WEBVTT - Broadcasting from the 9/11 Memorial & Museum Summit on Security 0:00:00.520 --> 0:00:03.000 This is Bloomberg Business Week. I'm Carol Masser and I'm 0:00:03.080 --> 0:00:05.560 Jason Kelly. We're here every day bringing you the latest 0:00:05.559 --> 0:00:09.840 news from the world's of business and finance, plus technology, politics, economics, 0:00:09.920 --> 0:00:13.520 all harnessing the power of Bloomberg Business Week reporters and editors, 0:00:13.560 --> 0:00:16.720 not to mention our hundred journalists and analysts more than 0:00:16.720 --> 0:00:19.360 a hundred and twenty countries. You can download Bloomberg Business 0:00:19.400 --> 0:00:22.240 Week on iTunes, SoundCloud, or Bloomberg dot Com. You can 0:00:22.239 --> 0:00:24.560 also listen to our radio show weekdays at two pm 0:00:24.560 --> 0:00:27.560 Eastern only on Bloomberg Radio. At the bottom of the hour, 0:00:27.680 --> 0:00:30.600 we're going to be at the Non eleven Memorial and 0:00:30.840 --> 0:00:34.240 Museum the Summit on Security. Will be joining Bloomberg Business 0:00:34.280 --> 0:00:38.720 Week show host Jason Kelly. Earlier in the day, he 0:00:38.840 --> 0:00:42.320 was speaking with Christopher Crummy, who is the executive director 0:00:42.479 --> 0:00:46.800 of x Force Command for IBM Security and Jason and 0:00:46.880 --> 0:00:50.000 Mr Crummy we're talking about on the lessons learned from 0:00:50.159 --> 0:00:55.640 recent cyber attacks in both private and public sectors. So, Chris, 0:00:55.640 --> 0:00:59.520 tell me your message to the summit today, because it 0:00:59.560 --> 0:01:02.640 was so ring on the one hand, but very realistic 0:01:02.680 --> 0:01:05.319 at the same time. So I think my message is 0:01:05.800 --> 0:01:09.160 we've experienced some of the most mature customers in the 0:01:09.160 --> 0:01:12.000 world that have come through our cyber range, that have 0:01:12.080 --> 0:01:14.840 come through our cyber truck, So we've picked up a 0:01:14.959 --> 0:01:17.960 lot of best practices and a lot of their gaps 0:01:18.000 --> 0:01:21.040 when they go through a crisis. So our message was 0:01:21.640 --> 0:01:24.880 make sure that you focus on security culture. That's a 0:01:24.959 --> 0:01:27.920 key aspect. There's so many things that you can do 0:01:28.080 --> 0:01:31.920 ahead of time, practicing your run books, making sure you 0:01:31.920 --> 0:01:34.320 have the right language as you go through these things, 0:01:34.640 --> 0:01:36.960 and then making sure that you're doing this as a 0:01:37.160 --> 0:01:40.840 full business response and not just a technical response. So 0:01:40.880 --> 0:01:42.880 these are just some of the major ideas, and one 0:01:42.920 --> 0:01:44.920 of the key themes I feel like it's coming out 0:01:44.920 --> 0:01:48.040 of all of these conversations is around sort of the 0:01:48.160 --> 0:01:51.680 human aspect to this and when people go through the range, 0:01:51.840 --> 0:01:56.000 as you say, sort of seeing them at their most vulnerable, 0:01:56.240 --> 0:01:59.680 sort of literally and figuratively. What do you take away 0:01:59.760 --> 0:02:04.400 from those experiences the the fact that cyber is all 0:02:04.440 --> 0:02:06.920 about the human I mean, I really think it is 0:02:06.960 --> 0:02:10.840 a major major focus. Um think about how a human 0:02:10.880 --> 0:02:14.600 being reacts physically to a crisis, right that the courtisol 0:02:14.680 --> 0:02:18.040 that flushes through your brain, the mistakes that they make. 0:02:18.360 --> 0:02:20.600 These are all things we want customers to be aware 0:02:20.600 --> 0:02:24.520 of that their teams are going through a crisis and 0:02:24.639 --> 0:02:27.600 need a better way to respond, So we focus on 0:02:27.600 --> 0:02:32.280 trying to make sure that they understand how much you 0:02:32.360 --> 0:02:37.000 need to address things like increasing the password size. If 0:02:37.040 --> 0:02:40.120 you do that, you make yourself more secure, but you're 0:02:40.160 --> 0:02:44.000 not addressing the human side of that. Humans are not 0:02:44.040 --> 0:02:47.600 designed to remember fifteen character passwords. So if you're going 0:02:47.639 --> 0:02:49.519 to be more secure, you just got to make sure 0:02:49.560 --> 0:02:52.600 that you make it frictionless for your in users to 0:02:52.639 --> 0:02:54.919 do the right thing, and to also explain to them 0:02:55.320 --> 0:02:59.720 why you have to change your password every ninety days. Right. 0:02:59.760 --> 0:03:03.160 There's there's great stories of very famous people who had 0:03:03.200 --> 0:03:06.120 their Twitter accounts taken over because they use the same 0:03:06.120 --> 0:03:09.120 password in my Space and the bad guy's got access 0:03:09.120 --> 0:03:12.120 to that. So it's it's taking advantage and giving them 0:03:12.160 --> 0:03:15.160 an idea of what they're up against and explaining the 0:03:15.280 --> 0:03:17.160 why you need to make these changes that I think 0:03:17.200 --> 0:03:21.080 help the overall culture and the overall safety of the company. 0:03:21.320 --> 0:03:23.480 So take me inside the range. What does it look like, 0:03:23.520 --> 0:03:25.680 what does it feel like for people who are going 0:03:25.720 --> 0:03:28.800 through it? So the range is designed to prepare for 0:03:28.840 --> 0:03:32.160 your worst day, so we will work with the customer 0:03:32.280 --> 0:03:35.320 and figure out the industry, the key aspects of stuff. 0:03:36.040 --> 0:03:37.800 You walk in there and now you're part of a 0:03:37.800 --> 0:03:41.280 fake company and we're going to literally put you through 0:03:41.320 --> 0:03:44.520 your worst day. We have concepts around media, we have 0:03:44.640 --> 0:03:48.960 concepts around regulators, we have concepts around your training, and 0:03:49.080 --> 0:03:52.040 how does this all come to get together on your 0:03:52.080 --> 0:03:55.880 worst day? Who's in charge? What's my next move? What's 0:03:55.920 --> 0:04:00.280 my priority? What is the company's north star? Is is 0:04:00.320 --> 0:04:03.480 it the customer that's my north star? Like, you don't 0:04:03.560 --> 0:04:07.080 find out where you are on your training or other 0:04:07.160 --> 0:04:11.800 aspects until it's underload. It's really important to realize that 0:04:12.000 --> 0:04:14.360 we've get a lot of run books and they're about 0:04:14.360 --> 0:04:16.880 an eight in quality, but when you put them underload, 0:04:16.880 --> 0:04:20.960 there about a three. Because they don't train like you 0:04:21.040 --> 0:04:24.120 fight and fight like you train. So we we they 0:04:24.120 --> 0:04:26.880 discover a lot of gaps. They want to as soon 0:04:26.880 --> 0:04:28.440 as they're done, they want to go right back home 0:04:29.040 --> 0:04:30.680 to the office and they're gonna They've got an action 0:04:30.720 --> 0:04:33.000 list of things that are gonna implement right away, so 0:04:33.040 --> 0:04:35.520 they get a good feel of you know what, you're 0:04:35.600 --> 0:04:38.760 validating what we're doing well. But you've also opened our 0:04:38.800 --> 0:04:42.760 eyes to things we haven't seen before, blind spots. The 0:04:43.360 --> 0:04:49.400 use of confirmation bias under a crisis is crippling. They 0:04:49.480 --> 0:04:52.320 assume that's the insider threat, and it wasn't the whole time, 0:04:52.920 --> 0:04:55.839 but they cannot let it go. So they trained to 0:04:56.000 --> 0:05:00.480 understand the physical reactions, the human reaction, the process reaction. 0:05:01.000 --> 0:05:03.039 Who do I call next, what do I need to 0:05:03.080 --> 0:05:06.360 do in the next twenty four hours, what are my priorities? 0:05:06.520 --> 0:05:08.120 And you don't do that until you train for it. 0:05:08.640 --> 0:05:11.560 And so in here in twenty nineteen, I feel like 0:05:11.600 --> 0:05:17.720 we're having this near existential debate around privacy versus freedom 0:05:17.760 --> 0:05:21.920 of access, freedom of movement. The smartphone obviously has changed 0:05:21.960 --> 0:05:26.039 everything it feels like in our daily lives, both personally 0:05:26.120 --> 0:05:30.000 and professionally. How do you sort of come down on that? 0:05:30.040 --> 0:05:33.880 How do you help people understand that balance? So when 0:05:33.960 --> 0:05:37.680 you think about the most mature customers, they always want 0:05:37.680 --> 0:05:42.160 to train for you as an individual at home first, 0:05:42.720 --> 0:05:44.719 if I make you a better spouse, a better mom 0:05:44.800 --> 0:05:47.360 or dad, uh, dealing with your kids and your cell 0:05:47.360 --> 0:05:50.760 phones at home, that awareness, that ability to understand comes 0:05:50.760 --> 0:05:53.560 into work and that is a great way to do it. 0:05:53.640 --> 0:05:56.440 So so if you make it personal for people, they 0:05:56.520 --> 0:06:00.600 better understand those things. There is. Cyber is one thousand 0:06:00.600 --> 0:06:04.520 percent about risk, and there's a balance of Someone said 0:06:04.520 --> 0:06:08.320 today there's no such thing as perfect security. It is 0:06:08.360 --> 0:06:12.200 how do I lower the risk? That is Christopher Crummy. 0:06:12.200 --> 0:06:15.760 He is executive director of x Force Command that IBM 0:06:15.839 --> 0:06:20.240 Security talking there with Bloomberg's Jason Kelly from the nine 0:06:20.240 --> 0:06:24.520 eleven Memorial and Museum Summit on Security. You're listening to 0:06:24.640 --> 0:06:28.520 Bloomberg Business Week with Carol Masser and Jason Kelly on 0:06:28.760 --> 0:06:35.719 Bloomberg Radio. Well, and welcome everybody to this very special 0:06:35.880 --> 0:06:40.920 edition Bloomberg Business Week. I'm Jason Kelly downtown Manhattan here 0:06:40.960 --> 0:06:44.880 at the nine eleven Memorial and Museum. And Alice Greenwald, 0:06:45.440 --> 0:06:50.960 you run this whole thing here with the cast of thousands, 0:06:51.279 --> 0:06:56.200 fair enough, and Frank Physignano, president and CEO of By Serve, 0:06:57.080 --> 0:07:01.279 also a board member here at nine eleven. Alice, this 0:07:01.279 --> 0:07:03.160 is a big day, the second year you've done this. 0:07:04.600 --> 0:07:08.120 Tell us the purpose, Well, the purpose of the Summit 0:07:08.160 --> 0:07:11.760 on Security is to bring together individuals across sectors, so 0:07:11.880 --> 0:07:15.120 from the private side, the public side, government, corporate, so 0:07:15.240 --> 0:07:19.480 that there can be a joint conversation about preparedness, the 0:07:19.560 --> 0:07:23.440 nature of the threats, how you recover from events, and 0:07:23.800 --> 0:07:26.320 really from our point of view, it's a perfect example 0:07:26.440 --> 0:07:29.160 of the continuing impact of nine eleven, the things that 0:07:29.200 --> 0:07:31.800 we have to pay attention to as a result of 0:07:31.880 --> 0:07:35.360 the world we now live in. And so what has 0:07:35.400 --> 0:07:37.840 really stood out to you today, the second year you're 0:07:37.840 --> 0:07:39.240 doing this, We were talking a little bit about this 0:07:39.280 --> 0:07:41.240 before we came on here. Let's really jumped out at 0:07:41.240 --> 0:07:43.920 you theme wise this year, So the theme has been 0:07:43.920 --> 0:07:48.200 primarily about cybersecurity, which is obviously a threat at every 0:07:48.280 --> 0:07:51.680 level of our lives. UM. But what has struck me 0:07:51.800 --> 0:07:55.400 most is that the conversation has bridged both the cognitive 0:07:55.880 --> 0:07:58.080 practical what you do, how do you deal with it? 0:07:58.080 --> 0:08:00.760 What are the ways you know you've got a problem, 0:08:00.760 --> 0:08:03.080 how who do you partner with? But also the heart. 0:08:03.240 --> 0:08:05.480 So it's been hid and heart and there's been a 0:08:05.480 --> 0:08:10.120 lot of conversation today, including Frank kicking it off this morning, UM, 0:08:10.160 --> 0:08:13.400 that has been about the motivation for this awareness of 0:08:13.440 --> 0:08:17.320 the need for security coming out of personal nine eleven experiences. Well, 0:08:17.360 --> 0:08:19.400 and Frank pick up on that, because you did. You 0:08:19.480 --> 0:08:22.200 kicked it off so beautifully this morning on a very 0:08:22.280 --> 0:08:26.239 personal note, your own remembrances of nine eleven, but also 0:08:26.280 --> 0:08:29.520 talking about everything that's happened in between and the work 0:08:29.560 --> 0:08:32.719 that you're doing now, both professionally in your day job 0:08:32.760 --> 0:08:35.720 as well as your work here, helps set the tone 0:08:36.040 --> 0:08:37.880 in that regard for us. Well, I think it's about 0:08:37.880 --> 0:08:42.720 preparedness and advance, about partnership. If you were in the 0:08:42.840 --> 0:08:48.400 Sacred Place on nine twelve, Uh, in that year, you 0:08:48.520 --> 0:08:52.200 have seen partnership at its highest possible level, people all 0:08:52.240 --> 0:08:56.640 across America coming together, uh to bond. And when you 0:08:56.720 --> 0:09:01.520 take that thought and say we can protect ourselves by sharing, 0:09:01.640 --> 0:09:05.120 by partnering, we will be much better prepared. And that 0:09:05.160 --> 0:09:09.200 means government, that means businesses, that's every form of law 0:09:09.400 --> 0:09:13.840 enforcement and sharing because protection is the number one thing 0:09:14.320 --> 0:09:16.880 for us to work on in preparedness and in the 0:09:16.920 --> 0:09:20.720 event of any disaster. And I think, uh, it was 0:09:20.760 --> 0:09:25.239 always on everyone's mind, but now it's completely in the forefront, 0:09:25.280 --> 0:09:27.880 and the partnerships are very high and very strong. Well. 0:09:27.880 --> 0:09:30.640 And it's interesting, Frank too, because it feels like a 0:09:30.679 --> 0:09:34.480 lot of that sharing has been demonstrated in the financial 0:09:34.520 --> 0:09:38.800 services industry. You've been a long time in that business, 0:09:38.840 --> 0:09:41.280 it's a very competitive business. We all know that, and 0:09:41.360 --> 0:09:44.560 yet financial Services has been able to share around this 0:09:44.679 --> 0:09:47.199 in a way that maybe is unexpected. Why do you 0:09:47.240 --> 0:09:49.640 think that is Well, I think everybody recognized that the 0:09:49.720 --> 0:09:53.439 greater good is the most important thing. It was our 0:09:53.520 --> 0:09:58.040 our financial markets, our stock market that wasn't operating during 0:09:58.120 --> 0:10:01.719 that disaster, and that's good for no one except the 0:10:01.760 --> 0:10:05.040 bad guys. And we all united to bring it together 0:10:05.120 --> 0:10:07.760 to get it back up and running. And everybody understands 0:10:07.760 --> 0:10:10.640 help each other. When we were walking on those streets 0:10:10.720 --> 0:10:14.600 Greenwich Street, everyone was created equal and everyone believed that 0:10:14.640 --> 0:10:17.319 they had to help each other. And today in war Manhattan, 0:10:17.679 --> 0:10:21.439 when you come to this fabulous, fabulous sacred place, the 0:10:21.520 --> 0:10:24.640 Nino of a memorial and museum, all you see is teamwork, 0:10:24.720 --> 0:10:28.120 partnership and people caring for each other. And Alice, it 0:10:28.200 --> 0:10:30.480 was interesting. You know. Admiral Mullin, we're gonna hear from 0:10:30.559 --> 0:10:33.160 him a little bit later on in the show. He 0:10:33.240 --> 0:10:37.400 was here in part to help unveil a new exhibit 0:10:37.480 --> 0:10:39.959 that's going to be open to the public this weekend 0:10:40.080 --> 0:10:45.400 about the hunt for Bin Ladden ultimately uh successful after 0:10:45.480 --> 0:10:47.720 many many years. Tell us a little bit about that 0:10:47.760 --> 0:10:51.560 exhibit absolutely and thanks for asking. Revealed is opening on Friday, 0:10:51.600 --> 0:10:54.320 November fift It's called Revealed, the Hunt for Bin Laden 0:10:54.920 --> 0:10:57.080 and it tells the story we all think we know, 0:10:57.760 --> 0:10:59.600 we all know the ending of the story. We know 0:11:00.000 --> 0:11:02.680 where it leads. What we don't know is how we 0:11:02.760 --> 0:11:06.840 got there. And this is really a phenomenal telling of 0:11:06.880 --> 0:11:11.800 the work. It took, the coordination across law enforcement, military, UM, 0:11:12.400 --> 0:11:16.959 you know, intelligence agencies, domestic and international. It was a 0:11:17.040 --> 0:11:20.920 hugely coordinated effort that but longer than a decade, so 0:11:21.000 --> 0:11:27.040 before nine eleven until May um and that level of coordination, 0:11:27.080 --> 0:11:28.960 what it took. And as you go through this exhibit, 0:11:29.440 --> 0:11:32.440 it unfolds like a mystery. Even though you know where 0:11:32.480 --> 0:11:36.320 it will lead, you are riveted because each moment is 0:11:36.559 --> 0:11:40.600 peeling away the layers of UM trying to find this man. 0:11:41.240 --> 0:11:43.480 What the leads were, some of the leads and nowhere, 0:11:43.559 --> 0:11:45.840 and some of the leads actually led to a bottom 0:11:45.920 --> 0:11:49.840 us well, And as Alice says, Frank, so timely, you know, 0:11:49.920 --> 0:11:54.080 given the capture of all Bughdatti as well, uh most recently, 0:11:54.679 --> 0:11:56.600 it reminds us the world is not a safe place 0:11:57.360 --> 0:12:00.839 in many ways. And I wonder how do you think 0:12:00.880 --> 0:12:06.800 about that from your business perspective? Because you have responsibility 0:12:06.880 --> 0:12:10.760 for so many transactions, so much money moving through the system. 0:12:10.800 --> 0:12:12.080 How do you think about it today? Well, you know, 0:12:12.200 --> 0:12:15.199 most of my career I worried about this, and uh, 0:12:15.360 --> 0:12:18.320 it's top of mind. It's top of mind for every CEO, 0:12:18.520 --> 0:12:23.880 for every senior executive, protecting, protecting your people, protecting the 0:12:23.920 --> 0:12:28.680 assets of your clients, protecting your shareholders value. And so 0:12:28.800 --> 0:12:31.679 it is the number one item. And you make sure 0:12:31.760 --> 0:12:35.800 your defense is as strong as humanly possible. Um. And 0:12:35.840 --> 0:12:38.880 it's never good enough. Every day you come in and say, 0:12:38.960 --> 0:12:43.000 never good enough, and you can never feel safe enough. 0:12:43.679 --> 0:12:47.120 So um, it's a constant drum beat. It's ah, it's 0:12:47.240 --> 0:12:51.480 you build uh an organization around it. You make sure 0:12:51.520 --> 0:12:57.440 you have great organizational awareness. And then connectivity of organizations matter. 0:12:57.520 --> 0:13:00.760 You know, any piece of data and information and that 0:13:00.920 --> 0:13:04.600 may seem trivial may actually protect you very very much. 0:13:04.880 --> 0:13:08.280 And having all partners work together is critically important. So 0:13:08.320 --> 0:13:11.400 speaking of connectivity, we are blueberg. After all, the last 0:13:11.400 --> 0:13:13.839 time we talked, you had not done the big deal. 0:13:13.960 --> 0:13:16.800 I believe that you have now done. How's that going? 0:13:16.880 --> 0:13:19.440 It's going great, it's going great. You know, we have 0:13:19.559 --> 0:13:24.440 an unbelievable company. Fi Serve is U is alive and 0:13:24.559 --> 0:13:28.360 well and strong. Uh. You know Fi served before Verse 0:13:28.480 --> 0:13:32.960 Data was this great brand and great economic machine. First 0:13:33.040 --> 0:13:36.480 Data had a lot of fabulous assets in it. We're 0:13:36.600 --> 0:13:39.280 fortunate that we could put them together and build what 0:13:39.320 --> 0:13:42.560 we think is the best fintech in the world. Well, Alice, 0:13:42.600 --> 0:13:45.319 it's a beautiful day here in Lower Manhattan. What's the 0:13:45.320 --> 0:13:49.360 biggest priority for you going forward? Um? You know, the 0:13:49.360 --> 0:13:52.679 biggest priority is thinking about the next generation. You know, 0:13:52.720 --> 0:13:55.439 we are coming up on the twentieth anniversary of nine eleven, 0:13:55.559 --> 0:13:58.440 hard as that is to believe, and twenty years is 0:13:58.520 --> 0:14:03.040 a generation conventionally speaking, And already we are seeing people 0:14:03.120 --> 0:14:05.840 who are in college with no memory of nine eleven, 0:14:06.240 --> 0:14:10.319 Young professionals coming out of law enforcement training from the academies, 0:14:10.800 --> 0:14:14.680 no memory of that day. And yet they are moving 0:14:14.679 --> 0:14:18.960 into careers like security, moving into careers in the financial industry. 0:14:19.160 --> 0:14:21.880 And we believe that the world that they are inheriting 0:14:22.680 --> 0:14:26.160 has been conditioned by the events and repercussions of this event. 0:14:26.480 --> 0:14:28.720 So we are here to help them connect those dots. 0:14:28.720 --> 0:14:30.440 And I think that's going to be our most important 0:14:30.440 --> 0:14:34.280 purpose going forward. Alice Greenwald, Frank Dosignano, thank you so much. 0:14:34.320 --> 0:14:37.720 We should also mention, of course, at Michael Bloomberg, the 0:14:37.720 --> 0:14:41.200 founder and majority owner of Bloomberg LP, also serves as 0:14:41.240 --> 0:14:44.960 the chairman of the Non eleven Memorials and Museum. Thank 0:14:45.000 --> 0:14:48.080 you both so much. It's been a really interesting and 0:14:48.120 --> 0:14:51.240 powerful day here at the nine eleven Memorial and Museum. 0:14:51.280 --> 0:14:53.440 Earlier in the day, I got to catch up with 0:14:53.560 --> 0:14:57.560 Jen Easterly. She's managing director over at Morgan. Stanley worked 0:14:57.560 --> 0:15:00.600 in Army intelligence for many years the n s A 0:15:00.880 --> 0:15:03.080 in the White House. She's a graduate of West Point 0:15:03.120 --> 0:15:06.760 of former instructor there, and she talked about her job 0:15:07.280 --> 0:15:11.520 on Wall Street and what she's doing encountering all sorts 0:15:12.120 --> 0:15:16.000 of new threats. Take a listen. Obviously looking at the 0:15:16.040 --> 0:15:19.240 threat landscape now, we still have the physical threats from 0:15:19.240 --> 0:15:22.360 groups like ISIS and al Qaeda, but now dealing with 0:15:22.680 --> 0:15:26.560 cyber significant cyber threats from nation states, from organized criminal 0:15:26.560 --> 0:15:29.960 group threats from the weaponization of data for things like 0:15:30.040 --> 0:15:34.440 disinformation that really corrodes our trust and people and institutions, 0:15:34.840 --> 0:15:37.080 and so things like that that we have to worry about, 0:15:37.480 --> 0:15:41.640 both for attacks against critical infrastructure, but also attacks against 0:15:41.640 --> 0:15:44.680 things like things like reputation are hugely important, right, And 0:15:44.720 --> 0:15:46.840 I'm so glad you brought that up, because at the 0:15:46.880 --> 0:15:50.600 core of that conversation, it feels like increasingly the conversations 0:15:50.600 --> 0:15:54.480 that we're having are much more holistic and focus on 0:15:54.600 --> 0:15:58.080 people and not just the the bits and bites and 0:15:58.080 --> 0:16:01.160 and the really wonky technicals off that you understand and 0:16:01.200 --> 0:16:05.160 I don't, but I do understand the concept of bad actors, 0:16:05.640 --> 0:16:09.400 and so how do you combat that instan You know, 0:16:09.480 --> 0:16:12.440 I often say that cyber security is not about computers, 0:16:12.480 --> 0:16:16.560 and it's not about code. It's about people and frankly, 0:16:16.680 --> 0:16:19.400 what we what I think we really need to worry about. Obviously, 0:16:20.040 --> 0:16:22.320 you know, there are significant cyber threats, and so we've 0:16:22.320 --> 0:16:25.800 done a lot across the whole banking sector to protect 0:16:26.120 --> 0:16:29.360 our assets and and our clients. But at the end 0:16:29.360 --> 0:16:31.160 of the day, it's attacks against what I think is 0:16:31.200 --> 0:16:34.960 our most critical infrastructure are cognitive infrastructure, the way that 0:16:35.000 --> 0:16:38.640 we make good decisions and our judgment, and that's being 0:16:38.760 --> 0:16:43.440 impacted by a lot of these disinformation and malinformation campaigns 0:16:43.440 --> 0:16:46.320 through the weaponization of data. So you're right, I think 0:16:46.320 --> 0:16:49.520 we need to to look at the threat landscape very holistically, 0:16:49.600 --> 0:16:52.040 from the physical threats to the cyber threats to the 0:16:52.080 --> 0:16:56.920 threats against facts. Frankly well, and it sounds like one 0:16:56.920 --> 0:17:00.320 of the ways you combat that is with better people 0:17:00.400 --> 0:17:02.280 in some ways and training them in a different way. 0:17:02.320 --> 0:17:06.080 Tell me about that human capital is really critical here. 0:17:06.280 --> 0:17:09.200 You know, you need people, you need process, you need 0:17:09.240 --> 0:17:12.119 technology to be successful in the cybersecurity world. That I 0:17:12.160 --> 0:17:15.320 think talent is the most important. You know, researchers estimate 0:17:15.359 --> 0:17:17.840 that by the year there will be three point five 0:17:17.920 --> 0:17:21.840 million unfilled cybersecurity jobs around the world, and you could 0:17:21.920 --> 0:17:24.960 argue were already in negative percent unemployment, so more jobs 0:17:24.960 --> 0:17:28.320 out there than people. So there's much we have to 0:17:28.359 --> 0:17:32.040 do to educate, you know, clearly our employees and our 0:17:32.080 --> 0:17:34.600 clients about the threats that are out there in cyberspace. 0:17:34.640 --> 0:17:36.399 But I really think we need to look at this 0:17:36.720 --> 0:17:39.639 problem much more comprehensively. We have to we have to 0:17:39.680 --> 0:17:41.720 start with the youngest among us. One of the things 0:17:41.720 --> 0:17:44.240 that I've been working on is part of a new 0:17:44.280 --> 0:17:47.879 nonprofit called Cybernation, and the idea is to bring together 0:17:47.920 --> 0:17:51.040 the world cyber and technology experts with the world's greatest 0:17:51.080 --> 0:17:55.359 storytellers to demystify cyber so to inspire, to inform, to 0:17:55.560 --> 0:17:59.520 educate from K through gray, from your digital natives to 0:17:59.520 --> 0:18:03.080 your digital immigrants, because we all need to understand what's 0:18:03.119 --> 0:18:06.600 the technology, what are the threats, are their laws and cyberspaces, 0:18:06.600 --> 0:18:09.879 their privacy online, and then ultimately what it means to 0:18:09.960 --> 0:18:12.560 be a good digital citizen. When you think about your 0:18:12.560 --> 0:18:14.760 work in the financial services world, as you said, you 0:18:14.800 --> 0:18:17.280 came out of the public sector working in the army, 0:18:17.320 --> 0:18:18.960 you worked in the White House, you worked in the 0:18:19.040 --> 0:18:22.159 n S. A part of what you are now faced 0:18:22.200 --> 0:18:25.320 with is cybersecurity when it comes to one of the 0:18:25.320 --> 0:18:29.080 fundamental building box of our society, which is money. And 0:18:29.280 --> 0:18:33.119 it does feel like banks and financial institutions have invested 0:18:33.160 --> 0:18:36.480 heavily here. What are you seeing now? Because you are 0:18:36.920 --> 0:18:39.720 charged largely with looking around the corner. I see my 0:18:39.800 --> 0:18:42.280 mission now is really an extension of what I've done 0:18:42.320 --> 0:18:44.919 through most of my career in national security, which is 0:18:45.480 --> 0:18:49.040 really defending our economic security. I mean, given that a 0:18:49.080 --> 0:18:53.200 big bank is so fundamental to to national security, so 0:18:53.320 --> 0:18:55.280 I think you're right. I mean, the banking sector is 0:18:55.320 --> 0:18:58.080 ahead of this problem, and we had to be because 0:18:58.240 --> 0:19:04.520 we were attacked pretty signific pigotly in time timeframe. We're 0:19:04.520 --> 0:19:07.000 a group known as the Al Kasam cyber fighters, later 0:19:07.040 --> 0:19:10.320 identified with the Iranian government. We're doing what was called 0:19:10.320 --> 0:19:15.000 distributed denial of service attacks, essentially launching massive data website 0:19:15.040 --> 0:19:17.280 so that people couldn't get to them, and it caused 0:19:17.280 --> 0:19:20.320 a panic. It was for the first time it illuminated 0:19:20.480 --> 0:19:23.480 the vulnerability of our critical financial infrastructure. But off the 0:19:23.520 --> 0:19:26.840 back of that, UH Banking really got ahead of this 0:19:26.960 --> 0:19:30.240 and put in the right programs, the right process is, 0:19:30.320 --> 0:19:33.480 the right technologies and started really investing in that talent 0:19:33.880 --> 0:19:36.080 so that we could strengthen the sector and some of 0:19:36.080 --> 0:19:38.480 the things that we've done to come together very importantly 0:19:38.840 --> 0:19:42.760 to share information. I was incredibly encouraged to come from 0:19:43.200 --> 0:19:46.320 the White House to the banking to the financial sector 0:19:46.359 --> 0:19:50.399 to see how much sharing there is both within the 0:19:50.480 --> 0:19:53.920 financial sector. So you know, big banks are super competitive 0:19:53.960 --> 0:19:57.400 about talent and super competitive about business, they're not competitive 0:19:57.760 --> 0:20:00.959 about sharing information. That's going to keep the sector safe. 0:20:01.320 --> 0:20:04.320 And there's also good sharing between the government as well 0:20:04.359 --> 0:20:07.359 as the private sector, and that it will continue to 0:20:07.960 --> 0:20:10.640 grow and strength and hopefully in the coming years. And 0:20:10.680 --> 0:20:12.760 so you know, you talked about that sort of k 0:20:12.920 --> 0:20:16.400 through Gray. I'd love that phraseology. But when you think 0:20:16.440 --> 0:20:19.280 about your own business and the talent gap there, how 0:20:19.320 --> 0:20:23.000 do you fill that? So we have been successful so 0:20:23.040 --> 0:20:26.119 far in recruiting the folks that we've needed for the 0:20:26.840 --> 0:20:29.680 for the Fusion Center, but we've reached pretty far afield. 0:20:29.760 --> 0:20:32.679 So we of course had great talent within Morgan Stanley 0:20:32.680 --> 0:20:34.720 from an engineering standpoint that we brought in to help 0:20:34.760 --> 0:20:38.440 build the center, but we've gone out to academia, We've 0:20:38.480 --> 0:20:41.680 gone to the military, we've gone to the intelligence community, 0:20:42.160 --> 0:20:44.840 some of the other banks, some vendors. We have really 0:20:44.880 --> 0:20:47.359 built sort of a village because it does take a 0:20:47.400 --> 0:20:50.119 village to be successful in cybersecurity, and it's not just 0:20:50.240 --> 0:20:54.120 about coders or developers or programmers. You do definitely need 0:20:54.119 --> 0:20:57.200 that skill, but you also need analysts who can help 0:20:57.240 --> 0:21:00.720 you understand the very complex and dynamic cyber threat environment. 0:21:01.119 --> 0:21:05.680 You need incident responders who understand how to reverse engineer malware. 0:21:05.840 --> 0:21:08.639 You need crisis managers who can deal with a major 0:21:08.720 --> 0:21:13.280 threat or a major vulnerability. So it's really building, uh, 0:21:13.359 --> 0:21:17.159 this fabric of talent that's brought in from places all 0:21:17.200 --> 0:21:19.560 around the world. Because we're in New York, we're in Baltimore, 0:21:19.600 --> 0:21:22.240 where in Glasgow, we're in Singapore, so we're truly global, 0:21:22.640 --> 0:21:25.840 and so it's tapping into a global talent market. And 0:21:25.880 --> 0:21:29.000 then you know, my biggest challenge has not been recruiting necessarily, 0:21:29.040 --> 0:21:32.040 but it's retention because in a world where there are 0:21:32.080 --> 0:21:35.600 so many opportunities for cyber talent, you have to really 0:21:35.720 --> 0:21:38.720 cultivate an environment that enables you to retain that talent. 0:21:38.800 --> 0:21:43.240 And you know, you need an environment of psychological safety. Frankly, 0:21:43.240 --> 0:21:46.320 where people can bring their imagination, they feel like they're actively, 0:21:46.440 --> 0:21:49.560 actively listened to, where they can bring great ideas to 0:21:49.600 --> 0:21:52.720 the table, and that I think is the key to 0:21:53.200 --> 0:21:57.160 retaining your your best and brightest and that is Jen Easterly. 0:21:57.240 --> 0:22:01.280 She is managing director over at Morgan's Stanley, looking after 0:22:01.320 --> 0:22:04.639 all of their cybersecurity, coming out of the government to 0:22:04.840 --> 0:22:07.359 do that job. Over the course of her career, she 0:22:07.520 --> 0:22:10.159 worked not only for Condoleeza Rice during the George W. 0:22:10.280 --> 0:22:15.920 Bush administration, she worked for Susan Rice. Under the Obama administration, 0:22:16.040 --> 0:22:18.240 she worked in the n s A. She was an 0:22:18.320 --> 0:22:23.240 Army intelligence officer deployed all sorts of places overseas. She 0:22:23.359 --> 0:22:26.520 has seen the threat up close and personal that conversation 0:22:26.640 --> 0:22:29.320 talking about sort of looking around the corner but also 0:22:29.440 --> 0:22:31.920 having the right people to do it has really been 0:22:32.160 --> 0:22:35.680 a key theme here at the nine eleven Memorial Museum, 0:22:35.800 --> 0:22:39.240 UH and Summit on Security. Well, let's move to a 0:22:39.240 --> 0:22:43.640 conversation here at the nine eleven Memorial and Museum Summit 0:22:43.760 --> 0:22:47.439 on Security. Greg virgin is here with me. He is 0:22:47.520 --> 0:22:52.359 the CEO at Red Jack participating in the conference. Here. Greg, 0:22:52.359 --> 0:22:54.479 great to see you, Thanks for having me. All right, 0:22:54.640 --> 0:22:58.120 So tell us Essentially, I was gonna say why are 0:22:58.119 --> 0:23:00.840 you here? But I know why you are here because 0:23:01.040 --> 0:23:04.400