Risky Bulletin Podcast Summary: "Srsly Risky Biz: Why Two Hats Are Better Than Two Heads"

Release Date: December 19, 2024
Host: risky.biz (Patrick)
Guest: Tom Uren, Public Policy and Intelligence Editor

Introduction

In the December 19, 2024 episode of Risky Bulletin, host Patrick engages in an in-depth discussion with Tom Uren, the podcast's public policy and intelligence editor. Titled “Why Two Hats Are Better Than Two Heads,” the episode delves into the complexities of leadership roles within the U.S. cybersecurity apparatus, the implications of potential administrative changes, SEC regulations on cyber incident disclosures, and the pervasive influence of WhatsApp globally. This summary captures the essence of their conversation, highlighting key points, notable quotes, and insightful analyses.

Splitting Leadership: NSA vs. Cyber Command

Discussion Overview:
The primary focus of the episode revolves around the proposed plan by the incoming Trump administration to split the leadership roles of the National Security Agency (NSA) and Cyber Command. Patrick introduces the topic by contrasting his perspective with Tom’s detailed analysis.

Notable Points:

• Current Leadership Structure:

  • Patrick mentions the current unified leadership under General Tim Hogg, highlighting the dual responsibilities that come with overseeing both the NSA and Cyber Command.
  • Tom explains, “[00:26] B: ... Cyber Command is led at a four-star level... NSA is led by a three-star... Cyber Command, just by the nature of the Department of Defense, outranks NSA.”

• Implications of Splitting Roles:

  • Tom argues that splitting the leadership could inadvertently prioritize Cyber Command’s disruptive missions over the NSA’s intelligence-gathering operations. He states, “[02:11] B: ... NSA, the priority is to collect intelligence... Cyber Command... to do disruptive and destructive things... placing that capability at risk.”

• Decision-Making Dynamics:

  • The conversation emphasizes the benefits of having a single decision-maker who can balance long-term intelligence collection with short-term cyber operations. Tom cites General Hogg’s Senate confirmation remarks: “[03:24] B: ... a single decision maker... is best equipped to protect critical intelligence equities... while executing national priorities.”

• Challenges of a Split Structure:

  • Tom highlights the practical difficulties in creating a new architecture for deconflicting decisions between split roles, noting that it’s a complex endeavor within the existing Department of Defense framework.

Notable Quote:
[03:26] B: “A single decision maker, responsible and accountable for the mission outcomes of both organizations is best equipped to protect critical intelligence equities... while executing national priorities as directed.”

Trump Administration’s Cyber Policy Direction

Discussion Overview:
Patrick and Tom explore President Trump’s distinctive approach to cyber policy, marked by a preference for more aggressive and less cautious strategies.

Notable Points:

• Aggressive Cyber Stance:

  • Patrick remarks on Trump’s clear policy direction towards aggressive cyber operations, mentioning initiatives like NSPM 13 and the "defend forward" strategy.

• Implications for Cyber Operations:

  • Tom agrees that while more offensive cyber operations aren’t inherently bad, they must be balanced to avoid undermining long-term intelligence capabilities. “[10:05] B: ... you don’t want to do too many [offensive operations] at the expense of longer-term capabilities.”

Notable Quote:
[10:43] A: “It's interesting because it's one of the only times... an executive... has a clear policy direction in cyber. It's Trump, the cyber president.”

SEC Cyber Incident Disclosure Requirements

Discussion Overview:
The episode shifts focus to the Securities and Exchange Commission’s (SEC) new disclosure requirements for cyber incidents, examining the industry's reaction and the effectiveness of these regulations.

Notable Points:

• Initial Panic and Overreporting:

  • Patrick describes the initial reaction among Chief Information Security Officers (CISOs) who feared an onslaught of mandatory disclosures, leading to premature and excessive reporting. “[11 months later] we've seen some people over reporting...”

• SEC’s Response:

  • In response to the overreporting, the SEC intervened to curb unnecessary disclosures, yet many organizations continue to report incidents prematurely. “[12:49] B: ... very few material incidents have been reported...”

• Boilerplate Language:

  • Both speakers note the prevalence of boilerplate language in SEC filings, which often lack substantive details about the incidents. “[12:53] A: ... boilerplate language in an SEC filing... just a copy-paste.”

• Future Outlook:

  • Tom suggests a need for ongoing education and iterative rule-making to refine disclosure requirements, emphasizing that cybersecurity remains a dynamic and evolving challenge.

Notable Quote:
[13:14] B: “So when I was writing this piece, I was thinking... you continue to educate people, cyber incidents aren't going to go away anytime soon.”

The Global Influence of WhatsApp

Discussion Overview:
The conversation transitions to the pervasive role of WhatsApp in various regions, particularly in countries like Brazil and India, and its impact on communication during crises.

Notable Points:

• WhatsApp’s Reliability:

  • Patrick shares a personal anecdote about using WhatsApp for insurance claims in Brazil, underscoring the platform’s reliability even in areas with poor internet connectivity.
  • Tom elaborates on WhatsApp’s design for robustness, making it a preferred tool in conflict zones where other communication methods fail. “[17:10] B: ... it's often used as the app of choice for people like NGOs in conflict or disaster areas.”

• Dual-Edged Sword:

  • The speakers acknowledge that while WhatsApp facilitates essential communication, it also enables malicious actors to coordinate activities, highlighting its dual nature.

• Technological Legacy:

  • Tom points out that WhatsApp’s foundational principles of reliability have led to its widespread adoption across diverse and challenging environments, solidifying its role as a critical communication tool.

Notable Quote:
[17:51] A: “... it also is used by the people who are perpetrating the violence. So it's that double-edged sword...”

Conclusion and Future Outlook

As the episode wraps up, Patrick and Tom briefly touch upon personal updates and future plans. Tom announces his upcoming leave until early February 2025, allowing him to recharge before continuing his work.

Notable Points:

• Tom’s Sabbatical:

  • Patrick wishes Tom a great break and looks forward to reconvening in the next year.

• Closing Remarks:

  • The conversation ends on a positive note, appreciating the insights shared and the collaborative effort in navigating the complexities of cybersecurity policies.

Notable Quote:
[19:13] B: “Feburary something or other. Early February, not late February.”
[19:29] B: “Thanks, Pat. And you too.”

Key Takeaways

1. Unified Leadership Benefits: Maintaining a single leadership role for both NSA and Cyber Command ensures balanced decision-making, safeguarding long-term intelligence capabilities while managing immediate cyber operations.

2. Policy Direction Matters: The Trump administration’s assertive cyber policies highlight the significance of clear leadership in shaping national cybersecurity strategies, though they must be carefully balanced to avoid undermining foundational intelligence functions.

3. Regulatory Challenges: SEC’s cyber incident disclosure requirements have led to initial overreporting and the proliferation of boilerplate language, indicating a need for more nuanced and iterative regulatory frameworks.

4. Global Communication Tools: WhatsApp’s design for reliability underpins its widespread use in both benign and adversarial contexts, illustrating the profound impact of technological choices on global communication dynamics.

5. Continuous Adaptation: Cybersecurity remains an ever-evolving field requiring ongoing education, adaptable policies, and resilient infrastructure to address both current and future challenges.

This episode of Risky Bulletin offers a comprehensive exploration of pivotal issues in cybersecurity policy, reflecting on leadership structures, regulatory environments, and the broader implications of ubiquitous communication technologies. Whether you're a seasoned professional or new to the field, Patrick and Tom’s insightful dialogue provides valuable perspectives on navigating the intricate landscape of cybersecurity.