Listen Live
Trending:
FILE - This Tuesday, Aug. 4, 2009, file photo shows the United States Chamber of Commerce building in Washington. Elite cyber spies have spent months secretly exploiting SolarWinds software to peer into computer networks, putting many of the company's highest-profile customers in national governments, including the U.S. Treasury and Commerce departments, and Fortune 500 companies on high alert. (AP Photo/Manuel Balce Ceneta, File)
SolarWinds-Hack_99424
Cybersecurity

After SolarWinds breach, where do we go from here?

The federal government has a big data loss problem and a reputational black eye from the recently-discovered Russian cybersecurity attack successes.

CyberChat

The future of federal cybersecurity

Reporter's Notebook

New interagency group to show resistance to the cloud is futile

Commentary

IT modernization reform gets its own modernization project

Market Chat

Insight by Government Marketing University Episode 1: Insider Tips For Marketing to Senior Government Executives

Reporter's Notebook

DHS’ privacy officer gives the 'carwash' its seal of approval

Reporter's Notebook

OMB compels agencies to look in the mirror for their IT futures

<iframe src="https://www.podcastone.com/episodewidget?episodeID=f32e55e2-3a7e-4842-b604-ad5c5b7507dc&amp;logo=true" width="100%" height="70" frameborder="0" scrolling="no"></iframe> <em>Best listening experience is on Chrome, Firefox or Safari. Subscribe to Federal Drive’s daily audio interviews on <a href="https://itunes.apple.com/us/podcast/federal-drive-with-tom-temin/id1270799277?mt=2" target="_blank" rel="noopener noreferrer">Apple Podcasts</a> or <a href="https://www.podcastone.com/federal-drive-with-tom-temin?pid=1753589" target="_blank" rel="noopener noreferrer">PodcastOne</a>.</em> The federal government has a big data loss problem and a reputational black eye from the recently-discovered Russian cybersecurity attack successes. A longtime federal cybersecurity executive, most recently at the Department of Homeland Security, has a few ideas about what the government might be able to do next. Keith Trippie joined <a href="https://federalnewsnetwork.com/category/temin/tom-temin-federal-drive/"><em><strong>Federal Drive with Tom Temin</strong></em></a> to discuss. <em>Interview transcript:</em> <blockquote><strong>Tom Temin:</strong> Mr. Trippie, good to have you on. <strong>Keith Trippie:</strong> Hey Tom. <strong>Tom Temin:</strong> So what did the government do wrong here? I mean, all of these years of cybersecurity policies, laws, directives, executives parading through, I've watched it for 20 years -- and it's almost as if they had done nothing or am I missing something? <strong>Keith Trippie:</strong> Let's be clear, we've spent billions on this. And this is our cyber 9/11. This is the wake up call. This isn't just a wake up call for the politicians, this is a wake up call for CEOs of companies to federal agencies. We have spent so much money Tom, and one of the risk areas that we in the government, when I was there and since I've left, have not focused on is what is the supply chain risk. We've talked about it, there's been a bunch of academics that go away for three weeks, and they write a paper. But there aren't the hard and fast rules. So what are our, for lack of a better term, what is our cybersecurity doctrine for the United States? What is if somebody hits us, whether it's a nation state or criminal enterprise, or just somebody that got lucky that knows how to hack, what is our policy? Is it mutual destruction? Is it same force? Is it domino theory? Is it the strategies that we've used in kinetic conflicts? We don't have that yet. And I think in a vacuum, you get the sort of testing for what it looks like Russia was doing. They test, they see how far they can go. <strong>Tom Temin:</strong> Microsoft had an interesting reaction to the whole thing. <strong>Keith Trippie:</strong> They did. And I tell you what is fascinating about what they did is, I would argue, they went further than most companies I've seen in responding to this. Part of it was they got a taste of the medicine, right? They were impacted by it. So they were, I would argue, incentivized to take actions. And one of the things that they did was they did a bit of a takedown service, like they went after the domain, that was in theory, talking with some of the servers in these organizations, and took it out, took it over and then was able to get intelligence about who were potentially the Russians, who were they communicating with? What companies did they attack? What did they successfully get access to? So that sort of action is really one of the first steps I've seen a company take. And I'll be honest the American in me says, great, go get em Microsoft. The Homeland Security veteran in me says, well wait a minute, what are the implications if we have a private sector company edging into what most people would think that is a federal government response? So we really need to think about what is our doctrine? What is the roles that a large US corporation can take if they've been attacked? I don't think that's answered yet. So that's what's fascinating about what Microsoft fractions. <strong>Tom Temin:</strong> Well, shouldn't Homeland Security then have done this and say, alright we see now where this is coming from, just unload everything we've got on them. And we do have some offensive tools, everyone knows that. <strong>Keith Trippie:</strong> Great question. So again, we've spent billions. We had someone that used to run the cyber organization inside DHS just three weeks ago say was the most secure election that we've had. At the same time reports are coming out that this same software that was hacked was potentially used by one of the election software voting machine system companies. So I don't want to say asleep at the switch, I would want to argue that our civilian and military side meet together and figure out what is your response? And what is my responsibility to pull back US companies from doing a lot of this? And I think, whether it's on the military side, if it's overseas, or if it's conus, in the United States, Homeland and FBI, need to probably have more of a leadership role to take those actions and maybe take that server over. Why did we do Microsoft to do it? We've spent billions of dollars, we have the Einstein network, and I'm sure some of your audience considering that you talk to everyday is aware of what this is. We spend billions, what good does that do us? Nine months, this has been going on and we had a private sector company find the problem. It wasn't the US government. <strong>Tom Temin:</strong> What about the fundamental problem that no matter what billions we've spent, and what policies we've had, federal systems are still apparently inherently insecure? <strong>Keith Trippie:</strong> That's a great question. So I'd love to get into that. So a couple of things in federal contract. Part of the problem is a lot of federal agencies look at cyber as what happens at the end of the line right before the system goes live. Throw some security on there. That is wrong. The concept that the federal government hasn't adopted yet is cyber by design. That's where you embed cyber all the way over from planning and budgeting all the way through the contracts process. Just so for example, all of these federal agencies that got whacked, what is in their contracts that says that they can pay, either A, take legal action against this company, or be assigned financial penalties, there isn't. The federal government signed contracts with all of these software and hardware companies. And there's no contractual language that says, should you be sloppy, and get hacked, and it impacts us, we're able to financially penalize you, and all of the financial costs associated with the cleanup, you're going to pay that. None of our contracts do that. And federal government pays almost 50 to 100% more than what you typically get in the commercial market. And so we can't figure out a way to add that sort of cyber protection language into our contracts. That is one of the first things that I would do, because if you did that, and say, you added a clause that said, hey CISA, you offer auditing services. So you have three to six people that can come in and assess your technology. Why are we buying software from in the United States and outside the United States, that doesn't require, say, a service organization to go in and fully vet the software on a quarterly or at a minimum, an annual basis, we don't do that. We don't even require that. We offer guidelines. CISA offers it as a service, if you will, for free, but none of these companies are, A, forced to do it. And two, none of them want to do it because they don't trust the federal government to protect their data, number one. And number two, keep them from being assessed liabilities, if they are hacked. You've got these different challenges all happening at the same time that the federal government's got to step up here. I mean, this is our 9/11 in the world of cyber, they have got to take action. <strong>Tom Temin:</strong> But what you describe is a compliance and penalty approach. And that might be some of it. But what about the design of the federal systems themselves? What's been happening on that front such that they are so easily hackable the supply chain can't hold up? <strong>Keith Trippie:</strong> Well, what's interesting about this was right, this is true Trojan horse, right. So it was a company that was a company that's selling to the government for years, was hacked, in their supply chain. So the federal government, when they do a patch upgrade or an upgrade to that software, they willingly allow the malicious code into their network because it was inherently trusted, because it means you will have as a trusted company. So that problem would have been found right away by say, an Einstein if you will. But we need to be able to say that when we're running our updates and scans, we've got a scan that, when I say we the government, has got to be able to scan all of that software, before it gets added to your servers to help identify and look for things like backdoors, which is what it looks like these guys, if it is the Russians, put into the software code that they upgraded. And so we all just willingly upgraded and don't have the security check as part of that process. I would bet a year from now, every federal agency will have that on all of their software. If you think that the Russkies if they really did this, if you think that they just said, I'm going to pick some company in Austin, Texas and I'm going to hope that my strategy works and it's going to get into thousand of agencies and companies. No, they're trying that and probably been successful with other software and hardware companies. We're just all focused on this one because it's the shiny object. But if we think that these companies or these nation state actors just tried one company, no. <strong>Tom Temin:</strong> And you have probably been watching in the course of consulting with different companies since your federal career, looking at the Cybersecurity Maturity Model certification system, which is very, very much in its infancy at this point -- do you think that holds promise for the future? <strong>Keith Trippie:</strong> Yeah, I mean, I kind of look at it like this -- so when I think of that model, I look at it and say, okay when the underwriters laboratories came around years ago, no one when they plug in a lamp to the wall are they worried that it's going to burn down the house because of that UL stamp on the lamp. That's great. We don't have that in cyber, we don't have anything close to that. So I think this new model that's been developed is promising. But until it gets fully implemented and ingrained in commercial entities that build software and hardware, fully ingrained into federal agencies, but we've got people that are in IT, that have been in this game a long time and they do business a certain way. And you have the young wave of talent coming in that says, Well, why did we do it this way? And they're not thinking about cyber. They're a little bit more focused on on building apps. So what you've got here is kind of a challenge in the workforce. Are you really recruiting the right individuals to be building systems and deploying systems in the federal government? So you've got some old greybeards that are used to building it one way and the new whippersnappers that are only focused on building apps as fast as they can. You don't have a culture of cyber DNA yet in the federal workforce. So you can come up with a standard and you can talk about it, but who's implementing? Which CIO is going to divert funding from pick a mission project and put it into cyber. It's very hard for them to do, a lot of pressure from senior leadership at an organization that says you make sure that this new system that supports some regulation gets implemented. Well, it's a trade off, you can't do everything. So when usually things could sacrifice, cyber sometimes is on the chopping block early. And I think that mentality has got to change. <strong>Tom Temin:</strong> And while we have you since your federal career, you have become an author. <strong>Keith Trippie:</strong> I have. I've got a little bit of free time over here in Indonesia now. So nights and weekends, gives me something to do. And I tell you, it was a sort of a thoughtful reflection on over a decade in the federal government, kind of seeing how the way things work. I came up with this concept, and Tom it's a little out there, right. So the name of the book is called the Forgotten American. But the subtitle is called prosecuting a RICO case against the US Congress. And so the question I asked myself is, are US citizens unwitting co-conspirators laundering violations by the US Congress, kind of a big topic, a heavy topic. But if you go back 100 years, and you go forward over the past several years, we have implemented taxation that violates the Constitution. We spend outside the 18 enumerated powers. McConnell and Pelosi have just agreed on yet another $900 billion that are outside the 18 enumerated powers. And then the backside of that money laundering conversation is, how does the money come back in to the politicians? Well, through campaign finance. You and I just watched one of the craziest elections of all time, and more than $14 billion was spent on electing a bunch of politicians. Why would people spend $14 billion to elect politicians? So this book is written as a courtroom drama, it's a fictional drama. And it's fun, there's some comedy in there. But the concept that we're trying to make is or the case that I'm trying to make is, is the Congress performing money laundering and RICO violations against US citizens. And having worked inside the government for 10 years, I saw things that made me ask those questions. <strong>Tom Temin:</strong> Alright, well we'll have to find the answer to the trial and when we read the book. Keith Trippie is former DHS senior cybersecurity executive, now in private consulting. Thanks so much for joining me. <strong>Keith Trippie:</strong> Thanks and stay safe.</blockquote>
Federal Tech Talk

Big data: What's the next step?

Federal News Radio pinwheel icon
All News

Communication key in preparing for continuing resolution

Keith Trippie
All News

Keith Trippie: The good, bad and ugly of a continuing resolution

Federal News Radio pinwheel icon
All News

Federal News Countdown: Cyber sprint, Ill-informed feds

keith_trippie
All News

Keith Trippie, CEO, Trippie Group

keith_trippie
All News

Keith Trippie, Chief Executive Officer, Trippie Group

keith_trippie
All News

Keith Trippie, CEO, Trippie Group

Federal News Radio pinwheel icon
All News

Federal News Countdown: VA chief defends discipline record, Change world tour launches

Federal Acquisition, GSA
Amelia Brust/Federal News Network
Technology

An acquisition wish list for Santa

Keith_Trippie_90x120.jpg
All News

Keith Trippie, Former Director of Enterprise System Development , DHS

Federal News Radio pinwheel icon
Technology

Information to strategy: The future transformation of CIOs

Keith_Trippie_90x120.jpg
Federal Drive

Keith Trippie, Chief Executive Officer, The Trippie Group

Federal Acquisition, GSA
Amelia Brust/Federal News Network
Management

Silicon Valley on the Potomac

Federal News Radio pinwheel icon
Management

DHS unleashing data analysts to improve investments

Federal Acquisition, GSA
Amelia Brust/Federal News Network
Management

OMB reworking financial system requirements to focus on outcomes, not inputs

Federal Acquisition, GSA
Amelia Brust/Federal News Network
Federal Drive

FedRAMP begins review process of vendors' cybersecurity in the cloud