Lessons - She Protected the White House From Hackers. Here's What Companies Keep Getting Wrong. | Theresa Payton - First Female White House CIO

WEBVTT

1
00:00:00.131 --> 00:00:18.627
In this lessons episode, discover why cybersecurity threats are far more constant and far-reaching than most people realize, understand how attackers target critical infrastructure and intellectual property, explore why digital systems and quantum computing create emerging risks, and uncover why preparing for the next wave of cyber threats requires thinking several steps ahead.

2
00:00:26.247 --> 00:00:33.030
I want to ask you some more questions about some of your time in the White House because I find that fascinating.

3
00:00:33.170 --> 00:00:37.332
Obviously, you speak about what you can speak about and don't get yourself in trouble.

4
00:00:37.973 --> 00:00:41.514
But I am curious about some of the ...

5
00:00:41.754 --> 00:00:46.477
When you walk into the White House, you say the general public is not aware of ...

6
00:00:47.417 --> 00:00:49.619
really the threats that are going on.

7
00:00:49.679 --> 00:00:55.023
So what are some things that the public should know about that they're kind of oblivious to?

8
00:00:55.063 --> 00:00:57.025
Like, what is coming at the U.S.?

9
00:00:57.125 --> 00:00:59.146
Why are we in trouble?

10
00:01:00.928 --> 00:01:07.233
I think you mentioned at some point, it's not unicorns and rainbows when it comes to cybersecurity.

11
00:01:07.293 --> 00:01:08.554
And people know about...

12
00:01:09.437 --> 00:01:16.104
other nation states and they understand that, you know, China exists and Iran exists and Russia to an extent exists.

13
00:01:16.164 --> 00:01:24.854
And but maybe a little bit more clear as to what is actually happening that we have no clue or we don't pay attention to.

14
00:01:24.874 --> 00:01:27.697
Yeah, well, I mean, for example, uh.

15
00:01:31.044 --> 00:01:45.956
Cyber criminals, especially nation states, and then people who are loosely affiliated, because for the record, China, Russia, Iran, and North Korea say they don't have nation state operatives hacking into American infrastructure.

16
00:01:45.996 --> 00:01:46.776
So they say that.

17
00:01:46.836 --> 00:01:50.419
So I'm just going to give that disclaimer from them.

18
00:01:51.260 --> 00:01:51.560
But...

19
00:01:52.799 --> 00:02:00.562
What's interesting is they first primarily focused on what's referred to as the defense industrial base.

20
00:02:01.383 --> 00:02:07.145
They would go after the U.S. government, U.S. military, departments and agencies, White House.

21
00:02:07.805 --> 00:02:16.829
Then they'd go after the vendors, the big vendors that provide airplanes or weapons or anything else to the government.

22
00:02:17.329 --> 00:02:18.510
But then they realized...

23
00:02:20.201 --> 00:02:22.203
You know, they might be leaving money on the table.

24
00:02:22.303 --> 00:02:33.216
Maybe we should steal, I don't know, intellectual property, trade secrets, and then reverse engineer and manufacture our own stuff and compete with the U.S. You know, kind of even the playing field.

25
00:02:33.737 --> 00:02:35.098
We'll just steal their R&D.

26
00:02:35.138 --> 00:02:38.542
We'll skip that process and we'll just reverse engineer it and produce it here.

27
00:02:39.563 --> 00:02:42.665
And China, for one, is really good at doing that.

28
00:02:42.765 --> 00:02:51.148
And so that was something that was very eye-opening to me at that time, because that wasn't really being discussed.

29
00:02:51.869 --> 00:03:00.613
And if any companies at that time were falling victim to that, they weren't talking about it because they were worried their competitors would take advantage of it.

30
00:03:01.213 --> 00:03:05.035
So I think that's something that was a big aha moment for me.

31
00:03:06.078 --> 00:03:08.060
You know, many people may not realize this.

32
00:03:08.380 --> 00:03:16.046
I'm sure most people assume attacks against White House are constants, a constant barrage.

33
00:03:16.126 --> 00:03:17.247
And that is correct.

34
00:03:17.867 --> 00:03:27.354
But what's interesting is, is like I learned, for example, because we have WhiteHouse.gov and WhiteHouse.gov is not connected like to anything like there's not.

35
00:03:28.264 --> 00:03:33.406
like, hey, the president's secret briefing is just right behind whitehouse.gov.

36
00:03:33.426 --> 00:03:38.408
Like it's really just meant to be sort of a, here's where the executive orders are.

37
00:03:38.728 --> 00:03:46.311
And like, hey, look at President Bush's dogs, Barney and Miss Beasley, and watch Barney run around the White House.

38
00:03:46.991 --> 00:03:50.293
One of the favorite videos of my kids was Barney at Christmas time.

39
00:03:51.153 --> 00:03:54.577
watching things get decorated and running around with a little Barney cam on.

40
00:03:55.618 --> 00:04:01.925
Probably the Peyton household was the biggest consumer of Barney, but the president's dog.

41
00:04:02.446 --> 00:04:06.290
And it's really meant for that, but for whatever reason.

42
00:04:07.546 --> 00:04:26.063
If there was like a visiting head of state from another country who had a beef with somebody else or different things that were going on, we would sometimes, according to our vendors and routers and our own monitoring, be the most attacked website in the world on certain days.

43
00:04:27.557 --> 00:04:33.859
Now, if the website goes down, it's incredibly embarrassing, but the website isn't like where people get money.

44
00:04:34.539 --> 00:04:38.900
And the website's not like, it's not connected to classified systems or anything like that.

45
00:04:39.300 --> 00:04:47.683
But for whatever reason, that was a kind of a digital representation, a public face, if you will, of the White House.

46
00:04:47.703 --> 00:04:55.285
So a vitally important page to not have commandeered and defaced, which was a very popular thing at that time.

47
00:04:56.055 --> 00:05:02.101
Let's take over this department and agency's webpage and put, you know, long liver on or, you know, something like that.

48
00:05:02.541 --> 00:05:14.953
So those are, you know, some of the, a little bit of an inside ball without giving too much away of, you know, the types of things that you have to think about and deal with that shape my thinking when I work with companies and people today.

49
00:05:15.663 --> 00:05:16.304
That's interesting.

50
00:05:16.404 --> 00:05:34.517
I actually, I had a few people on that spoke about this, but Dmitry Alperovitch, who spoke about, yeah, so he spoke about some of the work that he did with Google and McAfee when he realized that nation states were actually targeting the US.

51
00:05:34.537 --> 00:05:39.561
I think that was, I can't remember the name of the, there was like an instance and I am blanking on it now.

52
00:05:39.581 --> 00:05:40.121
I didn't write it.

53
00:05:40.581 --> 00:05:41.242
Yes, that's it.

54
00:05:41.722 --> 00:05:42.443
Yeah, exactly.

55
00:05:43.483 --> 00:05:49.805
So it's just very, it's very interesting what, how constant we are bombarded.

56
00:05:50.205 --> 00:05:53.946
And I don't know if everybody really thinks about that, that it's like a daily thing.

57
00:05:53.966 --> 00:06:10.210
I think most people think that intermittently there will be attacks, not just constant attacks, which is a little bit, it's a little bit stressful when you think about, you think about your role and what you had to, what you had to, what you had to sort of handle.

58
00:06:12.292 --> 00:06:23.915
So there's always these attacks happening, whether or not they're on WhiteHouse.gov, which are obviously the ones that could be embarrassing or the ones that are more serious that are targeting actual mission-critical systems like you mentioned.

59
00:06:25.916 --> 00:06:33.038
Is there, in your mind, is there a concern, because we always speak about nuclear war and the concern about nuclear war.

60
00:06:33.158 --> 00:06:40.520
Are you just as concerned about a nuclear war version of a cyber attack or a cyber war?

61
00:06:41.506 --> 00:06:42.287
Absolutely.

62
00:06:42.307 --> 00:06:47.751
The question would be, why would they want to do it?

63
00:06:49.132 --> 00:06:55.658
So you always have to think about motive, opportunity, and then are they prepared for the repercussions?

64
00:06:56.618 --> 00:06:58.000
And when I think about...

65
00:06:59.364 --> 00:07:04.706
the mayhem that can be created by a nation state or a cyber criminal syndicate.

66
00:07:05.687 --> 00:07:07.167
It can be pretty significant.

67
00:07:07.668 --> 00:07:11.609
And it doesn't just have to be the systems that we think about.

68
00:07:11.629 --> 00:07:12.870
It can be space, too.

69
00:07:13.810 --> 00:07:18.673
A lot of our internet connectivity is dependent upon space.

70
00:07:18.753 --> 00:07:22.854
It's not just undersea cables, although those are really important to protect, too.

71
00:07:23.335 --> 00:07:23.715
So you've got

72
00:07:25.230 --> 00:07:32.944
You've got multi-layered levels of opportunity for infrastructure to be impacted.

73
00:07:33.705 --> 00:07:34.767
But at the same time...

74
00:07:36.371 --> 00:07:44.335
that's multi layers of connectivity and digital, that it would be hard to attack them all at this time.

75
00:07:44.836 --> 00:08:00.604
I'm not saying impossible, but you'd have to have a pretty well orchestrated attack to go after the undersea cables, the satellite and broadband cables to take out all internet.

76
00:08:01.885 --> 00:08:05.367
But the question is, is a nation state

77
00:08:06.642 --> 00:08:12.344
who decides to play the long game, you know, they might be thinking about opportunities like that.

78
00:08:12.944 --> 00:08:23.168
So to me, I do think about war in the sense of, you know, coming from a military family, there's land, air, and sea.

79
00:08:24.089 --> 00:08:26.350
There's the digital realm, but there's also space.

80
00:08:29.513 --> 00:08:39.037
I think that if you think about the most alarming cybersecurity opportunities, you think about internet, obviously that's connectivity.

81
00:08:39.737 --> 00:08:42.418
You think about a power grid, like you mentioned before.

82
00:08:43.459 --> 00:08:52.943
You could also think about nuclear launches as a potential, not an opportunity, but a target, excuse me.

83
00:08:53.715 --> 00:08:59.780
But obviously the systems and protections in all of these circumstances are so extensive.

84
00:09:00.220 --> 00:09:15.332
What would be something that you think going forward outside of just space would be another target for malicious actors that eventually we're going to have to pay more attention to?

85
00:09:16.413 --> 00:09:20.596
Leveraging quantum computing to break all of our encryption.

86
00:09:22.057 --> 00:09:23.358
How far are we away from that?

87
00:09:24.323 --> 00:09:24.924
It's a race.

88
00:09:26.225 --> 00:09:28.088
We're not going to know until we know who wins.

89
00:09:29.169 --> 00:09:32.013
That's very scary because they have quantum computing already.

90
00:09:32.734 --> 00:09:35.778
Yeah, it's not like commercially available yet.

91
00:09:36.198 --> 00:09:40.824
And there are really smart people working on post-quantum computing encryption.

92
00:09:40.864 --> 00:09:42.486
And for laypeople...

93
00:09:43.318 --> 00:09:46.280
Here's what I want you to take away about quantum computing.

94
00:09:46.320 --> 00:09:55.346
So today's computing, even though it looks cool and sexy like your mobile app you might be using behind the scenes, it's just ones and zeros on a computer.

95
00:09:55.386 --> 00:09:56.927
So everything's just ones and zeros.

96
00:09:57.828 --> 00:10:00.850
And today's computers, I can add more memory.

97
00:10:00.990 --> 00:10:02.311
I can add more storage.

98
00:10:02.651 --> 00:10:07.034
You can kind of tweak the programming to leverage everything that's there.

99
00:10:07.054 --> 00:10:11.738
But at the end of the day, you're flipping ones and zeros to make the program work.

100
00:10:12.847 --> 00:10:16.129
Quantum computing is stateless computing.

101
00:10:17.130 --> 00:10:20.032
So nothing is a zero or one, there's no flipping zeros and ones.

102
00:10:20.292 --> 00:10:37.064
So you can have an instruction go out and instead of being a linear set of instructions across like multiple memory, soft memory, software memory and hardware memory and disk space, et cetera, quantum computing is stateless.

103
00:10:37.124 --> 00:10:41.988
So you can process mathematical instructions

104
00:10:42.868 --> 00:10:47.272
and to handle mathematical calculations at a speed and scale we've never seen before.

105
00:10:47.832 --> 00:11:06.708
And right now there's some quantum computing, but the scale of the power that it needs for cooling, electricity, the processing power, we're still in our infancy stages for quantum computing.

106
00:11:07.457 --> 00:11:18.016
But once it becomes generally available and something that's scalable, isn't environmentally as harmful as it is today with the energy that it needs to consume...

107
00:11:19.363 --> 00:11:26.445
It's just going to basically run mathematical calculations at a speed and scale we've never seen before.

108
00:11:27.085 --> 00:11:34.287
Encryption of your passwords, of your data, of systems, is nothing but a big old math problem.

109
00:11:34.907 --> 00:11:47.750
So quantum computing with today's encryption can unlock these mathematical problems at a speed and scale we haven't seen before, which is why we need post-quantum computing encryption.

110
00:11:49.043 --> 00:11:51.429
So the question is, is who wins the battle first?

111
00:11:51.509 --> 00:11:58.565
Who figures out post-quantum computing encryption so it's ready when it comes, or who figures out

112
00:11:59.505 --> 00:12:06.170
busting encryption and getting quantum computing in the hands of evildoers before that happens.

113
00:12:06.511 --> 00:12:15.518
And then even if post-quantum computing encryption is available, it may not be simple and easy to implement.

114
00:12:15.898 --> 00:12:22.983
So how long will it take everybody to get it implemented before it's in the hands of cyber criminals to use quantum computing?

115
00:12:23.644 --> 00:12:24.865
That's the race we're under.

116
00:12:25.245 --> 00:12:25.846
And you've got...

117
00:12:26.626 --> 00:12:28.707
Really smart, good people working on this issue.

118
00:12:28.907 --> 00:12:33.830
And you've got, sadly, smart evildoers working on their set of priorities.