WEBVTT
00:00:00.080 -->
00:00:16.000Yeah, I just want to turn to you because I know your Skyfall lab is things that we're talking about, both AI for cyber defense, AI machine learning for cyber defense, and how adversaries might use AI to target energy grid systems and things like that.
00:00:16.239 -->
00:00:23.280So what can you tell us about that work, what you're learning, and how it could inform some of these national efforts that are ongoing?
00:00:23.600 -->
00:00:24.000Absolutely.
00:00:24.079 -->
00:00:47.520So just uh a word of background, our our Skyfall laboratory is a capability that allows us to take the real physical hardware that exists in critical infrastructure systems, integrate it with our high-performance computing simulation environment so we can understand effects on individual real devices, but then understand how those propagate to system level scale, because we don't really care about effects on devices.
00:00:47.600 -->
00:00:49.359We care about effects on systems.
00:00:49.679 -->
00:00:55.280And so we've absolutely been using that to help understand AI and the role of AI in critical infrastructure.
00:00:55.439 -->
00:01:05.680And actually want to maybe take a step back and broaden the thinking on that just a little bit because a lot of the focus has been on using AI to find vulnerabilities in software and devices.
00:01:05.760 -->
00:01:08.000And that absolutely is something important to think about.
00:01:08.239 -->
00:01:13.439But AI also helps upskill the adversary in a lot of different ways.
00:01:13.680 -->
00:01:20.719One of the really important things about cyber attacks on critical infrastructure is bringing the right level of expertise to that problem.
00:01:20.879 -->
00:01:25.760You have to understand how the cyber system works in order to get in and get your access.
00:01:25.920 -->
00:01:31.439But if you don't understand how the underlying infrastructure system works, the effects you make are going to be random.
00:01:31.840 -->
00:01:38.959If you look at a lot of the early attacks we've seen on critical infrastructure systems, they are break in, cause chaos, get out.
00:01:39.120 -->
00:01:41.680The impact of that is a temporary disruption.
00:01:41.920 -->
00:01:51.920You get someone in there who really understands how the power grid works, how a water system works, and they make the right manipulations, suddenly you're dealing with a whole different level of problem.
00:01:52.000 -->
00:02:01.439And AI helps the adversary learn about those systems and can help them not only find their accesses, find their vulnerabilities, but design those attacks.
00:02:01.599 -->
00:02:07.439And so when we think about AI and the use in critical infrastructure, we think about risk in four different categories.
00:02:07.760 -->
00:02:11.520One is an important one, too, unintentional failure-friendly AI.
00:02:11.680 -->
00:02:14.400We trust an AI system to run our systems.
00:02:14.560 -->
00:02:15.680It hallucinates.
00:02:15.919 -->
00:02:18.319You push it beyond its boundary, it messes up.
00:02:18.479 -->
00:02:20.240That is a very real risk.
00:02:20.479 -->
00:02:25.280Second mode of risk is adversary attacking the AI itself.
00:02:25.439 -->
00:02:34.240So trying to cause your AI to make incorrect decisions, disrupt your training data, extract sensitive information from the AI models.
00:02:34.560 -->
00:02:37.680Third category is what we were talking about before.
00:02:37.840 -->
00:02:42.000It's the adversary using AI to design and execute their attack.
00:02:42.159 -->
00:02:44.960And then the fourth category is we have to understand AI software.
00:02:45.120 -->
00:02:47.439Software has its own vulnerabilities.
00:02:47.599 -->
00:02:54.800And so thinking about the common libraries, the common components that are used in these AI models and thinking of them as attack vectors.
00:02:54.960 -->
00:03:03.360We try to think about risks all four of those areas at the same time, understanding the true benefits of AI because it's not just a risk thing.
00:03:03.520 -->
00:03:06.000It can have a lot of positive impacts as well.
00:03:06.240 -->
00:03:18.719And so our focus has been on working with, in particular, DOE Caesar and their AI Forts program to design, build, and deploy a series of test beds that address those risks.
00:03:18.960 -->
00:03:28.000One of them focuses on understanding an AI model's susceptibility to manipulation and other adversary attacks on the AI itself.
00:03:28.240 -->
00:03:35.599There's a second one that focuses on measuring and quantifying the functionality and performance of the AI model.
00:03:35.759 -->
00:03:38.479How well does it perform the task it's designed to perform?
00:03:38.639 -->
00:03:42.560And a third one that helps aid in the adoption of the AI.
00:03:42.719 -->
00:03:52.240Basically, the simple way to think about it, it helps makes an AI show its work to competent humans who can then say, yes, it's coming to the right conclusion.
00:03:52.319 -->
00:03:58.719And by the way, it's getting there for the right reasons so that we can build that confidence to use that in our systems.
00:03:59.199 -->
00:04:02.000And those test beds are operational today or being built out?
00:04:02.639 -->
00:04:03.439Various stages.
00:04:03.599 -->
00:04:06.159So we've got uh uh one of them that is operational.
00:04:06.240 -->
00:04:10.960We're actually starting to work with industry partners now to test their models.
00:04:11.120 -->
00:04:18.160There are others that are in various stages of development, but we hope to get those out and connect with the asset owners and the capability owners very soon.
00:04:18.480 -->
00:04:18.879Interesting.
00:04:19.040 -->
00:04:19.839Stay tuned on that.
00:04:20.000 -->
00:04:29.199One question that struck me as all of you were talking was just how, Matt, you said clearing houses, because there's multiple clearing houses.
00:04:29.279 -->
00:04:31.920There's the federal one that's just starting to be built.
00:04:32.160 -->
00:04:37.839I'm guessing maybe you're referring to like Project Glasswing from Anthropic and related efforts like that.
00:04:38.000 -->
00:04:44.160I mean, how do those come together to effectively address this problem?
00:04:44.319 -->
00:04:46.639Should they come together, or how are they coordinated?
00:04:46.959 -->
00:04:48.399Well, and right now it's not just domestic.
00:04:48.480 -->
00:04:50.399There's international partners that are doing this.
00:04:50.480 -->
00:04:54.560There's a global approach similar to the way MasterCard's taking this on.
00:04:54.639 -->
00:05:01.680And there's a lot of information sharing that does kind of go from international body to industry and industry to home front.
00:05:01.839 -->
00:05:04.800And so there is a lot of telephone game that goes on with those.
00:05:05.040 -->
00:05:08.319The good news is there's a lot of people taking a lot of looks at this.
00:05:08.480 -->
00:05:14.720And so the coordination is not perfect right now, but at least all the partners at the table all have each other's cell phone.
00:05:14.800 -->
00:05:18.720So it's not, it's not an exclusive club to the extent that that information stays inside a bubble.
00:05:19.040 -->
00:05:28.000So the office of the national cyber director obviously in a position to kind of oversee a lot of those federal efforts at least and use the power of persuasion to bring in industry.
00:05:28.160 -->
00:05:31.920I mean, what can you say about that effort to oversee this at a national scale?
00:05:32.240 -->
00:05:32.480Yeah.
00:05:32.560 -->
00:05:40.000I mean, I think to our earlier discussion around public-private partnerships, it takes both sides bringing sort of their best to the table, right?
00:05:40.160 -->
00:05:49.680And that means maybe there's other pieces that flow into that of things that is just industry to industry working together and then they together bring their best or they're bringing individual pieces.
00:05:49.839 -->
00:06:01.920But ultimately, you know, ensuring that that's given to, for example, from the critical infrastructure perspective in a clear, coherent way for how that infrastructure entity can prioritize and makes their own security decisions, right?
00:06:02.000 -->
00:06:19.519So it's a good thing to have a plethora of different ways that industry and government are working together, but ensuring that those are all at the end of the day presenting a coherent message to the end user from a critical infrastructure perspective or a federal CISO perspective so they can make quicker, more effective decisions to protect their networks.
00:06:20.240 -->
00:06:27.040The executive order also talks about making AI cybersecurity tools and services available to state local critical infrastructure.
00:06:27.279 -->
00:06:39.040We've talked a little bit about how this can be leveraged to make up some security gains, address both the AI-driven vulnerabilities, but also just broader cybersecurity challenges.
00:06:39.279 -->
00:06:51.120I want to ask the panel what might be most useful to entities like that could come out of this executive order from ONCD, from agencies like CISA and others to slow down to these entities.
00:06:51.360 -->
00:06:52.480Pearson, any thoughts there?
00:06:52.800 -->
00:06:55.120Well, I'll talk about it from an industry side first.
00:06:55.279 -->
00:07:01.839I think kind of just going off of what Seth was saying about how we coordinate and collaborate across infrastructure, industry, and government.
00:07:02.000 -->
00:07:07.759It's, I think there's the responsibility as I sit in industry right now for industry to share what it's seeing.
00:07:07.920 -->
00:07:19.360So from a MasterCard perspective, if we think about fraud, if we think about protection, which I think all of these things are now becoming linked, it's cyber-enabled fraud when we look at protection of critical infrastructure.
00:07:19.519 -->
00:07:25.519So we're seeing work that we're bringing in AI to protect the payment ecosystem.
00:07:25.680 -->
00:07:33.519So it's being able now to show red flags to financial institutions to say, hey, we're seeing a synthetic identity being used to open an account.
00:07:33.680 -->
00:07:39.839Therefore, by preventing that, we're preventing a malicious actor from getting a foothold in the payment infrastructure.
00:07:40.000 -->
00:07:43.759And then when we see that, we're able to flag those signals to other entities.
00:07:43.839 -->
00:07:49.199So in sharing that, another way is being able to spot threat patterns in transaction decisioning.
00:07:49.279 -->
00:08:01.199So MasterCard analyzes transactions and is able to signal to financial institutions when we're seeing not just synthetic identities, but when we're seeing transactions that are likely part of fraud.
00:08:01.360 -->
00:08:04.319So I think from an industry side, it's getting at that source.
00:08:04.480 -->
00:08:09.199We talked a little bit about supply chain security and we were talking about where the symptoms come from.
00:08:09.439 -->
00:08:18.000Industry has a responsibility to look to identify the source and to help prevent and importantly share those indicators, not just of compromise, but of interest.
00:08:18.160 -->
00:08:28.079One of the things that we talked about at CISA was we're not just sharing what we see from a compromise perspective, but we're seeing, we're seeing when we see an indicator of interest, when something might be happening.
00:08:28.240 -->
00:08:32.159And I think that to Seth's point, you know, we've always said cyber is a team sport.
00:08:32.240 -->
00:08:34.559You can't do one entity doesn't do this by itself.
00:08:34.720 -->
00:08:36.399It's being able to share that.
00:08:36.559 -->
00:08:40.480And I think what is fascinating right now is industry knows its sector very well.
00:08:40.639 -->
00:08:52.799There are some sectors that can cut across and have that visibility, but government sits and is able to see cross-sector, which is also why I think I'm interested, particularly interested in the clearinghouse, because it's really looking at that cross-sector capability.
00:08:52.960 -->
00:09:01.600So we have to be able to share these threat signals, importantly, getting to this place of not just what we're seeing and where the threats are, but where we think they're coming from.
00:09:03.039 -->
00:09:03.679Other thoughts?
00:09:04.000 -->
00:09:05.279Yeah, tools and services.
00:09:05.360 -->
00:09:06.960So just building off what Kirsten said.
00:09:07.360 -->
00:09:12.720I mean, the challenge is you have a lot of different opportunities with what you can see from the internet.
00:09:12.960 -->
00:09:28.320Like the traditional human-centric security tooling we've done is vulnerability management, threat hunting, and attack service management have been one of the three most valuable techniques and tools we've seen that complements any good SOC, any good network security package.
00:09:28.480 -->
00:09:36.399But when we start talking about the clearinghouse prioritizing a lot of speed and scale, we're actually going to need those at speed and scale.
00:09:36.480 -->
00:09:42.480And so that action that we're looking to have driven, we need that clearinghouse to really be a home orchestration.
00:09:42.799 -->
00:09:47.919That's the term for taking all of these collaborative efforts and producing group action.
00:09:48.080 -->
00:10:01.519And that's where we're going to have a lot of incentives to use AI-shared tools that can both be disseminated by states, by CISA or other particular, like for example, energy has shared resources as well, their sector by sector resources that are available.
00:10:01.679 -->
00:10:32.080I think that there you're going to start to see what used to be a challenge to share because it was so subject matter expert dependent, as a deep dive on vulnerabilities of my network, you're going to start to see AI-based tools that are genic that can actually be sent out and done to networks on behalf of others and have a privacy quotient to that as well, to where you actually do get to Christian's point about predictive prioritization and the ability to have an orchestration at scale to know that certain people are covered down on and certain people still have work to do.
00:10:32.480 -->
00:10:38.320Is there a risk that we get caught up in this AI kind of craze?
00:10:38.399 -->
00:10:45.919And we've been talking about cyber hygiene so much for the last five years, and we lose a little bit of focus on the basics, or can that happen in concert?
00:10:46.000 -->
00:10:47.679I don't know if anyone has thoughts there.
00:10:48.000 -->
00:10:49.360Well, I think it has to happen in concert.
00:10:49.519 -->
00:10:58.000I mean, we can't lose sight of cyber hygiene, but I do think, you know, we're talking about when Nate was saying upskilling, I thought he was going to talk about for our labor force, right?
00:10:58.080 -->
00:11:01.759I mean, I know he was going some, but there is this both sides, right?
00:11:01.919 -->
00:11:04.639So AI to help us with cyber hygiene.
00:11:04.799 -->
00:11:09.360I think that, you know, is going back to the small business piece and small business and cybersecurity.
00:11:09.440 -->
00:11:18.639I think AI to help small businesses, that's one of the key elements is cyber hygiene and how you can automate some of these defense tools and what that looks like.
00:11:18.799 -->
00:11:21.039But these things can never happen in isolation.
00:11:21.200 -->
00:11:24.240And so we have to be thinking about how they are working in concert.
00:11:24.639 -->
00:11:24.879Yeah.
00:11:24.960 -->
00:11:32.559And I think the importance of cyber hygiene is if you haven't taken care of the easy stuff, the adversaries aren't going to use their best stuff against you.
00:11:32.799 -->
00:11:36.320So you got to raise the baseline and force them to at least try.
00:11:36.559 -->
00:11:37.840So that's super important.
00:11:38.000 -->
00:11:41.759I do want to come back to how we use AI on defense.
00:11:41.840 -->
00:11:51.519And I think uh, you know, the simple way to say that the best defense against the bad guy with AI, we think about adversaries using AI to discover vulnerabilities and write exploits.
00:11:51.679 -->
00:11:56.879You know, we have to think about how the good guys use AI to discover vulnerabilities and write patches.
00:11:57.120 -->
00:12:02.879Where that gets challenging is in critical infrastructure systems, patching is not an easy thing to do.
00:12:03.120 -->
00:12:08.799Just because you write a patch doesn't mean you can deploy that patch out into your system or that you'd even want to.
00:12:08.960 -->
00:12:11.840And so you have to think of other compensating controls.
00:12:12.080 -->
00:12:15.519So vulnerability comes out, an exploit's developed.
00:12:15.759 -->
00:12:19.440Maybe you can't patch for months or years.
00:12:19.600 -->
00:12:26.960So you write firewall rules, you write detection rules to detect those exploits that are coming in and try to contain that threat.
00:12:27.039 -->
00:12:38.879And so a lot of the focus that we've been seeing is taking those AI tools and again helping to upskill and scale our workforce, just like you were mentioning.
00:12:39.120 -->
00:12:56.639So one of the things that we're excited about is the ability to take threat hunting and take our expert threat hunters, code the way they look at systems into these AI models, and then hand that off to some of the smaller entities who maybe don't have that level of expertise.
00:12:56.720 -->
00:13:06.080And you can take you're not going to take a novice and turn them into an expert, but you can take a novice and turn them into someone who's decent, or you can take someone who's decent and make them really good.
00:13:06.320 -->
00:13:16.879And so using AI in that sort of way on the defensive way and investing in how we can use AI as defenders, not just the way the adversary is thinking about it, but how do we use it to secure our systems?
00:13:18.320 -->
00:13:25.679I want to hone in on operational technology here because obviously it's such a key piece of critical infrastructure.
00:13:25.840 -->
00:13:34.720And the same day that the AI security executive order was released, CISAR released an advisory on automated tank gauge readers and how they were being targeted.
00:13:34.799 -->
00:13:37.919And that got a lot less press than the AI security executive order.
00:13:38.159 -->
00:13:45.919Reading through it was also somewhat alarming that these types of technologies are being successfully targeted by adversaries in some cases.
00:13:46.080 -->
00:13:50.559And so, Nate, maybe we can start with you because this is so much what the lab looks at.
00:13:50.799 -->
00:13:57.440OT specifically, what are some of the key challenges and opportunities for securing those today that you're working on?
00:13:57.759 -->
00:13:57.919Yeah.
00:13:58.159 -->
00:14:00.480So I mean, one challenge is what I mentioned before.
00:14:00.639 -->
00:14:04.159The idea of rapid patching of OT just is not feasible.
00:14:04.399 -->
00:14:17.600If you think about the confidentiality, integrity, availability triad, OT has traditionally focused very heavily on availability, the other two not as important because the idea was you know, that network's isolated.
00:14:17.679 -->
00:14:18.799It's not connected to anything.
00:14:18.879 -->
00:14:20.559We don't need to worry about security.
00:14:20.799 -->
00:14:22.080That's not true anymore.
00:14:22.240 -->
00:14:34.960You know, with the increasing conversions of IT and OT, and that doesn't necessarily mean your OT systems are connected to your IT systems, but means your OT systems use technology that's also used on IT networks in those OT systems.
00:14:35.279 -->
00:14:38.080Security becomes a lot more important.
00:14:38.639 -->
00:14:48.480Right now, if you can get on an OT network, a lot of times you can communicate directly with the physical devices on that network, issue them commands, they execute them.
00:14:48.639 -->
00:14:55.200They don't have that questioning nature that devices we've learned to build into things that are on IT systems.
00:14:55.360 -->
00:14:57.600They get a command, they follow it.
00:14:57.919 -->
00:15:03.279And so it is very easy if you can get access to those networks to cause those disruptions.
00:15:03.360 -->
00:15:09.759And so we need to think about how we build security into those OT systems without compromising availability.
00:15:09.919 -->
00:15:15.840Because again, my desktop computer crashes, I just reboot it and I lose a minute or two of productivity.
00:15:16.080 -->
00:15:20.720An OT system crashes, there are physical consequences that are not acceptable.
00:15:20.960 -->
00:15:28.399And so trying to build in that security without compromising the availability concern is the biggest challenge with OT.
00:15:29.360 -->
00:15:39.440Seth, and your pilots with critical infrastructure, the defense critical infrastructure pilots, some of the work that's emerging on AI, how does OT factor into what you're looking at from your perch?
00:15:39.759 -->
00:15:40.639OT is a big piece.
00:15:40.799 -->
00:15:45.440As Nay alluded to, we've seen more convergence between OT and IT over the years.
00:15:45.679 -->
00:15:50.480Much of that OT, certainly not all of it, but a lot of it has been around for a very long time by design.
00:15:50.639 -->
00:16:01.120They're high availability systems that are designed to work for 15 or 20 or plus years, and maybe people are using them even past end of life to keep with integrations with other systems they're having.
00:16:01.360 -->
00:16:16.159And especially as we see sort of the innovation happening in the AI space, I think there's a unique opportunity to be able to say, hey, how do we help some of those small entities who have a lot of OG, maybe out of date?
00:16:16.240 -->
00:16:18.879And also there's some new technologies to be able to help test.
00:16:19.039 -->
00:16:21.759We're not going to be able to do that everywhere in the US all at the same time.
00:16:21.840 -->
00:16:23.519But I think the pilots do have an opportunity.
00:16:23.600 -->
00:17:00.480And the concept behind them is to say, hey, let's pick a particular set, pick some technology that we think public-private partnership, and say, let's test these on actual networks, see what works, and then help states, localities, critical infrastructure, help scale those to protect those systems, particularly those that are at the long tail, that are just not thinking day in and day out about what's the cutting edge technology that I could be used to protect my water system, my rural hospital, my local power utility that are not only key dependencies for their own communities, but also for maybe the defense installation that's in that area for a key dependency for other parts of critical infrastructure or other federal systems.
00:17:00.720 -->
00:17:04.240I think to add on to that, we've talked a lot about the interdependency across sectors.
00:17:04.319 -->
00:17:10.000I think what Seth was talking through and Nate, we also have to remember that there's that interdependency to state and local level.
00:17:10.079 -->
00:17:20.079And I think that's where OT really comes into play is making sure that the state and local governments, that the entities in this administration has really invested a lot in pushing resources to the state and local governments.
00:17:20.240 -->
00:17:29.920I think that's going to be super important for the OT security and safety because there's a psychology to OT breaches when physical things get attacked.
00:17:30.160 -->
00:17:34.960That really impacts how we're looking at security and safety as a nation and more globally.
00:17:35.119 -->
00:17:42.400So that ability to work more closely with state and local governments on this IT OT convergence is becoming even more urgent than it's ever been.
00:17:43.279 -->
00:17:44.960We have about 10 minutes for questions.
00:17:45.279 -->
00:17:46.880We have some mics set around the room.
00:17:46.960 -->
00:17:49.599Does anyone have a question?
00:17:52.960 -->
00:17:54.559I can keep asking them to keep that.
00:17:57.839 -->
00:17:58.160All right.
00:17:58.480 -->
00:18:01.039Well, if something pops up, shout out.
00:18:01.440 -->
00:18:01.759Whatever.
00:18:02.000 -->
00:18:05.519But we wanted to talk about workforce, I think, as well as part of this panel.
00:18:05.599 -->
00:18:07.519I know it's a big part of the cyber strategy.
00:18:07.680 -->
00:18:14.319It's a big part of actually the AI security executive order mentions workforce hiring, I think, that the tech force.
00:18:14.559 -->
00:18:25.680And when we talk about critical infrastructure, so disparate, so many different entities, I think we've often heard that they lack the workforce in many cases to address these issues.
00:18:26.000 -->
00:18:32.480Nate, you just talked a little bit about what your lab is working on as far as pushing that type of AI-driven training.
00:18:32.640 -->
00:18:40.480But how do we get around this problem of the cyber workforce, especially in today's day and age with AI-driven threats and other things?
00:18:40.720 -->
00:18:43.599Seth, can you talk about the national cyber directors piece?
00:18:43.680 -->
00:18:43.839Yeah.
00:18:44.319 -->
00:18:50.240The president's directly said that like the cyber workforce in the United States is a national asset and it's worthy of investment, right?
00:18:50.319 -->
00:19:09.759And I think in our work around cyber workforce, it's important to think through there's a lot of different capabilities that exist across the private sector, across various places in government, but there's not a clear cohesive way for putting yourself in the shoes of a small town individual, you're coming up out of maybe middle school or high school, you're like, I'm really interested in cyber.
00:19:10.000 -->
00:19:18.960How do you then go from that to then gaining those skills, gaining those capabilities, maybe going into the government, going into a private sector, going back and forth between those entities, right?
00:19:19.200 -->
00:19:26.640And so is part of the work around pillar six and the workforce really building what we call the cyber academy.
00:19:26.799 -->
00:19:30.319And Sean and others in the National Cyber Director's Office have talked about this.
00:19:30.480 -->
00:20:05.359But essentially the concept is how do you less like a brick and mortar academy, but what does that workforce pipeline look like to be able to ensure that it's local, that it's accessible, and that it works not only for talent here coming to, you know, government agencies like a CISA or an NSA or whatever, but also for those local utilities, for businesses who are also, you know, struggling to find the right people and ensure that there's a cohesive way that people can then cycle back and forth between the public and private fields without losing their security clearance, going through a bureaucratic process, right?
00:20:05.440 -->
00:20:07.119How do we make that as streamlined as possible?
00:20:07.279 -->
00:20:08.240So I'll mention three things.
00:20:08.400 -->
00:20:11.039One, the academy is sort of that overall pipeline.
00:20:11.200 -->
00:20:14.400The second is what we're calling the accelerator.
00:20:14.559 -->
00:20:23.680And that's essentially like if you have an interesting idea, how do you then go to get pre-seed money to be able to build that into a workable prototype, right?
00:20:23.839 -->
00:20:32.559Knowing that like this is something that we need to continue and accelerate that innovation and having a place that is an easy way to get that for innovative ideas.
00:20:32.720 -->
00:20:39.920And then the last piece is around what we're calling the foundry essentially of like, how do you then for prototypes that work well, how do you scale those?
00:20:40.079 -->
00:20:43.039How do you get those and help innovators get that to market?
00:20:43.359 -->
00:20:48.400So I think it's pretty exciting because it sort of approaches the workforce problem from a few different angles, right?
00:20:48.480 -->
00:21:04.000From both the accelerating innovation side, but also making it very easy and accessible for people who are either new into cyber or also want to add new skills and retool to be able to do that in a cohesive way across government and industry.
00:21:05.279 -->
00:21:07.279Anyone else just on the workforce piece?
00:21:07.519 -->
00:21:18.880So having 30,000 employees that are under the umbrella of technology at GDIT meant that we have to both blend use case experts with lifetime learners and technology expertise.
00:21:19.039 -->
00:21:32.880And so that is a constant cycle where everyone on board has to have that perspective where they have to evolve their use case knowledge or the technology knowledge or both to be able to support a large amount of people and a large amount of companies and services at the same time.
00:21:33.039 -->
00:21:41.039And so we work with academia, we work with the certifying entities to try and get an idea of like what is that pace watering down to?
00:21:41.119 -->
00:21:43.359Like, is it 18 months you have to learn something new?
00:21:43.519 -->
00:21:45.759Is it every two years that you have an expertise?
00:21:46.000 -->
00:21:59.839What are the embed practices where if you have someone that has a very amazing skill that's working on a specific program, how do you lift and shift them to promote them into a more managerial executive position so they can bring more people into that expertise.
00:22:00.079 -->
00:22:01.039Expertise, understanding.
00:22:01.119 -->
00:22:02.400And it is a full-time job.
00:22:02.559 -->
00:22:04.079It is not something that's taken lightly.
00:22:04.160 -->
00:22:14.240And while AI does really help support the lifetime learning aspects as well as really poke at all those use cases for additional implementation, it is a challenge.
00:22:14.400 -->
00:22:19.839There's candidly a gap between I just graduated high school or I just graduated college.
00:22:20.000 -->
00:22:24.000How do I get that first one through three years of experience?
00:22:24.160 -->
00:22:25.839And that is very difficult to get.
00:22:25.920 -->
00:22:45.119So we're working with academia to try and do like, hey, can people start getting clearances through agencies at say freshman year and get them in that 1819 window to where they're expedited into the workforce with a lot of understanding and almost a journeyman approach with academia so that it's not just this cold start of, okay, I've got a computer science degree.
00:22:45.279 -->
00:22:45.839How do I help?
00:22:46.000 -->
00:22:49.279I mean, there's really a challenge getting that first rung in the door.
00:22:49.359 -->
00:22:51.359And so that's where we're really focusing a lot of our energy right now.
00:22:52.079 -->
00:22:58.000I think it's even more of a challenge also because to really effectively work in this space, you need an interdisciplinary skill set.
00:22:58.240 -->
00:23:00.640You can't come in with just one background.
00:23:00.880 -->
00:23:06.799And this has been a big challenge for us, as I'm sure everyone is how do you find the people who have that background?
00:23:06.960 -->
00:23:10.240We partner with universities as well and try to reach out.
00:23:10.400 -->
00:23:15.519We haven't found programs out there yet that produce that interdisciplinary type of skill set.
00:23:15.920 -->
00:23:28.400One of the things that we've started to do is we built a summer program where we bring in students from all over the country, various different backgrounds, and really introduce them to the problem of critical infrastructure cybersecurity.
00:23:28.559 -->
00:23:39.119The idea is to get them hooked on how important of a mission this is, get the electrical engineer, the chemical engineer to talk with their cybersecurity colleague and work together.
00:23:39.359 -->
00:23:54.160And over the course of the summer, really familiarize them with these sorts of problems so that hopefully when they finish school and they go to graduate, that they'll start looking to work in this space, whether it's with us, with other organizations, with the federal government.
00:23:54.400 -->
00:23:59.039We've actually been pretty successful of once you get people hooked on the mission, they'll come.
00:23:59.200 -->
00:24:02.000We sit out in the San Francisco area region.
00:24:02.079 -->
00:24:07.119There's a lot of tech companies there who will pay obscene salaries for folks with skill sets.
00:24:07.359 -->
00:24:12.319We want people to come to us, not for that, but because they think this mission is so important to the country.
00:24:12.559 -->
00:24:15.599And so building that in while they're still in school is super important.
00:24:16.079 -->
00:24:19.920Just to add on to that, I think the investing in the Skills Academy is really important.
00:24:20.079 -->
00:24:28.319MasterCard is working with a nice framework here globally in the EU, with Asia Pacific, Latin America, how we build that out internationally.
00:24:28.480 -->
00:24:41.279I think the other piece, though, I'm a big proponent of the interdisciplinary approach to the workforce because I think it's how do we help individuals see the capabilities and the aptitudes that they have being relevant to the cyber workforce.
00:24:41.440 -->
00:24:44.319And it's beyond being a computer scientist or an engineer.
00:24:44.480 -->
00:24:51.839We need historians, we need politicians, we need social scientists, economists, psychologists, psychiatrists, all in this space.
00:24:52.000 -->
00:24:54.960And the other piece, it's another way of looking at neurodiversity.
00:24:55.119 -->
00:25:10.640I think one of the elements that has been so powerful about AI is that it is taking out some of those necessary qualities that we're investing in in engineering, but it's allowing others who may not have those aptitudes to be able to highlight the aptitudes that they do have to bring into that space.
00:25:10.880 -->
00:25:22.559If you look at neurodiversity, we're seeing companies now that have neurodiverse workforces that are winning large government contracts to build AI algorithms to support this broader perspective and understanding.
00:25:22.720 -->
00:25:38.319And so as we're thinking about building out the cyber workforce, it's not just investing in the computer scientists and the engineers that's obviously incredibly critical, but helping individuals at a young age see themselves in cyber, even if they're not going to go into that engineering perspective.
00:25:38.400 -->
00:25:51.200Because if we're truly gonna look at these issues to build solutions and to solve problems, we have to make sure that we've got the commitment from this younger generation, but also to see themselves in how their aptitudes can feed into that.
00:25:51.279 -->
00:25:56.960And I think that is a critical element for not just where we are today, but how we're building out the workforce for tomorrow.
