail risk, something which doesn't happen very often, but when it does, it's really bad. And we live in the world where we've got to deal with all kinds of risks. Some of them are tail risks. They're extreme events which, when they occur, are catastrophic in one way or another. And there's there's many categories of them. Now people who haven't lived through them forget them or never learn about them, and so there does need to remind yourself of this um possibility. And so that's one of the functions that the memorial and the and the museum play when you think about it. For nine eleven. I mean, my I have two kids that are in high school. One of them was six months old when it happened, the other one wasn't even born yet. Um. And now there's whole generations coming through that have no living memory, no adult memory, of these events, and so it's important to keep that going. Yeah, I agree. How has the

use of things like artificial intelligence and data helped in terms of the fight against security threats? Well, it goes both ways. UM. So before we get to artificial intelligence, just in general, the digital age, we've gone through several waves of innovation here and including on the cybersecurity threat. And for a while there, i'd say from about two thousand one to two thousand fifteen sixteen, uh, it was really we were in free fall. It was exploding problem. Very very few companies, very few board ceo has really understood how to attack it, and it was getting worse every year. It was a constant parade of huge attacks that would happen um And one of the things that's happening now is the defensive technologies and the information security systems that enterprise can buy are starting to catch up, and so they're starting to be ord by no means out of the woods on this category problem yet, but there is now i'd say, a greater kind of parody of the offensive threats you're facing from the bad guys and the defensive abilities to protect your systems. It's still something that every board of directors, every CEO needs to take seriously and understand because it's one of those things that can can destroy your business, can deestimate your business. If you're in business today, you're in a digital business, and digital business relies on the if it can see these information systems only about thirty seconds left. Is there the sense of urgency out there right now around cyber as you talk to people in your business, I think it is. It may be a selection bias, which is the ones I'm talking to um find it urgent, But I think any serious company has to really grapple all these problems. And then in the public sector as well and government agencies, they're also seized with it. Now what they're able to do is a different story, but at a at an appreciation level, I think they do understand the gravity of this problem. You are listening to Bloomberg Business Week Carol Masser along with Jason Kelly at the nine eleven Memorial and Museum Security Summit. You are listening to Bloomberg business Week. I'm Jason Kelly along with Carol Massa. We are alive from the nine eleven Memorial and Museum Summit on Security, presented by First Data. I had a chance to moderate a panel earlier, Carol, and one of my stars was Luke Demboski, his partner at Deva Voice and Plumpton down in d C. Made his way up the SLIC corridor to be with us here today. A wide range of experience you worked in the government. You worked in Russia, and you're well positioned to give us a sense of where we are in fighting sort of cyber crime. At this point, what's let's let's go a level down. What's the threat we should be the most worried about when it comes to cyber I think it's really about the big systemic threats. Right now, there's always going to be that wire that gets misdiverted, phishing email, these types of low level attacks have been around, but now that we're more connected than ever, the

kind of attack that can cascade across the organization and worse, across a sector or an economy is really the big one. Like what like, I'm just curious, do you guys say, Okay, folks, here's here's the doomsday scenarios when it comes to a cyber threat. What might they be. We'll take the financial sector, and we do a ton of work in the financial sector. The banks are very interconnected. You have the trading platforms. All of these things are digitally driven now and so the right type of attack could have a broad effect, and the goal is to manage risks in a way to segment the effects. Do we need something like a blockchain to prevent that, Like you know what I mean. Like I'm trying to think we talk about these new technologies and trying to really understand the financial sectors all in and trying to figure out, Okay, what's the use? Is it? Something new in terms of how the systems operate has fascinating possibilities they I think it's really understood more on a micro level where it's it brings transparency, openness, and a decentralization to the exchange of funds. Banks and others are exploring how it could be used more broadly to bring those positive effects on a broader scale. So, Luke, I think about some of the cyber attacks and cyber incidents of the past few years. You have been involved, especially in your government job previously with the d o J in in helping to combat them, figure out what happened, and ultimately, I think, prosecute them. Whether it's targets, Sony, home depot and others. Are there common threads? I mean, what is it? What is it you took away uh from those experiences that you then advise clients about now that preparation is really key to one's ability to respond to actually practice being in a crisis. That's why I think the setting we're in today is so powerful here. Um, but that's a common denominator. Another one is you know you're still gonna be surprised no matter how much you prepare, and so uh, trusting others, having the partnerships in place and relationships in the end really will overcome the problem. What I think is below all of that is the technology. There's always gonna be technical threats. Really is about relationships, communication, trust at the higher levels. That's the difference maker. That seems to be a theme, and you pointed out earlier, Jason, this whole idea of collaboration public private sector. I mean, everybody's really got to work together to really, I guess ultimately have a secure system. Is that fair or definitely. I mean, the private sector controls more than eighty five percent of the internet infrastructure out there, so governments really depend on the private sector in many ways, including to tell them about the threats. Many people think it's the government's job to tell them about the threat and that's partly true, but the private sector has a lot of the networks that are being hit, and so there's an effort to try to bring these efforts together more collaboratively. Look what

about collaborations globally and internationally? I mean right now, you know we have governments in our own that's pushing back on trade policies and things and kind of thinking more domestically. Um, the importance of countries working on a global scale. I'm seeing you like NodD in your head. This isn't used to be my job. I used to get parachuted over to Europe to the European Cyber Crime Center to try to make these global operations work. And the first times I went on case is like silk Road. It would be a few countries participating, and then it would be few, a few more and a few more. So the having the will, the laws and the capability to participate is key to me. What underlies all of it is rule of law. People would say, you know, you're coming to us asking us to support the US government. Why is this about Team America? Really is not about Team America. It's about creating a level playing field so innovation can occur, so that as Steve Jobs of Bill Gates can come out of their garage and be protected in that innovation rather than having it taken from them which is what would happen in many of the corrupt countries around the world. You alluded earlier to Uh one of the best quotes of all time from Mike Tyson that everybody has a plan until they get punched in the face. Uh. How good is the planning at this point? And and specifically on the subject of planning and talent, we talked a little bit about black hats and white hats. How do you sort of leverage the bad guys help the good guys. Well, I think it's putting on your your doctor evil hat, if you will, and starting to think about things as an outside attacker, using outside experts instead of your own people to tell you how well protected they are. I mean, there are these dynamics within organizations that suppress, naturally suppress risk a little bit. So it's that outside the box attacker mentality, and then increasingly from a talent perspective, people in the risk area that can see cross functionally. Hackers operate in the gaps. They operate in the gaps between countries and then within organizations, the gaps between compliance, legal info, sec. Breaking down those gaps is the key to fighting this. I got to ask you about in terms of fighting it. When a company or an entity or an institution understands that there's been a security um hack or flaw or threat that's been actually carried out, what's the correct game plan for crisis management? Because we've certainly seen a lot of different scenarios play out for the corporate community UM and I'm just curious, from your perspective and dealing with so many corporate hacks, what is the right game plan? Is it to get out there in front? Is it first deal with the problem, then make it public? What's right? You start with putting your customer your client first, making choices in favor of your customer and client to protect them and not just your own self interests. And then the question is how do we execute on that so we don't trip over ourselves despite our good intentions. And that's a lot of practice to get that right. My job is to help our clients reflect their good intentions to their customers and other stakeholders, to the public, the media at large. And so it's it's practicing your communications plan. You don't You're not expected to know all the answers right away in a hack. You're expected to convey that you're on top of it. You're gonna put the customers first, You're going to act decisively, and you're gonna be back when you have more information. Is it like any other corporate crisis or is this different? Though? It's it moves more quickly than many of them do. Certainly natural disasters and they can occur very quickly some things we see coming, like hurricanes and so forth. But the speed, the scale of this is quite scary. It's quite global in nature, it's inner across border, and that intimidates people and they don't understand it as much. So I think rolling up your sleeves and understanding it is is a great start. And then you don't trust the system right, and systems start to break down if there isn't trust, and we see that often. You are listening to Bloomberg Business Week Live from the nine eleven Memorial and Museum Someone on Security, presented by First Data. Carol and I have been having some really interesting conversations throughout the course the day. Really excited to have our next guest, Mark Hughes. He is the CEO of BT Security based over in London, spends a lot of time here in New York UH and here with us on site. He and I got to participate in a panel earlier. So Mark, thanks so much for joining us so set the stage for us because and and maybe remind people how how much you really sit at the center of so much communication and kindidly by virtual of that vulnerability. Yeah. So, BT is one of the largest network providers in the world. So we have the largest MPLS network that's a multi packet level switch network in the world, extends to a hundred and eighty countries. And the fact is that a lot of the way in which the world's traffic moves around the globe transits the UK. So we really do sit on a load of data, a load of network traffic that gives us a lot of insight to what's actually going on, and therefore we can spot vulnerabilities and use that to help our customers and ensure that they're better protected, be they small customers, citizens in the UK or right up to one of some of the largest big smp How many on a daily basis, weekly basis, monthly basis, Mark, how often are we seeing networks being kind of attacked? Well, all the time, Carls. So we have six terroorbies of traffic that transits our network per second. So we're saying on a normal day upwards of plus thousand different types of attacks, which aren't just like scanning things. They're actually genuinely things that could turn into something quite malicious and then have an impact on an organization, but they don't. They don't because we do stuff about it. So we spot this. We

look at the types of traffic, we look at the types of patterns of traffic, and then we intervene so we can for our own business we make sure that we block and take action to stop that those things developing into militious attacks, and also for the UK more broadly, as I am fascinating about this because there is so much stuff floating around the world, right data information um voice. When you say you're tracking patterns of of traffic, like what specifically do you look forward that says Okay, we've got a problem here. Yeah, certain characteristics of the way in which malware proliferates you can see in network traffic. I'm not talking about content here, we're talking about the metadata, the things that don't have any privacy around it. They're just a way in which the the traffic, the data, traffic moves around down networks and certain things. Though, attacks that are trying to proliferate in a certain way have certain characteristics the way in which they operate, and therefore we can spot those and do something about it. One of the big questions that's been coming up here throughout the day, and we've talked a lot of our guests about it even on this show, is this intersection of business and government. Um, the UK actually has been fairly aggressive in and you've worked very closely with the government to identify some of the vulnerabilities and really come up with new and better ways to combat that. And you alluded to this sort of on the on the front end. How hard was that to pull off? Yeah, it took a better time, Jason. So we had to think hard about how people in the UK and more broadly across the globe, but specifically in the UK, we're really being impacted by this, and some of the stories are really tragic. You know, when when individuals get hit through attacks that potentially strip their their life savings away from them. You know, this is real, really hard things for people who are potentially quite vulnerable, and you know, most people who get involved in these things don't do it knowingly, they're duped in some way, they click on links they may be are socially engineered as well. So we really sat down with UK government and there is a piece of the UK government called the National Cyber Security Center, and we said to each other, look, we've done lots of things in terms of trying to build up cyber defenses in the UK, but are there things that we could do that could be really more targeted at trying to stop some of the real harm that is happening here. And we came up with a list of things technically and we said, look, as the largest I s P Internet service provider in the UK and one of the largest in the world, could we intervene in a way which would try and protect the UK citizens from these types of attacks most pretty well, all of which they never asked for. They never wanted those futching emails in the first place, and then they invertedly get to get stung, you know, by criminals acting in this way. And so we came up with a list of things which were now implementing and are making a real difference. We're seeing a reduction in the number of these types of attacks in the UK. That means that you know, people are now better protected than they were before. It's the next level of cyber threats that you guys are kind of kicking around. I think about ransomware. I feel like we talked about a lot over the last couple of years. What's the next level? Well, there is, ransomware hasn't gone away. Lots of things haven't gone away, Carol. This is a surprising thing when you look at actually the number of different things. A lot of this is quite old stuff that is doing the rounds again. And so we've still got a long way to go to get our basics right, to do the blocking and tackling of information security. We call it cybersecurity nowadays, but that's what it comes down to across many, many different environments. But it's never ending, right, I mean, you know, but then there's but then the fact is the advantages that we're seeing from all the technology that we know and love and use every day, they're never ending as well. So there is a bit of you know, as we improve and we all get access to better digital services and we do more stuff online than the threat grows as well. And that was always the case that there was always criminality around it, So we just need to be in a in a place well positioned to defeat that. Just go about thirty seconds left here. We keep hearing the theme and the important cub global of collaboration between governments, between countries, between corporations. Are you seeing more and more of that? Yeah? Absolutely, and we're we're in We're in BT, very very proud of what we do with the Government's not just about doing tangible action, it's also about how would we get that ecosystem of new talent coming through as well working with school kids to bring them and make them interested in careers and cybersecurity, so that collaboration is really growing. You know, I recruited over nine hundred people into my team last year alone, on the team of over three thousand, and now a lot of the new join us coming out of schools and connection. You're listening to Bloomberg Business Week Live from the nine eleven Memorial and Museum Summit on Security presented by First Data. So Carol add a chance to catch up earlier today with really one of the most dynamic CEOs I've interviewed in a long time, Teresa Peyton. She's the CEO of Fordalus. They work across the whole spectrum of cyber security. Fascinating conversation. Here's what you had to say. You were in the business of helping people think about cybersecurity, and we're at this time where it's clear that people have to be more proactive rather than just reactive. What's your best advice for companies out there? Yeah, my best advice is, you know, first of all, take take um at each level of the organization. Take the time out it can be a staff meaning and just say, what's the worst nightmare, Like, what is the worst

thing that can happen where either the regulators will pound us so badly, life will be miserable, or our customers will never trust us again. Are huge impacts to the bottom line. And then really understand what makes up the opportunity for that worst possible scenario, and then work your playbooks around that. So the technology you invest in, how you do segmentation, the tools that you implement, and how you tune them, focus them around those nightmares, and practice practice, practice, because you'll learn each time when you practice your playbook what you're missing. You'll learn, oh, I'm missing insurance to cover that if that happens, or you'll learn, you know what, we don't have the internal capabilities, either on the security team or the I T team, or the legal team or or crisis pr and we're gonna need an outside firm. You know. I'm from the South, so I often say a cybersecurity incident is not the time to have something like a shotgun wedding where you're all shaking hands right before the ceremony. And so you want to make sure where you know that you're going to need that outside help, that you make those introductions and you figure out who those partners are and you then in the future practice those digital disasters with them. Hopefully you'll never need the playbook, but when that worse case happens, you need to know what you're gonna do and even more importantly, what you're not going to do. You had an opportunity back in oh six to oh eight, I believe, to work in the White House chief information officer there. What did you learn from your government experience about that has helped you in the private sector, and how do we improve that nexus it feels like between the public and the private sector as it relates to cybersecurity. I'm so glad you brought that up, because that really was a big You know, there's several points in your career that are turning points, and that was one of sever all. And you know, I had come from the financial services industry, and when bad things would happen, I would think to myself, Okay, it must be a policy issue or training issue. If I could just communicate better, maybe bad things wouldn't happen, if I could just teach people a little bit about what I know. And then I get to the White House and I'm getting briefings daily on how the threat vectors being taken advantage of are changing daily, and there's multiple ones changing, and I've got people all around the world with different targets. And I thought to myself, if I'm going to stay the same, I'm going to fail at my job, and they're not going to be safe and secure. And that's when I realized, you know, that that old adage of humans are the weakest link is really wrong. It is a conventional wisdom that we need to overturn and stop talking like that. What we need to be saying is all technology by design today is designed to be open and interconnected. Right, you want that blue so you can be hands free in the car when you're talking on the phone. You

want to make sure that your phone can play music on your Bluetooth speakers. You want Internet of Things devices checking out your front porch and making sure your packages aren't being stolen. And that interoperability and that openness by design means it's always going to be open by being hacked, and the humans using it are vulnerable because of that. Right. So if we change that mindset, you actually change how you think about designing with the human in mind. Instead of saying, okay, human, let me sit you down, and this is how you do strong passwords. Okay, now, don't don't be on free WiFi. Now, be careful when you travel overseas. If you if you design by design with the human in mind, that everything's interoperable, interconnected, and hackaball, then you're gonna be thinking about creating these automated safety nets where they don't have to think about it. It just happens for them, right, And it does feel like one of the themes we keep hearing is this idea of understanding what the technology is and how people use it in order to create better uh and better human system so the government doing enough at this point to support private industry as it tries to stay a step ahead of the bad guys, I don't. I don't think we can ever do enough, and that this comes down to it's crime, and you know, at a real basic level, identity theft is annoying and money is stolen, and that's a problem. But at a more complex level, a lot of these crimes are funding other crimes. They're funding human trafficking and terrorism, illegal drug running. I mean, just horrible, horrible things happening on the planet. And so I would tell you we can never do enough. What what I can say is I do believe the government every year makes the best faith effort with our allies, with the private sector to do a better job. But the challenge that we have is is kind of these old ways of thinking, right, so everything's focused on defense. We some of the other speakers prior to our panel today talked a little bit about you know, once the bad guys get in, they can just run around and do whatever they want undetected. And that's because we haven't thought about sort of that segmentation or compartmentalization of the information. All the Crown Jewels are right by the front door. You know, you think about when you go away on vacation, you do a lot of things. You shut off the newspaper, the mail, you'll tell your neighbors, you have timers, turn on lights, you might turn on a security system. And you don't say, oh, the last thing before I leave, because I know this is also fool proof. I'm going to take all my valuables and put them right inside the front door. You don't do that, right, You still hide them like people have a sock drawer, people have home safes, people have safe deposit boxes at the bank. Why aren't we doing that with our data? So just assume they're going to get in, and just ask yourself, how do I create all these different sort of trap doors and opportunities. One to cordon them off too, to get alerted sooner, and then three if they get a piece of information that they can't run laterally through the organization and collect at all, how do you do that? So that was my conversation with Teresa Peyton, CEO of Fordlis Carol, I love what you said about I think it's a smart thing about this assumption that they're gonna get in. So if you think they're not, then you're kind of fooling yourself. And you've got to think about your data, your information, whatever it is, you gotta protect and be sophisticated about it, use common sense. It's I think it's an underappreciated sentiment in a very technical world. Thanks for listening to Bloomberg Business Week. You can subscribe to the podcast on iTunes, SoundCloud, or Bloomberg dot com. You can also listen to our radio show every weekday at two pm Eastern only on Bloomberg Radio