Evolving Cyber Threats: Insights from Former CISA Executive Brandon Wales

20 years in government, 19 at DHS. We're going to sit down today and talk about the evolution of cyber, since I can't think of any planning owners who were there as long as Brandon was in all sorts of senior roles. We'll also talk a little bit about the geopolitical environment and priorities for cyber on the homeland and how we can protect our critical infrastructure and cybersecurity assets, and also a little bit

on transition priorities. So stay tuned. Looking forward to this. Brandon, thanks so much for joining us today. No, Frank, really happy to be here. So 20 years in, I mean, you're literally just out of the gate. How does it feel? And let me first thank you for your service. In all sincerity, you've done yeoman's work and I can't think of anyone who's probably had more impact on CISA than yourself. So thank you for that. No, you're really appreciate that, Frank. It's good to hear and you

review by Secretary Chertoff into the proposed Preparedness Directorate. Then we had Katrina and Congress had pichemera and a lot of the post Katrina capabilities that were in that directorate sort of found their way back to fema. And Secretary Chertoff stood up nppd and under President Trump, CISA was created. So talk to me a little bit about sort of your trajectory because you've seen it through so many different lenses. Yeah, and I

the time. That was the focus. I mean, we're still living in the. In the aftermath of 9 11, the focus was still on how do we protect against both overseas and homegrown terrorist threats. I joined in April 2005. In July we had the Sunday, the London subway bombings of that year. And so the terrorist threat was still very, very much omnipresent. I would say that began to change with Katrina in August

of 2005. And I think the massive impacts, particularly on critical infrastructure in the Gulf coast and then some of the reverberating impacts across the country, led us to begin to look more all hazards missions. So looking at things like natural hazards and it made some of the changes that were envisioned. Under Secretary Chertoff's second stage review about combining some of the aspects of FEMA that have to do with resilience and preparedness

along with the infrastructure mission made a lot of sense. Even after those pieces went back to fema, there is still very much a focus even to today on, on all hazards risks. What do we need to do to be prepared and how do we build on the public prior partnerships that we've established and built and maintained to

ensure that we're able to address the all hazards risk environment. I had the privilege of serving in a infrastructure intelligence fusion center, really an organization that sat between the infrastructure protection mission and the Office of Intelligence Analysis at the time called the Homeland Infrastructure Threat and Risk Analysis center, hitrac. And it allowed us to kind of look across the threat space. And in the early days, the cyber mission was a small

part of that. You know, we had one or two analysts focused on communications and the IT sectors. As you could imagine. Today it's much different. Absolutely. And not to

every year in parts of our country that impact critical infrastructure. And then you have the real threats that we face from malicious actors. And those could be things that have impacted our mission from areas like school shootings and attacks against synagogues that sadly,

you know. You know, extremely sadly. But we reacted by surging our protective security advisors into the field across the country, meeting with schools, meeting with places of worship, helping them have tools to better react and prepare for and respond to those kind of

incidents should happen there so that they're able to minimize the consequences. And then frankly the cyber incidents that have dominated the news, things like SolarWinds, Microsoft Office, 365 compromises that came to light in 2021 and 2020 and 2021, Colonial Pipeline and others today, you know, Volt Typhoon compromises of US critical infrastructure. I've seen it all. And I think the one thread that I would pull throughout the entire arc of my experience

at the department has really been our relationship with industry. What is UNDERP that, what it allows us to be successful is our ability to work from government with industry in a honest and direct way on security, resilience, preparedness issues. And it really has, you know, I think a lot of people say that that's was really, you know, CIS was purpose built for that type of partnership. You know, that type of partnership

is really CIS's superpower. And I think what has been most impactful for us as an agency is being able to use those relationships and build and maintain them over time. And as the threats evolved, as the mission focus has evolved, those partnerships have been able to grow and evolve with them. And that is a unique, really around the world for how we have built and maintained those partnerships that has allowed us

to really leap ahead in some really critical areas like cybersecurity and integral. To success

prioritized. But take us back to when that hit. Yeah, it was actually an interesting

when they released a report on that. But I guess it was maybe about two weeks after that that the kind of scale of the program and the compromises really became fully known. And I got a call on a Friday night from Micro letting me know that there'd been a compromise at the department that the email of always a. Friday night, isn't it? So it was Friday night that they needed to get

on a call with us to talk about a potential compromise. And at the time our email system was maintained by the department and had to bring in the department, CIO and others. But even at that moment we were just beginning to understand the scope of this is Microsoft indicated that there were multiple federal agencies that were impacted

along with multiple private sector entities across the country. And as we unraveled this campaign by Russian intelligence services to burrow into the email networks of government and industry, we got a sense of its scale. This had been going on for about a year. Not in same in every agency they were compromised at different times in different companies. The initial compromises were against some nonprofit organizations and then some industry and

then government started to be compromised during the summer of 2020. We and again it wasn't detected until late late November, early December 2020 when it was actually detected and we jumped on it. But I think importantly we focused on it from two perspectives. There was one. What do we need to do to clean this up? What do we need to do to understand what happened? How do we remediate it how do we work with agencies to evict the adversary from their network? How to provide

guidance to industry to get to who are dealing with these same exact challenges. But internally we had a secondary focus which was what are we learning from this? That we need to begin to make changes in how we do federal cybersecurity. As a result, it exposed some real weaknesses in the overall architecture of federal cybersecurity. It highlighted

areas where we were weak and where we needed to make changes. And so when I was talking to the incoming Secretary of Homeland Security, the now Secretary Mayorkas, he said, what do we need to do to make progress here to really fix things? And I said, we need three things. One, we need some additional authorities that allow us to more persistently hunt on federal networks. Right now we don't have the ability to do that. We have to ask permission. It's lengthy and it doesn't give us

persistent access and persistent visibility, which is what we need to actually resolve this. Second, we need the entire government to be moving in the same direction. And three, we need additional resources to deploy more agents inside of networks to give us better visibility at the actual endpoint level and hosts and workstations across the government. At the time our focus was predominantly on perimeter based security sensors and those were becoming increasingly blind

thanks to encrypted network traffic. And more activity was happening on the host. And we just did not have the same level of visibility there. So it was all about how do we better have improved visibility so that we can more quickly detect activity and more quickly take action. And frankly we were able to get all three of those things done. The NDAA that passed over the President's veto in January of that

year for unrelated was vetoed for unrelated reasons. But that gave us persistent hunting authority across the federal civilian executive branch. Yes, a lot of these things were solarium ideas that we needed to get over the finish line. Second, we got a supplemental, as part of the broader American Rescue Plan act that the President was pushing, there was an additional several hundred million dollars for CISA to put into federal cybersecurity, which we

did. And third, In May of 2021, we had the President sign his executive order on CyberSecurity that required for example, agencies to give CISA object level visibility into their their networks to required both agencies and their contractors to report incidents directly to CISA and the FBI so that we can take more concerted action more quickly. And I think as a result, if I look back over the past three years, what, you

know, the changes that have been wrought based upon what we started then. Significant, I mean, night and day difference in terms of our ability to both understand what's happening on federal networks, to detect malicious activity more quickly. And I think we have seen this play out in the real world. When there was additional activity from a nation state against the State Department, they were able to detect that activity before Microsoft and

actually alerted Microsoft to activity that was happening on their own network. Again, that is thanks to a lot of work that we started three, three plus years ago. And getting those building blocks in place has allowed the federal government across the board to be far more secure, far more resilient from a cybersecurity perspective. And I think having that approach, we were looking at solar winds to not only focus on today, but

look ahead at tomorrow. What are we going to do to learn from this and real. Make real, lasting changes to how we do security here? Because that's the way in which we're going to get ahead of this. These are our, you know, from these adversaries. Thank you. That was very thoughtful and lots there to unpack. But one

can minimize the consequence, minimize the impact. And historically, and I think you had a significant role personally in a lot of this, you've had to come up with very creative ways, whether it's binding operational directives, to be able to make sure you can root out, whether it's Kaspersky or other technologies, Huawei and the like. But tell me

from a resilience perspective what you think some of the lessons learned are here. And not to add to that rich set of questions, but historically the department also has a significant role in countering terrorism and emergency preparedness and consequence management and all those sets of issues. So does that DNA help in all of that? Yeah. And, you

Turi, now a leadership role in FEMA Response and Recovery Directorate. But the reason for that is for this exact reason in that we want to make sure that there are not hard boundaries as we go from protection to response and recovery. So that we're thinking about how are we prepared for all phases of, of incident management from the very beginning. And you know, we were lucky. We never faced an actual, an

actual incident directly against our critical infrastructure. As a result from the Russian government, we saw some lower level hacktivists doing website defacements and such and some DDoS attacks at a lower level, but never a real significant attack. So what we were doing was a lot of planning and a lot of exercising. So for example, we brought together exercises working with some of our sector risk management agencies like Department of Energy and

epa. Both their cybersecurity elements, but also their emergency response elements. So do we think about how does that continuum work if there are, for example, cyber attacks that have physical implications? We want there to be as much close support and synergy as possible. Some of that has been enabled by changes that were made post Hurricane Maria, like changes to the National Response Framework, the creation of ESF 14 on Critical Infrastructure that

CISA leads. But even right before I left, we were still doing work on exercising to understand how do we better perform the kind of national security work that we need to do in responding to major potential disruptions and how will that work from. From a preparedness, protection, resilience, response, recovery, all of it needs to be closely aligned.

And that is a real strength for us being in the Department together. And it's one of the reasons that CISA Director Jen Easterly, along with FEMA Administrator Dan Criswell last year kicked off a resilience effort together called Shields Ready. It was because of this idea that these things are meshed. Resilience of critical infrastructure, resilience of communities, that these things are very much intertwined and we need to approach them in as joint

and unified a way as possible. I'm going to ask you the unfair question five

what generates success. You know, I think, you know, it has a lot of work to do and so does FEMA and so does other parts of the department. A change could distract from that work at a time when we don't necessarily have time for distractions. And so I'm much more, you know, an institutionalist. I've been in, was in the government for, you know, 20 years, in the department for 19. I'd rather

see us make kind of small, consistent improvements in what we are doing. And I think we showed how we did that in federal cybersecurity, how we've continued to build on those successes in critical infrastructure security. So that's where I think the focus should be. That's well said and nothing I could disagree with there. So good stuff. Talking

any form of conflict today, tomorrow will not have a cyber element to it. Whether it's intelligence preparation of the battlefield, whether it's phase one, phase two into activities, whether it's trying to weaken morale from a misinformation, disinformation, deception perspective, or whether it's actual cyber attacks that can have kinetic impact, or cyber attacks that can have cyber impact or kinetic attacks that can have cyber consequences. So what are your thoughts on all

that? Yeah, I mean, you know, you don't have to believe us. You can just

into conflict. But I would say critical infrastructure was the first shot fired in the Russia Ukraine conflict was cyber was the disruption of Western critical infrastructure viasat satellite constellation by Russian intelligence services to disrupt command and control in Ukraine and had implications and impacts on neighboring countries in the region. And China is even more clear about what they will do. And it's not only what they will do, but what they're doing

today. As you note, you know we have seen the Volt Typhoon actor, Chinese state sponsored actor who is compromising US critical infrastructure today so that in future conflict they can launch disruptive and destructive attacks. That is what these compromises are for. There is

no intelligence, no espionage, there's no espionage value. And you do not sit in a piece of critical infrastructure in one case for up to five years and don't do anything except make sure you continue to have access and dump the credentials every six months. Unless you are waiting for something you are not looking for intelligence gap, you know, intelligence information. You are waiting to disrupt, to destroy, to degrade those networks when

given the direction to do so. And NSA referred to it as living off the

months. So they are, they are giving off indicators that could be detected but they're not being looked for in the right way. And I think are the advisories that CISA, FBI, NSA and some of our Five Eyes partners issued over the past 18 months on the Volt Typhoon activity. Talk about the living off the land techniques, what

to look for. But we are now seeing other groups, ransomware groups and others begin to change tactics, employ more living off the land techniques because they're just harder to detect. It requires network operators to have much greater degree of visibility, much greater insight into what a baseline of their network operations look like and how to detect whether something's anomalous. So you know, it really is likely to be the wave of the

future. The Chinese have just been perfecting it over the past several years, are very good at it and they are using it for this purpose to get inside of our networks to lie in wait. And if we are in a crisis situation, the next boom, you know, again, the first strike and the next war could also be through cyber. And that pre positioning to make it happen could be happening right now.

sized entities around the country. And I think that is borne out by the actual targeting in the Volt Typhoon campaign location because they're hitting targets around the country, they're not hitting only big critical infrastructure, they're hitting small and medium sized companies. Sometimes they're in supply chains, a bigger one, sometimes they're not. So and Guam and, and some,

this gets back to the conversation earlier about resilience. We're not going to protect everything. How do we make sure that we can get back on our feet quickly. And

resilience, our ability to withstand disruptions, to operate in a degraded environment. We need to do better, period. And just to remind our viewers and listeners, still patch, still patch

reverse. They've worked really hard to improve their tradecraft, to fly below the radar. That's not true across the board, particularly some of their intelligence services that use outside hackers that tend to maybe be a little bit less stealthy. A lot of discussion around

they're doing. Volt Typhoon is as active as ever, trying to compromise U.S. critical infrastructure. We, along with Taiwan, are still target number one and two of the Chinese actors. And their teams are spending every day figuring out how do they compromise the networks they want to get into so that they're in position to execute direction from their leadership at a time and place in the future. You mentioned Taiwan, which is obviously

also their resilience. I mean, I think the thing that most, that we have been most impressed by is both the societal and the infrastructure resilience, that they are not able to only withstand cyber attacks, but really barbaric physical attacks against their, against their critical infrastructure. I mean, their energy grid is routinely hit by bombs and missiles and let alone cyber attacks. And so their ability to withstand those types of attacks and

continue to stay cohesive as a country. Taiwan will have unique challenges as an island country, you know, being able to be supported and serviced has some unique challenges, but it's also harder to conduct operations offensively there. So, you know, there'll be a little bit on both ends. I think that there, you know, everyone is looking at what lessons can be learned from Russia, Ukraine, including the, including the Taiwanese. And certainly that

has been a key part of our conversations with them. What, how do they build similar levels of resilience of their digital infrastructure, of their physical infrastructure? And that's certainly front and center, and it will likely be front and center for government and private sector actors with Taiwan. But there's urgency. Absolutely, absolutely. So looking not

looked. How hard was that to be able to initiate when you were at cisa?

And you're right, it started with our closest friends and allies. You know, first starting just within the US Government to more consistently co seal documents to make sure that there is a US government perspective on cybersecurity that we are advancing as often as possible. And so almost all of our advisories today are joint sealed across the government at a minimum. Then we look at international partners, starting with our close partners in

the five eyes and then moving on to others. I think we had one earlier, I think we had one in maybe last year that had like 19 co signatories. I think some of the work we did on AI, some of the work we've done on secure by design, obviously it's far easier to get partners when we're talking more generically about best practices on cybersecurity, on AI for critical infrastructure. A lot of countries want to join and support our efforts on that on secure by design. Huge

global support for those efforts. A little harder when you're doing attribution of a incident to a specific nation state, particularly China. But I will note that we have overcome that challenge in a number of cases and some countries are doing attribution themselves. I mean even in the last few weeks Germany has done attribution of a, of a

campaign to Chinese state sponsored actors. I think more countries are becoming willing to do this because they recognize that the evidence is so overwhelming and the, there's, there's a real demand to, to call out this type of behavior that's outside the bounds of,

of norms in cyberspace. And so my hope is that we convince more countries to be willing to do that because I think the more we are able to highlight the fact that countries like China and Russia and Iran, North Korea are doing things in cyberspace that we all disagree with, the potential exists that it will actually have an effect on their behavior. And if you had to Rackenstack and this is sort

and most important focus. Russia is fairly distracted trying to handle Ukraine. It doesn't mean that their cyber capabilities are less potent, but it does mean that they're focus is a little bit different. Self induced. Self induced. They created their own nightmare. But it also means that they've got, you know, what they do is a little bit different. You know, they are much more permissive in allowing proxies to use criminal organizations, for

example, to operate in inside of Russia without taking action. And I think that is one of the reasons, not the only one, but one of the reasons why ransomware has gotten as aggressive as it has over the past few years is because they've had a safe haven operating out of Russia. You know, you don't see the same exact thing happening in China. Our concern, there is much more actors that are directly

state sponsored, state directed. There's some moonlighting, but it's not. There's moonlighting, but not the scale of the pla. We're not talking about the scale of what there is in Russia. You know, I think Iran's capabilities continue to grow. We've seen them be fairly aggressive, particularly in the disinformation space. And these kind of hybrid attacks, even like we saw a few weeks ago with the compromise of some campaign email accounts and then

leaking, potentially leaking that information. We saw that same similar activity in 2020 where they were masquerading as proud boys. So they've got capability. They tend to focus a bit more regionally a lot more activity. If I'm in Israel, I've got a different perspective on this. But you know, we have seen semi Iranian actors launch attacks against US

water systems. Fairly low level, not very sophisticated attacks, but they're out there. So I think unfortunately the nature of our, the vulnerabilities in US critical infrastructure mean you don't

necessarily need to be the most sophisticated actor to have some negative consequence. And it's, you know, I think it's one of the reasons why CISA was pushing so hard on a lot of the secure by design because defending our way out of this one water utility at a time is not a recipe for a lot of success. We need ways to scale these solutions. And I think working with some of the major technology companies who then provide this technology to tens or hundreds of thousands of

pieces of critical infrastructure, that's the way you really can get ahead. Of some of

of initial access brokers. And then you'll have people who will license those tools and pay small bouts of the proceeds back to the entities that built them. And you'll buy accesses from another person. And so this specialization has allowed a dramatic improvement in the sophistication of the criminal ecosystem by them basically tapping into the capabilities of the most sophisticated parts of the entire community. And it is an industry, it's an illicit

operate. But the ecosystem has been demonstrated to be somewhat Self healing as one group goes away, another one. Sort of like the narcotics industry from a counter narcotics perspective.

that will be right in the middle of, of this next administration. And so the urgency of the Chinese threat to, to the US needs to be priority number one.

requiring kind of consistent reporting across critical infrastructure of cyber incidents. Really for the first time it is the final rule is supposed to be submitted by October of next year and will go live shortly thereafter. So the next administration is going to have

the finalization all the remaining policy decisions getting it through the interagency process. So that's going to be a kind of key program that needs to get over the finish line because giving us the visibility of what's happening across the US cyber ecosystem is critical. I mean we still today believe between CISA and the FBI that we were only receiving about 30 or 40% of all cyber attacks that were happening. And so

without knowing what's happening, it's really hard to make sure that we're protecting it. And third, going to the, to the comment you made is making sure that we continue to look for ways to optimize how we operationally collaborate with industry. How do we continue to strengthen that. JCDC is the mechanism by which CISA does that. It was

demonstrated its value. So I think really now it's kind of how do you optimize it? How do you make sure that industry knows how to work with it? How do you make sure people understand what it is and what it isn't? When it works well, how do you make sure we lean into that where it may not be the right mechanism for a public private partnership? How do you identify those other

areas? So I really think that those are some of the most key decisions from both the cisa, but also, frankly, from a broader US Cybersecurity perspective, those same priorities are going to be, I would argue, for the White House as well. Yeah, I

behind that because that, that's where we're going to yield great fruit. And I think that's where you've seen the inner agency yield great fruit is one team. And I

agree with that. And the companies we have in this country in cybersecurity and technology really lead the globe. And if we can bring them together with what the government understands, the government's expertise with the national partners, you know, that's really our strength. And I think that is, and that is not a partisan issue. That is, anyone will kind of look at it the same way and needs to figure out how to lean into those partnerships to achieve our overall goals. And I'd like to see it

correctly because of the strength in the systems. Let's say they won't have, won't be some issues here and there because anytime you have, you know, 150 plus million people doing something on the same day using technology, you know, there will be, there will be challenges here and there. Things won't work perfectly, nothing does. But overall there's enough

redundancy, there's enough resilience in the system for us to have confidence. I think it is a good example for a sector that even before it started focusing on cybersecurity, focused a lot on resilience. How do you make sure you continue to hold an election even after you had a hurricane wipe out all of your polling stations? And election officials do that every day. And so as we run up to the, to this election, people should continue to have confidence in it because people who have spent

the most time looking at it do. Brandon, thank you for your many years of

it is the frontline in cybersecurity. And so having an opportunity to really get in with some of the most critical companies, helping them better protect themselves, working with a great team at Sentinel One, I think it'll be a really fantastic opportunity and way for me to make sure that I'm still helping with what we started in government.