megan thank you so much uh i'm really delighted to have this opportunity to talk with these two very impressive women today as part of this conference celebrating women in homeland security i should note at the outset that we actually are recording this conversation on march 4th and i understand it's going to be broadcast on march 11th and we're going to start off with some timely news so i wanted to make sure folks knew that this was recorded and with without the benefit of knowing what's going to transpire over the coming week uh but we do have some really interesting things to talk about with these women and some it's important insights into the work uh of homeland security in addition to kind of the role of women uh in in dhs and in this homeland security enterprise you know dhs has the advantage really in a way of having started anew in 2002 when the department was created and not having that entrenched uh culture uh that so much of the national security community uh you know grew up and originated at a time when women were largely in clerical positions and security was almost exclusively a man's world um and and dhs i think had a bit of an advantage in starting up a little bit later now it brought in some of those entrenched cultures uh and uh for good and for bad into the department but dhs has done fairly well and i i just reflect on my time at dhs when i entered dhs four of the five top posts at dhs were occupied by women the secretary the deputy secretary uh and three of the four under secretaries which is that third tier of course um statistically uh it you know we're still not where we need to be in terms of reflecting the the percentage of women in in the population um but the statistics that i have women represent about 32.7 percent of the dhs workforce and i think that number is relatively low largely because of the significant numbers of law enforcement uh within the dhs workforce and that's still an area that is burdened by some preconceived notions both in the population and in the workforce but women are in 44 of leadership positions at dhs and and if you look at women in leadership positions across the country and in the federal government that's a pretty good pretty good statistic so we'll talk a bit about that uh with kirsten um particularly i'm sure she's got some thoughts on that but i thought we would start uh today by talking about what is uh so so forefront in the minds of of all of us and that is the the horror that is unfolding in ukraine and what the implications might be for our homeland security and so kirsten i want to ask you to start by filling us in a bit on the role that cisa has played over the last several weeks and and the role that the president has recently asked the department to step up and lead with regard to making sure that we're prepared to effectively deal with the consequences of any retaliation thanks so much suzanne it's great to be with you and thank you for your leadership um as you rightly point out with the agency starting in 2002 uh dhs is a young agency cis is even younger but it's as a young agency we know so clearly how every moment is built on previous moments and you were certainly a key leader in building us up to this place and so thank you for for all of your direction and guidance and service yeah as you rightly point out um you know cisa has had a significant role but importantly recently when uh with the evolution of the crisis the secretary of homeland security designated cis executive director brandon wales as the senior response official for domestic preparedness in response to the current crisis the department of homeland security has been identified by the president as the lead federal agency to coordinate what is happening with across the agency and particularly when we're looking at protecting the homeland and how do we defend ourselves this is an interagency it's a cross-sector challenge so having that coordination is critical and so the initial priorities of this role that brandon has been given is establishing this unified coordination group which he has done and it actually played off of work that we had done starting at cisa and then to the agency uh larger to make sure that we were all coordinated understood how we would respond it's sort of the evolution of tabletop exercises uh brandon and the ucg are also responsible for developing the objectives the priorities identifying lines of effort and establishing coordinating mechanisms which is critical and so cisa will continue to remain laser focused on the efforts for critical infrastructure security resilience cyber security uh across the nation and so much of this has to do with our industry government collaboration uh what we know as as you know well suzanne uh so much of the threat comes both from industry um and the vulnerability of industry networks as well as the vulnerability of government networks and so as we've looked at this thread and we've actually been preparing for this since november uh and how do we harden the systems cis has been putting out a lot of communication our shields up website which is specifically talking about what companies and organizations of all sizes need to be doing to protect themselves the good news there is that a lot of that isn't too sophisticated it's starting with the basics in cyber hygiene everything from enabling multi-factor authentication uh to encryption and other elements but it's really about having a heightened awareness right now and encouraging all entities individuals businesses to be doing the basics and so as we adopt this heightened posture when it comes to cyber security and protecting critical assets this is staying in close touch with industry and i'll go into a little bit more of that partnership because it's been so critical to where we are today um but right now it's this uh department of homeland security as a lead federal agency closely connected with cisa and importantly an inter-agency coordination collaboration that's going to be critical in ensuring that the united states is hardened and resilient and working collaboratively with our international partners kirsten that's great uh to hear all of the the things of course we've seen a lot of it's been very visible and certainly the shields up uh efforts um it's so it's what i have found is that in government when there is a crisis the interagency comes together and everybody does what needs to be done the key will be can we institutionalize some of the good lessons that we're learning uh from this inner agency cohesiveness around this crisis and really important is you know how is this looking from the private sector nicole we're so grateful uh that you made time to join us today you bring such an important perspective and your in your career you have touched on some of these key critical infrastructure sectors you've worked with them you understand them and and so i'm really interested in your perspective how effective do you think cis's warnings and its guidance have been uh in this context thank you suzanne and um kirsten great to be on with you and um you know first i'd like to say on behalf of our ceo um bill mcdermott and um our 17 000 employees around the world um this this conversation is so critically important and our hearts um you know our prayers and thoughts go out to the families uh affected uh by what's happening in ukraine uh you know we're praying for our military and our leaders who are making you know critically important decisions such as kirsten um and and others and our president et cetera and so you know sis is doing a fantastic job um we know that information sharing is very important and you know as the white house cyber security director has recently uh shared in various articles and conversations that resiliency is very important and embedding resiliency in our infrastructure at the outset it is something that we need to consider um and it's almost it has almost become a mandate yeah terrific nicole thank you and you know it's been really interesting i think in the context again of this crisis that's unfolding uh to see how thin the line can be sometimes between uh government action and the private sector role even in prosecuting uh this the the actions against russia for example and we've we've seen microsoft step up and do things that normally you know you would look to government uh and and and the social media platforms and the cyber security firms that are offering their assistance so um kirsten how how do you look at this this we've talked for years about public-private partnership this is kind of a unique uh situation isn't it it absolutely is and obviously suzanne you know this well and just we've had this term public private partnership for so long um and you know when jenn did her black hat speech the director of sisa bachanaga she talked about it as a happy term because it is one of these things that has sort of lost its meaning and one of the priorities of jen and cisa right now is really looking at how do we move beyond this partnership to operational collaboration and the key vehicle for this was the launch of the joint cyber defense collaborative which is an idea that came out of the solarium commission and what this is is it brings together industry partners with government to share in real time information and we've developed communications channels for this and this is a group that will deliberately grow but what's been very important is just this real-time exchange and so you talk about the microsoft issue and actually what we're seeing is a lot of companies have done that microsoft is part of this but a lot of companies are part of this as well and being able to put forth maybe this is what we're seeing these are the vulnerabilities we're seeing or this is the unusual activity that we're seeing one of cis's uh big calls to action is to really lower the threshold for reporting and this joint cyber defense collaborative has provided an opportunity to share anomalies and to work in real time to take that information and then you marry that up with the government's intelligence and there's a greater more pieces to the puzzle that are being that are coming together and this i think what has been so striking and we saw this with log 4j which was the vulnerability that was uh revealed in december that even if it's asking the questions together so coming together and having industry and government say this is what we're seeing this isn't what's making sense this isn't what uh we're able to understand having that type of conversation and when you marry all the pieces together you start to get greater situational awareness and so we've been very grateful to the industry participation and they similarly have been pleased with the type of communication and the response that they're seeing from government and you know suzanne as you know so much of this is about that real-time activity that the challenge to government in the past has been yes you've given us information but you've given it to us you know way too late where it's no longer relevant and we've actually seen most of that but when it's real time like this particularly in a crisis like the one that we're in right now this type of back and forth even if something doesn't turn out to be significant or substantive or even valid it's the awareness of okay these are the types of tools techniques procedures we should be looking out for these are the vulnerabilities we're seeing more of sisa just uh released yesterday uh an increase of identification of over 90 known exploited vulnerabilities that we are concerned russia is going to be using and exploiting it's not that these vulnerabilities are new but what we're seeing is that these are ones that russia will be more inclined to expose and so just even that information and that's a list that obviously is is aggregated not just from cisa and government intelligence but also with our industry partnership so coming from the outside into this it was one of the key elements of how do we do this better and i will say i've been incredibly impressed and just really pleased with how industry and government have come together so quickly i'll also share suzanne because i think you know you'll appreciate this is it's also the point in time that we're in you know i've thought to myself is the jcdc something that could have happened 10 years ago i'm not sure that it could have because we are at a different point in time where we recognize to nicole cited the the office of the national cyber director chris english the director one of the other things that he says is in order to be one of us you have to be all of us that mentality is an evolution it's the recognition that we cannot defend ourselves as an independent organization company agency that we have to do this together and that joint effort is one that i think we've certainly seen grow even over the last year with the uh the threats and the and the events that have come up so we are at a unique time and what is very gratifying and important is that industry and government are truly coming together in the recognition not of just resilience and peace time but importantly resilience in this geopolitical crisis yeah it's just uh terrific to see and and again i you know something where i hope we can very quickly capture lessons learned and institutionalize some of the the uh forward progress that is made because you do alter in a time of crisis your your cost benefit analysis your risk tolerance right for the kinds of things that you worried about um and i think what you know your description of the uh latest information that cisa has put out on likelihood right what which of the which of of the vast you know sea of vulnerabilities that we've asked folks to pay attention to uh i know that it's been a a a priority for cisa to help both its government uh stakeholders and non-government folks prioritize and and we know that is likelihood and consequence right a factor of the likelihood and the consequence the likelihood that an adversary will exploit that particular vulnerability so i think that should be hugely helpful to the folks who are getting that information and trying to to prioritize scarce resources but the other piece of that is consequences and that's where i think resilience nicole you talked about the importance of resilience i certainly felt that was one of the most important parts of the solarium report was the pillar on resilience and strengthening resilience and i wonder if you can talk a little bit more about that and the challenge um you know what is it that you would look to the federal government to help to with in terms of private sector resilience that's a great question suzanne well first of all we know that the white house uh released last year in may its executive order on cyber security and so um i'd say the the answer is uh in short form is leadership setting the tone for how the government should work with the private sector and that ranges from as we've as we've read there's an expectation of ensuring that these platforms these clouds that we operate as companies are secure and so if we're going to work with the federal government if we are going to uh have business customers uh and you know those customers range from hospitals and schools and and uh corporations that have sensitive data right um and in order to do that there has to be some sort of leadership the tone has to be said in terms of what our systems what sort of equipment we should have what sort of software should we have where should it come from um just as you know when we're eating a certain type of food we often will look at and mention women we often look at you know the caloric content how much sugar how you know how much protein and so we should know what our infrastructure our software and our hardware we should have an inventory of what we have and and so having that sort of prescriptive guidance as outlined in the executive order is really helpful and and so that leadership is phenomenal for us we are in position getting in position uh looking at you know the white house has had a few sessions on open source software what does that mean how do companies like ours how are we impacted by that what systems of ours are vulnerable and we call that a cmdb so do federal agencies have a cmdb do these agencies know what is in their inventory if they don't know how can the private sector help them uh so that they can catalog that inventory so that we do know you know if if other countries are targeting certain vulnerabilities that governments in the private sector has how can the private and public sector work together so that we have a catalog of that we regain our offense right so kirsten i want to give you a chance to answer we we you know nicole had some questions there about whether what the federal government has and is doing uh even as she applauded the leadership i want to give you a chance to address that but i also would ask you to speak to uh you know how cisa having the mission for critical infrastructure against all hazards uh helps in the resilience analysis and thinking about ways to mitigate consequences in the real world understanding cascading consequences and mitigating those consequences a lot of people don't realize that cis is not just cyber and as you can appreciate it's something as we brand and uh really work with the workforce to understand that everybody is critical to the mission because it is cyber and physical critical infrastructure and they're so inextricably linked and you raise a really interesting point suzanne and building off of nicole's comments which is i was doing some work on infrastructure and cyber protection and was talking to a senior leader of a bank in europe who said i don't measure my success by what i've prevented i measure my success by how i respond when something happens and i think that really is one of the key tenets of resilience and part of that also is how we prioritize critical infrastructure and so back in 2018 when the national risk management center was launched it's a component of cisa it's really looking at critical infrastructure and systemically important critical infrastructure and how do we prioritize that infrastructure and i think that is a key piece to looking at all of this is how we work together to create that resilience to create the redundancy one of the challenges and the opportunities that we have had over the last few years in recent memory is that the interconnectedness and the interdependencies of our infrastructure really create almost a blurred line between what is critical and what is not uh one of the things that i worked on earlier was the development of the nist voluntary cyber security framework and this is back in 2013 2014 and when we were looking at that that was very much about critical infrastructure and what we would say is this is not about the mom-and-pop pizza shop on the corner this is about critical infrastructure if you fast forward just a couple of years in 2016 i was uh executive director of president obama's commission on cyber security one of the commissioners uh was ajay bhanga the ceo of mastercard and one of our issues was small business security and he said it absolutely has become about the mom-and-pop pizza shop on the corner because they are now connected to our financial sector through square through different types of financial infrastructure that is connected that point being that we now have this broader set of infrastructure and so part of cis's mission is to identify how do we rank what is critical because if you prioritize everything you're not prioritizing anything how do we rank that criticality but ensure that we've built that resilience throughout the infrastructure and that is becoming more and more important also as more businesses come online you mentioned the role of social media in the ukraine russia crisis and i think one of the interesting pieces to this is while they started as tech companies i would assert in my own personal capacity that social media has become critical infrastructure and when we look at how we rely upon it for communications and the role that it's had so we are seeing a real evolution for technology in our infrastructure and so prioritizing that infrastructure and ensuring resilience throughout is obviously is a critical priority for cisa yeah and i appreciate you know your openness to thinking about the term critical infrastructure i think so often we get so hung up on this organizational construct that we came up with of the sector coordinating councils if it doesn't fit neatly into one of those it must not be critical infrastructure uh well no go back to the definition right have critical infrastructure don't get so hung up on it yeah and the definition proves not to really capture everything that we think uh is in fact of national importance that we need to pay attention to i i sometimes struggle with people saying well protection of of elections is now part of critical infrastructure but protection of other democratic institutions or democracy itself or thinking about the resilience of those is not critical infrastructure i think we need to think carefully about that um because certainly uh disruption of public trust in democracy and democratic institutions would have a significant impact on our national security and i wanted to piggyback off of a comment that you made about it's not just about cyber security right it's when we think about critical infrastructure and as we think about covid um you know what was impacted by covid right what gets impacted if there's some sort of threat to uh to our technology and you know to to buildings and to to roads and bridges our people are impacted by it right so at its cords people are impacted and and then you ask how are they impacted if they're not able to get to work or they're not able to access unemployment benefits at a time that they need that they desperately needed or their you know veterans benefits or you name it access to education because you know children have you know and so many of them still have to use you know their laptops and have access to broadband um and so technology is you know at the center of of of everything that we do nicole it's such a great point that you make about remembering what this is really at the end of the day all about right it's not the networks and systems we care about it's the functions they enable and the impact of those disruptions on people and on people's lives and i do think that this is one of the reasons making you know keeping a focus and really understanding who is impacted most and in what ways by the kinds of disruptions and and uh and malicious cyber activity that we're trying to prevent is is is one of the reasons why i think it is so important to have a diverse workforce that you have a lot a variety of life experiences in the room when decisions are being made um kirsten what what you know talk to us a bit about how sisa thinks about the importance of a diverse and inclusive workforce and carrying out cis's mission thanks suzanne this is absolutely a priority for cisa uh both building out its own workforce but also in building out a national workforce when it comes to cyber security and when we look at this this is not just looking at one or two traits when we look at diversity i appreciate what you said because it's very much about diversity of thinking and that comes from race gender socioeconomic background cultural background we're actually launching a neurodiversity initiative that i hope eventually will be truly integrated into how we hire because when we think about cyber security what is required is imagination and innovation and those two pieces come from diversity of perspective and if we're truly going to look at building solutions and problem solving we need individuals who are looking at these problems differently and whether it's because they are neuro distinct they have a different background they look at something because of their experiences and how they've been raised it's bringing all of these different elements together and i'll share just a quick anecdote which has stuck with me and you'll be familiar with the the cyber moonshot suzanne through the end stack and in working on it a few years ago when we were looking at the cyber moonshot which was to secure the internet by 2030 we brought in an individual who was from the united states agency for international development and she talked about this effort that they have called a grand challenge and this is where you put out a very ambitious goal very concrete goal and figure out how to get there and one of the grand challenges that she referenced was the development of the ebola suit and she was talking about how they auditioned individuals to help bring together to think through how to do this and one of the key designers of that suit on their team ended up being a woman who was a wedding dress designer and the idea there was that she understood the breathability of fabric how to move in uncomfortable clothing but that really goes to this idea of diversity of thinking and how can we pull in people from different perspectives to truly integrate and contribute to this problem and again you know going to a very inclusive workforce what we're looking at is how do we become less exclusive more inclusive and pull in aptitudes from sociology psychology history economics politics because it's not just about math science and engineering that's obviously a key piece but we've got to be thinking about these problems innovatively one other point that i'll make is part of this is how do we recruit that talent and we can't just look to traditional means we've got to go into the communities go to where the talent is so we've partnered with organizations like girls who code and empower who are serving underserved communities and minorities specifically focused on minority girls and women and working with them to recruit that talent we're going to community colleges to vocational schools looking at what diversity of talent means and not just saying it but again going to where the talent is and not just expecting that individuals are going to be able to go on the internet and find our postings but really articulating what we're doing how we're doing it and meeting the talent and meeting this diversity where it is we certainly have a long way to go but it's it is absolutely a priority and something that we are pushing our own innovation and imagination uh to achieve that's great to hear christian i know that you guys have also been talking with girl security which i have the honor of being on their board uh you know they're talking to high school girls introducing them in many cases to the concept of national security to to broaden the pipeline and the the number of of girls and women who are interested in this field nicole it's an issue in the private sector as well obviously and i uh again going back to your emphasis on resilience i think a diverse workforce increases your resilience as well the resilience of your workforce um but but talk to us a little bit about you know what you see on the private sector side in terms of the the value of diversity and what and inclusion maintaining that workforce and providing an environment in which they everyone can as we say bring their best selves to the table um what kinds of things are being done absolutely and and i'd i'd start out by i want to start out by saying that we have to be intentional about these efforts to recruit um and retain and and and so and how do we do that and and you're right kirsten the work that you all are doing at dhs and assistant to to reach out to these different organizations are just essential uh and and so we have a phenomenal program at servicenow called nextgen we train students veterans you know graduates um uh with the just the top you know skills and equip them with the knowledge that they need to prepare for these jobs that we need now and and that we need in the future and we do that by reaching out to you know universities that are largely underrepresented uh across the country uh and we're doing this globally we're working through different organizations we're reaching out to veterans and what i really like about our program at servicenow is that we're not just teaching them how to code and i have a professor who makes me laugh when he talks about this um from from college who says you know lots of companies are offering you know girls can code dogs can code cats can code and then that's it and and so the the awesome thing about servicenow's next-gen program is we're teaching them to code we're teaching them other really important skills and we are opening up the doors for opportunities to get internships uh and a job you know after you know they have an internship if that's where they are depending upon the level and and they get one they get these opportunity opportunities to work not only with servicenow or with but within our ecosystem you know we work with over 80 percent of fortune 500 companies and over 300 federal agencies and sub agencies and so the opportunities are vast so as we talk about inclusion um access retention it's also about influence and and so once we have these opportunities and we are in these spaces where the underrepresented can see us um in these these jobs right these important jobs that are helping make decisions about how the world works um that we we can help them realize that they too can have have these opportunities uh and that they can work with government they can work with you know in the private sector and reaching out to all types of universities um uh you know the hbcus uh making sure that the big ones the smaller ones you know the the ohio states of the world where i graduated from um and and all sorts of universities um just working through organizations that are training young people and veterans and those who have to be re-skilled outstanding uh so uh kishan nicolas just in a very inspiring way talked about the importance of not just uh teaching technical skills but that empowerment um about you know how you assert yourself at the table and make sure your your views are heard with just a you know minute or so that we have left here um i want to give you a chance to very briefly whatever what is your best advice for uh particularly for for girls and women who are uh you know thinking of entering into this workforce or are in this workforce and are struggling to find the best best way to move their career their path forward i think that women have a tendency to opt out they self-select out and my advice would be that this is such a broad and diverse space that if you have an aptitude that you love in all in all uh likelihood that aptitude is relevant to this space and so one of the things that i used to do when i was younger but i still do it in many ways when we look at different elements of this of this space identify that which you're interested in and talk to the people who are doing it give them a call i think one of the things about workforce and where we are today at the end of the day is there's there is a lot of good will as we're looking to build this workforce and i know particularly women wanting to support other women and so i really encourage young women to pick up the phone send an email and if you don't get a response just try again i mean everybody's busy and inundated but to identify that which you're really interested in what you love and figure out where you can place that and i you know i saw one of the audience questions about i'm not outgoing how can i be more outgoing i think embrace who you are because what this is is this is a diverse workforce and this issue area requires so many capabilities and types of personalities that who you are and what you love actually absolutely has a place in this and so to believe in yourself to know that you can do this job you can do this work and look for those who you see have similar traits as you do to understand their path but don't discourage yourself and please don't self-select out i think that's to me when i hear women girls say oh it's not right or i'm not good at that it's know what you're good at develop that but develop the love that you have and when you have that then find a place for it because i can guarantee you there absolutely is a place for what you do and what you love right nicole would you like to jump in on this one sure we just need to keep reaching out to others and being accessible to to others and as i mentioned earlier when young women can see us in these positions it inspires them to realize that they can they can be whatever they want to be and and we have so many great social media tools and can reach each other just contact people and ask questions learn as much as possible because we're not here by accident and we are here to help and bring others along and and so the more that we do that um the more success we'll see uh in in this workforce outstanding well you have both certainly inspired me uh someone at the end of her career here uh and i have no doubt that you have inspired uh the women who are watching and listening to this program so i just am so grateful to both of you for making time uh for this program and uh and thank you uh to our sponsors for for having this wonderful conference thank you suzanne thanks nicole