Security Confidential S10 E5 Shea Nangle

Manoj Tandon:
Hello everyone. Welcome to another episode of Dark Rhino Security, Security Confidential. This is your host, Manoj Tandon. Today I am joined by our honored guest, Shea Nangle. Shea is a fantastic guy, has over 25 years of experience in cybersecurity. Everything from a think tank to being a practitioner, but his background is in risk, incident response and planning, crisis management, security assessments, and developing cybersecurity programs to a very high level of maturity. We’re honored to have him and we’re grateful to get his insights. Shea, welcome to the show. Thank you so much for being here.

Shea Nangle:
Thank you. Thank you for inviting me on.

Manoj Tandon:
So, you know, we always like to start with a little bit of your background and understanding how you got into cyber, and everyone has a strange journey. So we’d love to hear yours. What was the roadway like here?

Shea Nangle:
Yeah, especially for people that have kind of been in it as long as I have, no one has a straightforward journey into it. I’ve not talked to anyone around my age that has. Certainly, when I was kind of coming up and moving into the field, there was no training for cybersecurity. There were no cybersecurity degree programs. I graduated from undergrad with a bachelor’s in religious studies.

Manoj Tandon:
Awesome. Well, that’s fantastic!

Shea Nangle:
And the closest that maybe got to cybersecurity was, if the undergrad program I did had minors, I probably would have also graduated with a minor in technical theater, but even that’s a bit of a stretch.

I didn’t really have any specific career plans. I just kind of did a number of years of whatever jobs I needed to do to pay the rent, really. Nothing at all related with the schooling that I’d done or anything like that. And then really by coincidence, I slowly started moving into more technical fields, and not necessarily initially security.

I did some freelance software development, a number of things, and then in 1999, started a software company with a good friend from college, which had venture capital backing. I diplomatically refer to it as having been economically poorly timed.

Manoj Tandon:
Okay.

Shea Nangle:
With the dot-com bubble bursting, things kind of went away very quickly and without a lot of warning. At that point, I found myself going, “Well, what am I going to do now?”

I was living in a town where a fairly large research university was, and if you’ve ever spent time in those sorts of towns, often your choice for employment is with the university. There’s maybe one other employer.

So I started working at the university and mostly in service management. I ran the campus email system for a number of years, that sort of thing. I started getting exposed to security as a field, but it wasn’t really what I was specifically doing. It would be more potentially assisting security staff in an incident response process, if it had to do with an email account takeover or something like that.

For anybody that’s been a security practitioner in really any aspect of it, what I’m about to say is going to be highly amusing, at least. I decided I was sick and tired of getting calls in the middle of the night, so I would move into security and on the defensive side.

Now, I recognize, hindsight being 20/20, that that is an absurd thought to have.

Manoj Tandon:
Okay.

Shea Nangle:
In defense of having that thought, the position I was moving into was relatively non-technical, and it was more a policy development position, really. So I did think, “Who’s going to page me at two in the morning to say we need a new policy written?” or, “Can you weigh in on this federal compliance mandate?” or something like that.

Ironically enough, the first week in that position, I was taking part of that Friday off, and at about two o’clock that afternoon, on my way out of town on vacation, someone called with an emergency policy question.

Manoj Tandon:
Okay, do you remember what the question was? Because I’m curious.

Shea Nangle:
I remember almost perfectly. The only aspect I don’t really remember is what specific unit on campus was involved. But it was a researcher that was applying for a federal grant and everything had been left to the last minute. They had to get the rest of the grant paperwork in that day, or by the next Monday or something, and the grant required a certain degree of FISMA compliance. They wanted us to weigh in on whether, in this specific research lab or whatever it was, they could meet those requirements.

Manoj Tandon:
And they couldn’t call you later in the day?

Shea Nangle:
No, no. So yeah, that was my introduction to no longer being tied to a pager. I was at the university for about five years in security. In total, I had been there for, I think, 12 or 13 years, somewhere around there.

I missed that kind of environment, so I wanted to move back into the private sector. As I mentioned before, being in a university town, you have typically, as employers, the university and one or two other companies. I ended up working for one of the other companies, running security operations for their largest North American facility.

I was there for about a year, year and a half, got things running smoothly in terms of security there, I guess, and was starting to look for the next challenge. So I ended up moving out to the DC area, working for a number of firms out there. Most of those were a very specific role: coming into a company, standing up a greenfield security operation, getting that stable and running, and then moving on to another similar-sized company, similar-maturity company, and doing that again.

I did that until 2018, and then in 2018 decided to make a shift to consulting.

Manoj Tandon:
Wow. I figured you would have made that change a long time ago.

Shea Nangle:
No, although I will say I actually did. This was on the management consulting side, not on the security consulting side. I mentioned right out of undergrad I had a number of interesting jobs. One of those was about a year doing management consulting with a Big Four firm—or, well, it was not Big Four at that point, which kind of shows my age. It was one of the accounting and advisory firms at that point.

So I decided to come full circle, except focused specifically on security. I made that shift in the fall of 2018, initially with a company called Leviathan Security Group, which is based in Seattle.

Manoj Tandon:
That’s an interesting name.

Shea Nangle:
I was there until October of last year and then moved over to Echelon Risk and Cyber, where I am now. I’m the director of advisory services at Echelon currently.

Manoj Tandon:
That’s fantastic. And you never once used your work in religious studies in this entire process.

Shea Nangle:
No. I will say, my wife and I moved to Chicago right out of undergrad. We got married my last year of college, and purely coincidentally, where we ended up living first in Chicago was maybe five or six blocks away from a Bible college. So anyone that met me that didn’t know me previously knew where I lived and found out what my major had been, and thought I was continuing religious studies. But nope, haven’t really specifically touched it since then.

Manoj Tandon:
Wow. It’s so interesting that we’ve had people from such diverse backgrounds, and you’re definitely a very diverse background. We’ve never had anyone from religious studies transfer to cyber. We had a nurse who transferred to cyber, and she was on as well. It just goes to show that if you’re really willing to apply your mind and make the necessary efforts, you can break into a field. You can definitely break into something.

Shea Nangle:
Yeah, you certainly can. And I think it’s also representative. The person that moved into it from nursing, as you referenced, is another perfect example of this. I think there is certainly great value to be had in terms of specific training and education in cybersecurity, but we need people with diverse backgrounds. It makes us as a community stronger if we can really maintain that.

Manoj Tandon:
I agree with you completely. Cyber is very much, unfortunately, often looked at by the layperson as a technology problem. And it’s very much a business problem and a people problem. Having that diversity of background, I don’t think you can have enough diversity of background to address a people problem.

People are probably one of the biggest cyber assets on the planet, and oftentimes, unfortunately, they are one of the biggest neglected assets a company has. Getting people with a different background set might help organizations become more secure by incorporating their employee pools more into the processes.

So what does your work at Echelon Risk entail? What do you guys do there?

Shea Nangle:
I have a little of everything. Looking at the company as a whole, we have a number of groups within the company. We do a good deal of offensive security work. We also have a group that focuses on defensive security and defensive engineering. We have a group for virtual CISO services, so strategic advising, those sorts of things.

And then advisory services, which is a fairly large group that I co-manage with another person on the leadership team here. Advisory services really provides, you name it. Prior to this, figuring we’d talk about something like this, I looked at what projects we have going on right now and what’s common across all of them. There’s really something unique about each project we have going on right now, which is one of the things that I love about consulting.

One of the things that really made me move back into consulting was the opportunity to work with a broad range of people on helping them solve a wide range of problems. It’s one of the things that makes me happy to get up in the morning.

Manoj Tandon:
So let me ask you this then. It is a wide range of issues, but if I was going to ask you to generalize, what are people getting wrong about cybersecurity? You look at the newspapers today, you can’t pick up, whether it’s online or in print, without seeing a story about some kind of breach almost on a daily basis. What are companies getting wrong?

Shea Nangle:
You touched on something actually that I was hoping we’d talk about a little earlier, which is the importance of recognizing and focusing on people within organizations. I really feel like as a field, we kind of started with, “Okay, we have technical solutions. If they’re all tuned properly, this will take care of all of our problems.”

Manoj Tandon:
Oh man, there’s a lot of that going on even today.

Shea Nangle:
And then there was a shift where, as a field, we were starting to acknowledge the importance of people. But for a good deal of time, it went to what I think was a really unfortunate place, and I think it really did a disservice to security as a field, which was, “Your people are the weakest link in the chain defensively.”

So the focus really was on people being the weak link, and people often doing the wrong thing, those sorts of things. I think we’re swinging in what I think is the right direction overall now, which is acknowledging the importance of people in the overall security program and starting to recognize that people can also be our greatest strength. As security practitioners, what can we do to enable them to help from a defensive point of view?

Manoj Tandon:
That’s right. And Shea, what are some of the things that you have seen that have worked in organizations that have taken on the task of bringing their people into the fold?

Shea Nangle:
I think at a high level there are two big things, and I will evangelize for both of these for the rest of my life. One is, and this is somewhat tied into what I was talking about earlier in terms of this point as a field where the refrain was, “We’re from security. We’re here to tell you no.”

I can see an exact point in my career when I was as guilty of this as anybody else, where we were very comfortable being, “We’re from security. We’re here to tell you no.” And that’s the end of the conversation. “No, you can’t run this service in this way,” and the conversation just ends at that point.

There are going to be instances where, as practitioners, we need to be able to say no. But the important piece there is the conversation can’t end with us saying no. The conversation really needs to say, “Okay, here’s what you’ve proposed doing. These are the reasons why we can’t do this process this way. But let’s talk about what you’re trying to accomplish with this process, and let’s work together in a collaborative fashion so we can come up with a solution that takes care of the issue that you’re trying to address and the pain that you may be feeling, without necessarily causing problems from a security point of view.”

I think we need, as security practitioners, to view these sorts of conversations as opportunities for collaboration more than anything else.

Manoj Tandon:
Shea, you bring up a lot of very important points. One of the things that I’ll just comment from our personal experience that we’ve seen is people won’t take no for an answer. When it comes to their job, that’s kind of fundamental. Someone’s been tasked with something to do, and they’re going to do that something with your help or without your help.

It’s just human nature because that person doesn’t want to give up their bonus, their salary increase, and all the things that they go and work hard for to make a living.

The one thing that I’ll say that a lot of our colleagues in this conversation that is so important that you’re talking about have missed is explaining the why. Most humans are reasonable. I say most, because there are a couple that are not. And there are some that are just a lost cause, but they’re really the outliers.

For the most part, people are very reasonable. “Here’s why we want you to be on VPN when you’re at Starbucks,” or, “You never tell anybody your password irrespective. No one’s going to ever ask you for your password. You never send money without doing A, B, C, and D. You verify, authenticate, and then only can you trust for that moment.”

Then they’re like, “Oh, that makes complete sense. I get it.” Whereas if we just put a mandate out there, the “thou shall not,” then they’re like, “Yeah, the hell with you, man. I don’t even know why, but this is a massive inconvenience and I’m just not going to do it.”

Shea Nangle:
Yeah, and you touch on something there additionally that is really important, which is we as security practitioners also need to do everything we can to make sure that whatever processes need to be in place to ensure appropriate levels of security are reducing the amount of inconvenience for the end user, or whoever it’s impacting.

Otherwise, people always find a way. If it horribly impacts them being able to do whatever they need to do, they’ll find a way to work around it. Then you’re often in even worse shape than you were in the beginning before you started having that conversation with them.

Manoj Tandon:
That’s right. Shadow IT survives on those kinds of things, right? It’s a fundamental reason for it to exist, and we need to be cognizant of that as security professionals.

Also, if you’re going to defend something, you’ve got to know what is of value to defend. How have companies done in trying to really understand what the real value in their organizations is? What is worth defending, as opposed to taking the approach of, “Well, everything’s worth defending,” which is an impossible goal. You can’t do it.

Shea Nangle:
Yeah. I think there’s an even more fundamental challenge that a lot of companies are struggling with that, at first glance, doesn’t necessarily appear directly security related, but I think is really fundamental to being able to do the sort of value and risk calculations that you’re talking about. And that’s asset management. If you don’t know what you have, you’re not going to be able to make decisions about, “This is more valuable. This is less valuable. Also, where are things potentially less secured than they should be?” Those sorts of things.

I think there’s generally good momentum toward starting to address some of those basic asset management issues, but it’s still a challenge. I’ve been on both sides of the table: the advisory side, where I am now, and the direct boots-on-the-ground practitioner with the company dealing with asset management challenges. It’s incredibly challenging. I think there are tools and strategies that are making it easier, but it’s still a significant challenge. But it is a really foundational item to building out any sort of security program.

Manoj Tandon:
I am so glad you said that. Now maybe someone’s going to listen. It is absolutely foundational. If you don’t understand that, then you’re not going to have much of a cybersecurity program, or one that’s not going to be as effective, I should say.

But that often leads to this conversation about compliance. I’d love to get your perspective. Is compliance a false god?

Shea Nangle:
Not entirely, which I recognize may be somewhat of a wishy-washy answer, but I have more things to say about that. Compliance in and of itself is not a bad thing. Compliance in isolation, being used as a substitute for security, is where the issue comes in.

If you’ve been in security very long at all, you’ve seen this. You’ve seen companies where the attitude is, “Okay, it’s May. The auditors are coming in next week. Let’s make sure everything’s shipshape for the auditors. They’ll be gone in two weeks, and then we don’t have to worry about it until late April next year,” that sort of thing.

Manoj Tandon:
You’re absolutely right. I’m glad you’re saying all this.

Shea Nangle:
Compliance in and of itself, as I said, is not a bad thing, and I’m not arguing against it. But it needs to be looked at as part of security, rather than necessarily a replacement for ongoing security activities. I think that’s really where the tension lies.

Manoj Tandon:
You are so spot on. It’s unfortunate, but there are a lot of people that look at compliance in place of security. Then they end up in the newspaper, and they’re like, “Well, we did our PCI compliance. We are HIPAA compliant. We have zero trust in our organization,” blah, blah, blah, but they still get breached.

It’s because they just didn’t approach the problem. If you look at having a great cybersecurity program, as you’ve described it, where you build a foundation, understand the assets first, what are you defending, build a culture, bring the people in, and then put technologies to support all this, that makes all the sense in the world. Unfortunately, it usually doesn’t work that way. But if it’s done that way, then compliance is actually a natural outcome of all that anyways.

Shea Nangle:
100%. And as you said, it’s not always an easy thing to do. Again, I’ve seen that on both sides of the table: on the advisor side, where I am now, and as a practitioner.

If you’re building a company from scratch, it can be easier to bake those things in from the beginning. If the company’s been around for a while and already has its own culture established, and then you’re trying to retrofit security into it, it can be a big challenge.

At that point, you can buy all of the technical tools that you want. But if you don’t address the process issues and the cultural issues, spending as much money as you want on technical tools is not going to address the root issues. Will they help protect you? Yes. But you’re not going to have that robust and ongoing security program that you can if you can work through these process issues and cultural issues.

I’ve been saying this recently semi-jokingly, but I’m realizing there’s more of a grain of truth to it. Having been in the field as long as I have, and being on the advisory side of things right now, I said the other night, kind of jokingly, but starting to realize I think there’s something there: all of my work has to do with security, but a lot of my work, especially recently, almost is that I’m an organizational change consultant that happens to specialize in cybersecurity.

Manoj Tandon:
Very interesting.

Shea Nangle:
Because there’s certainly technical advising that I do, and that’s an important part of what I do. But so much of what I do is, “Here’s where you are now. How can we get you to this point that you need to be at and not alienate half of your staff, or have these changes that you need to make result in a huge shadow IT organization because it’s made everyone’s lives incredibly difficult?”

Manoj Tandon:
How do you think the boards, executive teams, and companies you work with have changed their mindset on cybersecurity?

Shea Nangle:
Yes. I think there’s been a fairly fundamental change. If I look way back to when I was first starting in cybersecurity, boards weren’t really acknowledging it. It wasn’t even something they talked about.

We’re certainly seeing that more and more. As you said early on in this conversation, you can’t look at the newspaper without seeing multiple stories about breaches almost every day. So companies, at the board level, are certainly starting to recognize that cybersecurity is something that needs to be acknowledged and addressed.

Whether or not it has sufficient resources varies greatly from company to company at this point. Whether or not the appropriate governance structure is in place varies as well. Companies are acknowledging at the C-suite level and at the board level that this is a very real and ongoing issue. It’s not, “How do we protect against this specific issue and then we don’t need to think about it until the next thing comes up?”

Manoj Tandon:
That’s good to know and to hear from a professional who’s dealing with this every day. It’s not a problem that’s going away anytime soon. What we’re seeing now, Shea, with the massive changes that are happening almost on a daily basis with the cyber insurance sector, boards are going to have to get engaged, and financial departments are going to have to get engaged in solving cyber resiliency for an organization.

Shea Nangle:
Yeah. And something else you talked about, financial involvement in this, is something that I’ve been watching for a while. Some companies are certainly starting to do it, and I think we’re going to start seeing this a lot more. For a very long time within companies, financial risk and security risk were treated as silos that were very far apart within the organization, and those two silos never talked.

I think we’re starting to see a shift. I think it’s in the very early stages, but we’re starting to see a shift of companies starting to address those in a holistic fashion, which I think is going to be critical for companies moving forward. This is not going away anytime soon.

I’ve always said the good news/bad news about working in cybersecurity is: if you want to work for literally the rest of your life, you have job security. Hands down, no question, you’ve got job security. The bad news is I recognized years ago there was never a point at which I would leave my office, come home, say to my wife, “Okay, we’re done. Everything’s secure. We fixed everything.”

Manoj Tandon:
It’s very much turned into a Cold War kind of scenario, where each adversary is trying to outwit the other, whether through technology, people, propaganda, whatever the case may be. It’s now turned into that because it’s very lucrative.

At a fundamental level, it’s a Bonnie and Clyde job. Only Bonnie and Clyde had to work. They had to go out, rob a bank, run away, and fight off the cops. Now you can sit in your living room and execute the same kind of things without all that violence and fanfare happening, with the net result that you still have somebody else’s money. You acquired it illegally, but you have it.

Shea Nangle:
Yeah. I had a conversation with a co-worker earlier this week about the evolution of cybercrime, and it has turned into a very big and lucrative business, but also a very real business. We’re seeing cybercrime organizations that are set up literally like businesses. They have affiliate programs and defined roles in the lifecycle of the attack, from very early stages to laundering money and everything in between.

Manoj Tandon:
Absolutely. There’s an entire underground market there. You can acquire ransomware as a service. You can acquire penetrated companies, compromised identities. There’s so much out there. It’s crazy how there’s a little bit of an infrastructure that’s in place. And it’s lucrative.

Having you on, with all your expertise and risk, a lot of our listeners are from small and medium businesses. A lot of small businesses struggle. At a high level, can you walk us through, for their benefit, if they were going to do the ABCs of cybersecurity, what would be your guidance? What would be the broad, general, big-stroke steps they need to take?

Shea Nangle:
Yeah. We talked a little bit earlier about the first thing I’d say, which is asset management. You can’t adequately protect what you don’t know is there.

Manoj Tandon:
Let me stop you just on that one, because asset management—A lot of these smaller businesses are supply houses to much larger businesses. When they think of their asset, a lot of times it’s in terms of what they produce or what they deliver, but they themselves are an asset that’s worthy of compromise. If they’re working for a much bigger fish, they may become the conduit by which that bigger fish is attacked.

When you look at the asset, it’s not just what you’re producing. You also have to look at your place in the supply chain of that order.

Shea Nangle:
Yes. Your place in the supply chain and also the things that you have that may not be what you’re producing for a larger company, as in the example you gave. There are things that are flowing out from your company, and obviously it’s very important to track and appropriately protect those.

But there are also things that you have that aren’t the business relationship for those companies. Those are things that are enabling you to do all the work that you do to produce the widgets that you’re making.

The other piece there that I see a lot of companies get wrapped up in, especially if this is a relatively new process for them to undergo, is, “Okay, we’ve got all of our physical assets inventoried. We’ve got a good list. We’re good. We’re done.”

But they don’t think about information as an asset. That’s a very deep rabbit hole that you can go down. I’ve done a good deal of federal compliance work, and once you start getting into information classification, those sorts of things, it’s a whole other field to deal with.

If you’re a small company, you don’t necessarily need something that robust in terms of how you’re tracking and valuing your information. But you need to be able to at the very least identify, “Here are the information assets that we need to keep private. Here are the ones that are already public and we’re okay with that. Here are the ones that may not explicitly be public, but if they become public, it’s not going to cause us any harm.”

That ties into another fundamental thing that companies that are young in terms of security can often get trapped in, which is this idea that the process has to be perfect. Obviously, you want the process, let’s say for classifying information, to be as good as possible. But what you really want it to do is be as good as appropriate.

I try to avoid speaking in cliches as much as possible, but make sure that you’re not letting perfect be the enemy of good. I would much rather see a company that had an imperfect asset inventory than see a company that never produced an asset inventory because they ended up spending so much time trapped in, “How are we going to make this process perfect?”

Manoj Tandon:
That’s very sound advice. Please keep going. This is fascinating to me.

Shea Nangle:
So, asset inventory. Identifying both physical assets and information assets. Then starting to look at risk and what are the things that are going to impact your confidentiality, integrity, or availability.

Someone removes your ability to access the data, or there’s a ransomware attack, whatever it is. What are those items that you’re going to need to prioritize the most highly and protect? Be willing to spend the most resources on protecting, whether that’s technical investment or hiring people that may need to do management work around those assets.

The other thing that I think is really important, in addition to other things, is that I have a background in emergency management in a non-cyber fashion, although those two worlds have come together greatly. One thing that has really stuck with me from the background in emergency management is that so much of the emergency management work is focused on catastrophic events with a large likelihood of loss of life, and not necessarily just planning for that, but also how are your people going to be protected? What happens if life is disrupted for the people that work for your company?

We saw a lot of companies having to suddenly deal with this with the rise of COVID. You had a lot of people that didn’t traditionally work from home now working from home because offices were closed. In worst-case scenarios, you had employees that unfortunately passed away as a result. How do you deal with that in an appropriate and humane and compassionate way?

But if employees physically can’t come to the office, and they are well enough to work, what sort of structures do you need for that? They’re often in a much less corporate-controlled environment in terms of things like networks. You don’t have the degree of observability that you may if someone is working out of the office.

Then, again, I want to loop back around to what I said earlier in terms of asset management, which is get something down on paper. Don’t worry so much about whether you’ve done the most picture-perfect risk analysis possible. You want to do as good, robust, and well-thought-out work as possible, but it is a process.

Part of that, especially with companies that are relatively young in this process, is that I see great value to quantitative risk analysis and risk management. I’m not putting it down as a field or an approach. But I think for companies that are relatively young in this process, you can start with an entirely qualitative approach.

Manoj Tandon:
It’ll give them a great deal of insight into their own lay of the land. I agree with you completely. That makes sense.

Shea Nangle:
Yeah. Once that risk analysis process is done, then, depending on the organization and skill sets within your organization, the next big piece is to identify what you need in order to address the risks that you’ve identified.

Manoj Tandon:
Now is the point at which you would say start looking at enablement, whether that’s technology or process enabled. Oftentimes, it’s the reverse. It’s like, “Hey, buy this gadget.”

Shea Nangle:
Yes. It used to be, “Buy this one-U high rack-mount thing with a lot of really impressive blinking lights on it, and this will solve your problems.” I’m very much saying, don’t even worry about that until the point that we’re at now.

I’m not trying to delegitimize technical solutions by any means, but there needs to be a balance between the technology side and the people and process side. Identify what’s realistically the best solution. Depending on what it is, it may be technology, it may be on the people and process side, or most often it’s some mix of the two.

Manoj Tandon:
You’re absolutely right. The way you’ve just described doing it, you’re getting to that point with the right context and background, and now you can look at making an investment that will yield a return that is relevant to your organization and your current situation.

Shea Nangle:
Yes. That’s really something you just identified that is critical. There are very few instances in security where a cookie-cutter approach works in the long term. You can get very short-term benefit out of it, but in the long term, it’s not going to really help address the issues in a sustainable fashion.

I feel like we’ve come almost completely full circle in this conversation. Early on, we were talking about the pitfalls of compliance being looked at as a replacement for security, where we address things once a year at a point in time, and then we’re done and don’t think about it further.

The approach we’re talking about can often lead to, “If we get this box with flashing lights on it, it will address this very specific requirement.” So where did that requirement come from? How does addressing or not addressing that requirement impact your business processes? That matters more than just checking the box.

Manoj Tandon:
You’re fantastic. This was worth the price of entry into this conversation.

I know we have time for one more question, and I do want to get to it. We’re not going to get through our whole list, but that’ll leave some stuff for next time. The Biden administration has talked about hack back, and that’s a proactive side of cybersecurity. What are your opinions on it, and do you have any thoughts or anecdotes you can share?

Shea Nangle:
Yeah. I’m enough of a policy geek at heart that I’ve been spending some quality time with the National Cybersecurity Strategy that was released. On the Echelon website, we’ll be releasing my analysis and commentary on that within the next couple of weeks.

It was interesting to see what they had to say in terms of the hack-back approach. There are really two pieces there. What is the US government, intelligence agencies, and military doing? And what’s the involvement of private industry?

On the first side of things, the governmental slash military approach, those capabilities have been around and have been utilized for many years. That’s really nothing new. How much they have been used in terms of things impacting business operations has varied greatly. A lot of that has been more on the military and intelligence side.

Starting to talk about private industry potentially being involved is interesting from a policy point of view and also from a precedent point of view. The National Cybersecurity Strategy gives a few very high-level examples of the sort of involvement that private industry may have in this approach.

Manoj Tandon:
Right.

Shea Nangle:
There are a number of different ways that private industry can be involved, from more of an information gathering and reporting point of view, information sharing agreements with law enforcement agencies, that sort of thing.

We’re seeing these attacks come in, and here’s where they appear to be originating from, those sorts of things that may feed into offensive operations. I believe there was also mention in the National Cybersecurity Strategy about the potential for private industry also providing things like training for operators on the federal side.

I get a little nervous when I think about this in the context that, if you’re reading the National Cybersecurity Strategy and looking at the potential implications of this, one natural conclusion, although it’s not explicitly called for, is private industry directly performing offensive cybersecurity operations against adversaries.

Manoj Tandon:
There are a lot of implications that are going to come into play if we start doing that.

Shea Nangle:
Yeah. It ranges from: if Company X starts doing that, first of all, is this being done in cooperation with federal law enforcement or those sorts of agencies? Or are they doing this on their own?

If they’re doing this on their own, or even if they’re working with adversaries in another country, what sort of repercussions then occur for the company? Legal repercussions in the country where the adversary is? Does this then lead to heightened revenge attacks if Company X performs an offensive operation against an organization, whether domestic or foreign? Does that then mean that company is going to be targeted more?

Manoj Tandon:
We’re going to have to have you back to have a discussion on that topic because it’s a deep one. Fundamentally, attribution: how does an individual organization actually get to real attribution? That’s a rabbit hole in itself.

We’re at the hour here, and I want to give you the floor for a minute. Anything you want to plug, anything you want to make us aware of?

Shea Nangle:
I have a couple of speaking engagements coming up, but those are private, so there’s not really much point in me plugging them. I have submissions in, or queued up, for a number of conferences this summer. Ideally, next time we talk, I’d love to have some of those to plug.

I will, however, put in a plug for a presentation that one of my coworkers is giving, who was a previous guest on the show. Amy Jo Fisher will be presenting at the 2023 Central Ohio InfoSec Summit, which I believe starts April 20th. She’ll be presenting specifically on strategies for moving beyond check-the-box compliance.

I had an opportunity to see an early version of that presentation, and I think it’s going to be really valuable. I highly encourage people to attend if they can.

Manoj Tandon:
Fantastic. If you can send us the links, we can put them in the show notes as well when we push it out.

Well, Shea, it’s been a pleasure. Thank you so much for being here. I look forward to seeing you again.

Shea Nangle:
Thank you. Definitely. I’d love to be on again.

Manoj Tandon:
Take care.

Shea Nangle:
Thanks, guys.