When We Scaled the Summit: A Report from the 2019 Forum – Part One

The Executive Summit Series community kicked off OSAC week in Washington DC, by assembling at The Boeing Company who generously provided the venue for an esteemed group of senior security executives.

Over 150 attendees participated in a serious exchange of threat intelligence, cultural relevance, leadership and emerging technology.

The leadership from government and industry was compelling and inspiring, providing critical insights, dire warnings, and practical advice.

Since we were operating under Chatham House Rules, we will provide an overview of key subject areas in this blog and provide attributions to our community in a private overview as part of their attendance.

The key learnings from the summit were:

The State of the Threat

• The Supply Chain represents the foremost threat to our businesses. And the threat is not well understood by government or industry. It is complex. You may feel you have secured your campus, but the nature of the supply chain on the people, processes and technology you have implemented may have left you open to attack. And the attack has converged against a number of vectors including physical, operational and cyber security. We can no longer think in silos. We must see the whole picture: 360-degree situational awareness.

• You and your government cannot fight this alone. Government will not be with you in your time of need. They can provide intelligence, they can provide assistance, but you cannot count on them to be your primary source of security.

• Business leaders are sacrificing the long term viability of their competitive position for the short term market and revenue gains they can achieve by entering the Chinese market.

• Businesses are allowing their procurement departments to buy cheap solutions that are not secured or vetted.

• Every business has a poster outlining their core values. And yet, when it comes to their partnerships with China, those values seem to be at risk or ignored. As a result, the Chinese consider us foolish and inept.

• We need a cultural shift to occur in the mindset of our leaders and our citizens. Much like how our “safety first” mandate helped our manufacturing industry compete and become more valuable, we need a “security first” revolution in our country. Add a minute and a KPI to the leadership meeting like we did with safety: tailgating, phishing, see it/report it. Everyone is in this together

• The Lack of a Compelling Narrative results in our business leaders see no looming threat like they did in previous generations such as the threat of nuclear attack during the cold war, or the original Iranian hostage crisis.

• How can government help you today? Provide products and services such as assessments on what emerging risks are unfolding. A good example is the impact on critical infrastructure risks on your business. Take the grid for example. Drill down and you start to realize the backbone is the substations. If one goes out what happens to your business? Most of the large transformers are not made in the USA. There is an 8-month delivery cycle for new one. So now what happens?

  • Encourage collaboration with the vendor community. They need to be at the table.

• 80% of adults have a compromised identity due to the theft of the Chinese. And our kid’s identity is being captured from birth. The threat lies dormant until it needs to be used. And, yet, CEOs are asking: “What is the harm?”

  • The insider threat is onerous and is the most critical according to recent studies. This year has been a record in indictments. Over 1,000 cases are currently active.

  • Insider threat will take a more robust collaboration between HR, Legal, Operations and Security. They now must be interdependent rather than operate in silos.

  • We can no longer hire foreign talent based on resumes. Too many insider breaches have occurred. We need to hire on suitability and defensibility

• Privacy Loss: will we be overcoming the legislative issues around privacy so that we can remain competitive? The problem is the private sector does not believe we need to deploy facial recognition and/or the monitoring of our employees and citizens.

• Counter-Terrorism: we have radicalized elements in our country. And they will focus on softer targets. The intent is to disrupt our culture of openness that fuels our country.

• Universities and the brain drain: We have 140 countries actively stealing our ideas and our technology.

  • 2019 was a pivotal year. Congress is bringing in University presidents and showing them their breaches. We must make them aware of the threat landscape and give them alternative funding mechanisms that are tied to security.

  • The culture shift may be occurring, with colleges beginning to focus on national security in their curriculum. We need this more than ever; a pipeline coming into our industry.

  • Culture will shift in academia. Auburn, Penn State, George WA, centered around national security. Trying to communicate to students. We need a pipeline coming into industry. Opportunity for academia. Go into the government to see the threat first-hand. Then go into industry to apply your knowledge. Then return to government to apply lessons from business. Citizen government. National culture keepers

Our next blog will focus on the Weaponization of social media and the true story of the so-called millennial.