Cybersecurity and Cyber Defense- Dr. Paul Maurer

I'm going to go back over to the desk. The author, the illustrator, the poet of honor, and earlier today there were 50 copies in the lobby. I think there's probably less now, but if there's any left, please take one, no cost, and I'm going to tell you why you should get it. Thank you. Thank you, JC. Good afternoon. Let's try that again. Good afternoon. It's time to engage your minds in cyber security. My name is Paul Mauer. I serve as President of Montague College in Western North Carolina, and we've been teaching cyber security for the last 14 years. And Montague College has grown into a national leader in cyber security education and workforce development, we've been recognized by the White House over two administrations, and for national leadership and we've been doing contract work for the National Security Agency for a number of years now. My objective today in talking to you about cyber security is singular. I have one objective and that is to give you a tool for your country in the war against cyber crime. Cyber security is the economic and security threat of our time and we get to that in a minute but I need to start my talk by talking about... I guess I need my PowerPoint slide. Is someone getting my PowerPoint slide? I'd offer to sing and dance but you would not like either of them. Did someone say try it? No I'm not going to try it. Do they have it? They don't have it. Can't find it. Okay I'm gonna plow ahead. Time is of the essence. If you find it please please do put it up if you find it. And I'll click to the right to the right slides. Where I need to start the presentation is about a value proposition about cyber security that we developed as a college some number of years ago and it goes like this that the problem of cyber security is not principally a technical problem. The problem of cyber security is principally a human problem and therefore the solution to cyber security is not principally a technical solution. It is principally a human solution. I'm here to talk about the human factor in cyber security. If your cyber security leaders and your cyber security operators are not people of ethics and character your technology does not matter very much. In other words AI is not going to solve the problem of cyber security. If anything it only complicates the problem it does not make it easier. And by the way the wonderful staff here are handing out copies of the book if you have not yet picked one up. We did bring a hundred copies most of them are gone and we're distributing the final ones here now. Particularly if you're a member of Parliament I'd ask you to raise your hand. We have one down here over to the left in the yellow. Thank you. If you're a member of Parliament somewhere we'd like for you in particular to have this if you're a person of influence in your government we'd like for you to have a copy of this. So the value proposition in cyber is that it's principally a human problem and you must have people trained and ready in ethics and character as your cyber security leaders and cyber operators. Several years ago I received a call from someone a leader from the National Security Agency. Lynn Clark is her name and Lynn has since retired but she was the head of the cyber education area for the National Security Agency. If you're not aware of the NSA in the United States they're at the top of the pyramid in terms of securing cybercrime for the United States of America. I got a call from Lynn and she asked us if we as a college would develop a curriculum for the schools that they designate as centers of academic excellence. In other words in American higher education the only academic discipline in our university system that is governed by the federal government is cyber security. All other academic programs in American universities are governed by other peer institutions in American higher education. But the federal government of the United States recognized, thank you, there's Lynn, the federal government recognized that because this was the economic security threat, economic and security threat of our time, that they needed to take leadership. And so the NSA and Lynn Clark years ago took leadership to begin to basically accredit cyber programs in American higher education. And so Montree College, my college, became a center of academic excellence back in 2017 and today there are nearly 500 schools in American higher education that meet that standard. These are the gold standard institutions in American higher education. She requested a curriculum and after discussion we agreed on developing both a curriculum for those schools but also a book. And the reason for the book, a trade book, not an academic book, was to give to professionals in cyber security who are already there. They'd already gotten their degree, either a two-year or four-year degree in cyber security, but they too need training. My co-author is Ed Skoudis. Ed is a cyber security expert and one of the leading cyber security experts in the United States. He has helped the federal government as a forensic analyst on most of the largest breaches in the United States over the past 20 years. And he runs a company and he's also president of the SANS group, S-A-N-S. SANS is the leading provider of cyber security continuing education after students get their cyber degree from the university system, SANS does the professional training in an ongoing way. The product is the Code of Honor, Embracing Ethics in Cyber Security. And if you didn't get a copy, I'll give you a QR code at the end of the talk to get it to that you can order it from. Why the code? Well, it's really simple. We think that if you look back at history, the greatest engagements, the greatest modernizations in civilized history over the past 2,000 years have recognized the need for ethical codes of conduct. So go all the way back 2,000 years to the creation of the Hippocratic Oath. The Hippocratic Oath guides medicine at a global level. It is voluntary, it is imperfect, but it has provided guardrails and guidelines for the practice of medicine over nearly 2,000 years. Law has legal ethics. You must, at least in the United States and I think in most of civilized countries around the world, you must adhere to a code of legal ethics. These are actually not voluntary, but they're also imperfect. There are people that are bad actors, there are people who cross these lines, but nonetheless the practice of law has a code of legal ethics and every lawyer must adhere to, they must take an oath that they will abide by that code of ethics. Even warfare among civilized nations has the Geneva Conventions. The Geneva Conventions were developed in 1949, but the Geneva Conventions just war theory goes back 2,000 years. So we actually have two millennia of some of the largest engagements in modern civilization that have these codes of ethics. Any of you who are elected officials in your governments, any of you who are judges, you have taken an oath of office as you stepped into the role of authority and leadership in your country. And so we believe that cybersecurity is worthy of that. Why is that? Because we do believe that the evidence shows that cybersecurity is the economic and security threat of our time at a global level. The cost of cybercrime this year globally is estimated to be ten trillion dollars. Ten trillion with a T. Just two years ago, in 2023, the estimated cost of cybercrime was six trillion. It is growing very, very rapidly. When you take some of the other topics of this forum, and you add the estimated cost of all them together, money laundering, transnational organized crime, illicit trade and drug trafficking, terrorism, if you take all of those categories and add them all together, the estimated cost of those cumulatively is less than half of the cost of cybercrime at ten trillion dollars. How many of you use facial recognition on your on your smartphone? Raise your hand. Most of you, many of you use facial recognition. How many of you use some other two-factor authentication on your laptop or on your device? When we talk about cybersecurity being the economic and security threat of our time, you've just been an illustration of the security threat. You have two-factor authentication because of cybercrime, because of cybersecurity. You do facial recognition because of cybersecurity. We believe that the scope and size and future of cybersecurity and cybercrime warrants a code of honor, a code of ethics that every professional, that every student would abide by, that the profession of cybersecurity would adhere to a code of honor. In the end, if you do not have people in the cybersecurity profession in your country that you can trust, you don't have much. You must be able to trust the cyber professionals that you train at your universities, that you train in your corporations. And so here's the code. I'm just going to read the eight planks of the code. Number one. So it's a code I solemnly swear to uphold to the best of my ability and judgment in all my professional duties, personal practices, and future endeavors the tenets of this pledge. Number one. I will treat all people with dignity and respect. Number two. I will seek the best interests of others. Three. I will strive to recognize, take ownership, and appropriately communicate my mistakes and exercise patience toward others who make errors. Four. I will be honest and trustworthy and above reproach in all my actions and communications. Five. I will not be a lone wolf, but will instead work collaboratively with my peers and superiors. Six. I will endeavor to exercise patience, wisdom, and self-control in all situations. Seven. I will not steal and will do everything within my power to prevent theft in all its forms. And lastly, I will protect and respect the privacy of others. Now you may be thinking very quickly, as we did as we developed this code, that doesn't sound very complicated. It sounds pretty basic. It can be applied to a lot of professions and that is all very true. But nonetheless, we believe that this or some other code, and there is no other at this point in time, that some other oath or code needs to be adopted by professionals in the cybersecurity arena. So let's apply the code. So every chapter in the book, there are eight chapters of the book, and at the end of each chapter is a case scenario. An actual cybersecurity situation that Ed Skoudis has encountered over the 20 years of his leadership in the cyber world. One of them is ransomware. So in chapter one, we deal with ransomware. How many of you know what ransomware is? Raise your hand. Okay, ransomware is where cyber criminals will take control of your computer network, of your government, of your business, of your organization, of your university. They will shut down your computer systems and they will demand that you pay a ransom of money in order to get your network back. Ransomware is running rampant around the world. There's an explosion of devastating ransomware attacks on a regular basis. It is one of the most common ways that cyber criminals make money. And make no mistake, cybercrime is about extortionists making money. These are well-organized criminals, sometimes from nation-states, sometimes individual actors, but the objective and the motivation is the same in all cases. It's your money. Attackers are getting more brazen and we are seeing rises in cybercrime and ransomware at hospitals, shutting down the ability to do surgery, shutting down the ability to apply medicine, going through medical devices, and holding hospitals hostage. Schools, governments, and manufacturing are all affected. So let's apply the code. So in chapter one, this ransomware situation is a medical device engineering company. It's a small company, mid-sized company. Ransomware shuts down its production capacity and their systems are exploited through a third-party IT service provider. Most of us have third-party IT service providers. In this case, the ransomware was exploited that way. Many different medical device companies, including the competition of this company, use this particular IT provider. So let's raise the ethical questions raised by this scenario. Number one, is it reasonable to try to hack back to neutralize the attacker? Number two, does the organization have a responsibility to alert the IT provider? Three, should the organization warn its competition of the attack? Four, should the organization notify law enforcement? What if the attacker demands that they not go to law enforcement? Five, should the organization pay the ransom? I'm dialing through these questions very, very quickly, but trust me, when cyber professionals encounter these sorts of breaches, these questions are real and they have to have a way to process through, as a team, the right answers to these questions. The good, right, best way forward answering these questions, because the implications of answering these questions the wrong way are very, very great. So for this scenario, let's consider the implications of some of the principles of the code. Number one, I will treat all people with dignity and respect. Number two, I will be honest, trustworthy, and above reproach of my actions and communications. Number three, I will not be a lone wolf, but will instead work collaboratively with my peers and superiors. And lastly, I will endeavor to exercise patience, wisdom, and self-control in all situations. Another question that commonly comes up is, where did you draw these principles? How did you come up with this code? And what my co-author and I did, over the span of about six months, is we reviewed mostly ancient wisdom literature. We went to Plato, we went to Aristotle, we went to the Old and New Testaments, we went to Aquinas and Augustine. We believe that ancient literature, in particular, contains the timeless answers to ethical challenges that transcend the millennia. And so as we put together this code, we looked at those ancient principles of wisdom that we thought most applied to the to the field of cybersecurity. Is it perfect? It is not. Is it infallible? It is not. Is it a guideline? It is, and we hope it's a guideline that you can use. What I've just walked through very, very quickly is what your students at your universities who are studying cybersecurity need to be trained on. The ethical muscles that we exercise in daily life, as you make ethical decisions, are muscles that must be exercised. We must practice these things, and so that's why at the end of every chapter we have put in exercises in different cybersecurity scenarios. In conclusion, in the United States, the National Security Agency has made the teaching of ethics a requirement for its nearly 500 schools designated as Centers of Academic Excellence. The federal government has said when you want redesignations as Center of Academic Excellence by the National Security Agency, you must demonstrate that you are teaching ethics to your students. That is now a requirement of the United States federal government. We think that is wise, and they have asked us to develop the tool for that practice to happen at the university level. It's not a requirement for businesses to do this because they're outside the scope of the NSA's authority, but the Code of Honor is intended for both businesses and for students, and if you are responsible, if your government sees itself as responsible for training the next generation of cyber professionals, this is a tool that we'd encourage you to use. There's a tool that's been created for the U.S. government. It's a tool free to you to use as well, free meaning you can pick up a copy. Obviously, if you're buying copies of the book for your universities, there's a cost to that, but we believe that the free governments, the free and Republican, Democratic governments of the world are responsible, like in the United States, to educate the next generation of cyber professionals. We also think that ethics must be taught in order for there to be a trustworthy workforce. So if you'd like to see information on ordering a copy of the book, the QR code on your left takes you to the Amazon website where the book can be examined and downloaded, and the QR code to the right will take you to the website for the code itself. What we encourage for the code itself, the one on the right, is that students who are coming through university programs in the cybersecurity, download it, sign it, and frame it, and put it up on their wall in their workplace. And if you are responsible for a cyber workforce in government or in business, we encourage you to consider that same practice. Walk through the book, walk through the code, the book explains the code, and if you believe it's of value to a trustworthy ethical workforce in cybersecurity, inside your business, inside your government, we do have a tool available to you for that. And then finally, lastly, if your nation needs to grow its cyber workforce, and you don't feel like you have the educational resources in your country, either qualitatively or quantitatively, or from an accessibility standpoint, we can help you there as well. Montreal College has a fully online Bachelors of Science program in cybersecurity, and students can take individual classes, they can take an entire program online. It is designed for working professionals, and so it's flexible. It can be done on an individual student's own time. Our college, as I mentioned at the top, is a national leader in cybersecurity, and we have the stamp of approval of the NSA. And then finally, our curriculum is both technically very strong and centrally competent, as well as rooted in the ethical principles of the Code of Honor. Thank you for your time and attention, and God bless you.