Ep. 348 Protecting Federal Data in the Age of AI and Zero Trust

Speaker 1 0:00
Hey, John Gilroy here. Today we’re at the Billington Cybersecurity Conference, and we’re going to jump into data. Hit the music, Manny. Welcome to the Federal Tech Podcast. My name is John Gilroy. I’ll be your moderator, face-to-face interview today. Scott Monty Montgomery, General Manager, U.S. Federal at Island, Monty, having a good time at the show here.

Speaker 2 0:23
I’m having a good time everywhere I am, but this has been a great show yesterday. I know

Speaker 1 0:27
4,600 of your closest friends. Wow,

Speaker 2 0:31
I I feel I feel rock starish, and that never happens to me in my day job. Yeah, yeah.

Speaker 1 0:37
Speaking of rock stars, Monty moderated a panel yesterday, and the title of the panel is “Building Resilient Zero Test Architecture in the Federal Space, and you guys killed it. I mean, that that was a fun group, wasn’t it?

Speaker 2 0:50
It was a fun group.

Speaker 1 0:51
I mean, it’s like a salad. You had you had you had some onions, and you had some raisins, you had some cranberries, and you had federal people. You had all kinds of different people, and everyone’s giving different opinions, and it was just great. So what I’d like to do is for the people who couldn’t make it to the conference, maybe give a summary of what happened at that interview because there’s so much good stuff in there, wasn’t it?

Speaker 2 1:10
Yeah. So it’s always fun when you’re moderating a panel to have different walks of life, so you get additional perspective. If you get five people that say the same thing as what you thought coming in, nobody learned anything, right? And it becomes an echo chamber. So having a mix of both industry and agency folks sets the table for what can be a lively discussion. And my job is basically to to just stay out of the way as much as possible, and get to the perspectives of the attendees.

Speaker 1 1:44
So I’m going to quote one of your guests from yesterday. Sure. And as most of my intellectual listeners know, George Orwell wrote a book called Animal Farm. He’s famous for saying all pigs are created equal. Some pigs are created more equal than others. So yesterday, Helmut Baiduan from Knox he said that not all data is created equally. I thought that was very perceptive, wasn’t it? Is this that you know you can’t protect everything and you can’t? So this is part of the challenge with protecting data. Which data do you protect?

Speaker 2 2:15
Sure, sure. So cybersecurity, privacy-they’re they’re very much like math games, and when the math doesn’t work in your favor, you don’t get to change the way the math works. You have to change your numbers, and what I mean by that specifically as it relates to to data management, there are pieces of data about me. I wear a particular brand of socks. I have a social security number. I have hobbies that I don’t want to be known in the public. Which ones of those would I protect more? Right. I’m going to tell you the brand of socks that I wear. I’m not going to mention the name of the brand, but it’s a it’s a brand of socks that they make fun socks that I like to wear, and when people ask me what brand of socks is that, I tell them so that they can go buy their own. That’s a piece of data about me I wouldn’t pay to protect. I would actually reveal to you, right? But there are pieces of data about me: my routing number for my checking account, my account number for my checking account. I would pay more to protect those, or I would do more to protect those. And what I think sometimes, and we learned this on the panel, is fascinating. Agencies struggle with how to make those distinctions around what’s called data valuation. Sometimes we make a bucket that’s listed as data. This is against your Orwell quote, right? It’s marked data, and we throw all of the data into it. Well, that actually isn’t how data works. That’s not how data is valued, and that’s not how we should protect it. So, when when with the panel, what I wanted to do was elicit ideas on how do we help people identify what data is worth protecting, or is worth more effort to protect? Because again, cyber-it’s a math game. If I spend less effort protecting the data that matters, that gives me more labor hours to do other things.

Speaker 1 4:13
So, Monty, we’re in downtown Washington D.C. not far from the White House, and I heard about this new executive order today, and they mandate that if you’re in a podcast, you got to say artificial intelligence, or you can’t broadcast. But I’m going to use the word AI. It has to use it. And from one of the people on your panel again, I thought this was very perceptive. Again, Steve Fayle from Microsoft, federal CTO, he said today because of AI, we are preparing data for AI like we should have done for users, yeah, wasn’t that revealing? Sure, it’s it’s fascinating

Speaker 2 4:45
if you think about different tracks of effort with respect to generative AI, and it’s funny we we made a conscious effort to not talk about AI because everybody else in every other panel is talking about AI. But it’s interesting how the opportunity of of AI permeates data and data valuation. It was fascinating, and if you think about it, there’s going to be two really large categories of data users in the new paradigm. One of them are people like you and I, and the other are agents or or or generative AI tools that we launch in order to do tasks for us, but to an adversary, do they care whether they compromise John Gilroy or do they care whether they compromise an agent if the data value is high? No, they don’t care, but we have to because we’re the stewards of the data, the protectors of the data, and I found it fascinating that the same, you know, it becomes. Are we having the fox guarding the the chicken coop? Generative AI is challenging without smart guardrails, and can we rely on AI to make those data valuations and distinctions? The answer is, we have to. It’s a tool that’s worth employing to help us do

Speaker 1 6:01
it, I quoted George Orwell. Now I’m going to have to quote Tom Hanks. I mean, it makes sense, doesn’t it? Chronological. There was a popular movie many years ago about women’s baseball team, and Tom Hanks was Jimmy Duggan in there. And this is a good quote too. He said, “You know, baseball-it’s supposed to be hard. If it wasn’t hard, everyone would do it. The hard part is what makes it great? And in your discussion yesterday, you said managing data is hard. It’s hard. It is. It’s hard. And you got to approach it from several different angles and figure it out. And and guess what? You’re gonna fail and just keep on figuring it out. I mean, this is the biggest challenge.

Speaker 2 6:36
Yeah, there there’s so many ways to take this, and one of them, the government’s not terribly great at. Agencies and departments really struggle with this, and it’s be. And I’ll get back to why in a moment. But the idea of failing fast. I worked for a number of years for a semiconductor company, and they said it’s okay to fail. In fact, you’re going to fail all the time. But what we’d like for you to do is identify when you’re failing and fail fast, and and if you think about it, that’s not very governmentish at all. Sometimes we we get into these intractable positions where we can’t easily adjust or make make adjustments, and and and the why of it is what matters here. When you talk about the the role or the mission of agencies, and the data that they’re protecting it kind of matters a lot, whether it’s the Social Security Administration and how we take care of our own elderly, whether it’s the Health and Human Services Agency where we do leading edge research and protect the sick and the indigent among the sick, whether it’s the Department of War and how we protect the privacy, the battlefield privacy even of our soldiers, the data matters, the mission matters. So sometimes it’s really hard to fail fast because what you’re doing matters so much. Perspective is what’s going to lend itself to this new AI territory, gaining some, applying some, and moving out fast with some. Which is why this panel was fun because it had both industry and agency participants.

Speaker 1 8:15
Right, and if you can find the transcript from that panel, it’d be great. You know, Monty, we are in downtown Washington. Do you see? Hop and Uber. We go down Lincoln Memorial, easy peasy, two three miles. If you look at that monument, it’s got a bunch of pillars, and you know and I know Zier Trust got pillars in it, and that’s why this guy Steve Fail from Microsoft. He said something yesterday that was again worth noting. He said, you know, the first pillar is in it, the second pillar, but you had to bring the pillars together, sure. So that’s the goal of data with zero trust architecture is bringing the pillars together. I guess, huh? Yeah.

Speaker 2 8:47
So it’s it’s fascinating. There was a different dialog on this same matter that I I found very very fascinating. There’s a young lady. She stood in at the very last moment. She got she got notification in the morning. One of our panelists fell ill, and Miss Jennifer Franks, who is in a CTO role at GAO, she said something that I think is among the most important things with respect to zero trust, and it really isn’t technical at all. She said why matters to users. If you think about these agencies and you think about them executing against their mission, who is it doing it? Who is it executing against mission? It’s people, it’s employees of the agency, and she said the best way to get people to buy in to something hard-you know, back to your Jimmy Duggan quote-doing something hard is what matters. How do you get people to buy in? How do you get non-technical, non-cyber, non-privacy people to buy in? You explain why they need to do it, and I think the why of the pillars is fascinating. So let’s think about identity. Hey, we’re going to ask you to prove who you are beyond the shadow. Out of a doubt, because who you are and what data you have access to, it matters. We’re going to ask you about the device that you’re using and why that device should be used for that mission data. Maybe it’s your personally owned device. Should you be able to get to everything? Maybe, maybe not. But that’s a distinction that matters. But what if I told you why I wouldn’t let you have it on your own iPad, well, I can’t be sure that you’re doing updates on your iPad. I can be sure that you’re doing updates on your government device because I make those updates, right? But the why would matter. Oh gosh, I hadn’t thought about that. If my iPad was unhygienic from the data standpoint, then I shouldn’t be able to have government. That’s a thanks for explaining that to me. Now that that employee, that agency employee, who we need to care about protecting data, suddenly knows why they have to. Now you get back to data itself. Who is the best person to ask about the value of the data? It’s not the IT team. It’s not the security team; it’s the people who use the data. The why? Oh wait, nobody should care about that data, and here’s why.

Speaker 3 11:08
Yeah, pulling it

Speaker 2 11:09
together without the buy-in of users, or at least tools that make it more obvious to users, tools that can inform while they’re on that data journey. That’s why I’m here at Ion because we can help inform users on that data journey. Those tools become invaluable because now the user understands something while they’re working with sensitive data. Fascinating.

Speaker 1 11:33
You know, Jennifer Franks is brilliant. I’ve heard on many podcasts, and every time it’s like home run, home run. Tom Hanks, home run, home run, home run. And I’m going to try to kind of work a story into her her comments. Over the weekend, I had to fix my garage door. I got out an 11 meter socket and I fixed it. It’s great. In two weeks, I’m going to get that same socket and fix something else. The point is that that tool is not going to change. But what she said is that you know you got to evolve tools to protect the data. So it’s not just 11 mil. It may be at 11 millimeter today, but it’s gonna. It’s dynamic, and so you have five tools. These tools work well. They work today at 1245, but it is just they’re changing, and and you have to even keep keep up with the tools, and tools can be attacked.

Speaker 2 12:19
It is. It’s fascinating when you go and you buy. You know, when you go buy your first home, one of the first purchases you make is that 100-piece starter tool set. Right? You don’t know what you’re going to need. You don’t know when you’re going to need it, but you know at some point it’s going to come up. And the fascinating thing about tools is, it doesn’t matter how good your Phillips head screwdriver is if you need a Torx wrench. It just doesn’t. It really doesn’t matter, right? And the fascinating thing about cyber tools is, again, with this notion of fail fast, sometimes we’re very, very rigid in our thinking, and if you look at monolithic government spending, we were super network centric for a long time. We’re going to do network security. We’re going to do network security. If you remember JRSs, this is this huge, multi-billion-dollar monolithic network stack, and we’re going to push all the traffic through it, and it’s going to be wonderful. And three years later, the OIG and RDT&E reports-this is super jargony-but these are reports that kind of measure efficacy of programs. They said this thing was hard to stand up; it was hard to use, and we’re not even sure if it helped. When I talk about fail fast, we need to have tools where the users themselves are part of the diagnostic process, and the tool itself is closer to users because the users and their access of data really truly matters. So the closer we can to get to the user, the faster we’re going to get to efficacy.

Speaker 1 13:56
I’m gonna quote someone who is not on your panel, just as smart, Dana Grisham from Sandia National Labs. I heard an interview with her, and she talked about a federated environment, different labs sharing information, and she said you have to understand how data can integrate and traverse the network. Wow, traverse! I mean, so data and rest good. What about where it’s going? And this is what Matt House from CISA talked about. He said, “Well, okay, but where’s it going? Well, it’s secure. Well, you don’t know that.

Speaker 2 14:25
Yeah, we talked. This was a fun topic as well. I wish we had had a tad longer because we had a large group of talented folks. But what Matt I thought crystallized brilliantly was not just data at rest, which is sort of old potatoes, right? Not just data in transit, which is sort of old potatoes. But what about data in use? Suddenly, what is a user looking at, and how does an adversary have access to what a user might be looking at at the moment they’re looking at?

Speaker 1 15:00
So a new tool for that. It is it is

Speaker 2 15:02
a fascinating idea. Again, this one I think though goes hand in glove with what I was saying a moment ago. Moving the tooling and the the experience closer to the user, suddenly the user themself becomes a a sensor. Whether it’s a user or whether it’s an agent, they become a sensor to who’s accessing data, why are they accessing data, and what’s the value of that data. It’s a it’s a it’s a fascinating fascinating study. I think the people that are going to be successful are going to automate faster. They’re going to be willing to fail fast and to retool without going headlong into very monolithic multi-billion-dollar spends, because then it’s hard to dig back out. There’s a there’s a young man in the Pentagon. He’s the CDAO. His name’s Cam Stanley, and he talks about experiments, and that’s what I would love for departments and agencies and industry to take a page out of. We’re going to try some experiments. And what are experiments designed to do in science? They’re designed to fail fast or succeed fast. Fail fast. Learn something. And that’s what I think the the departments and agencies that are able to protect mission data faster will be because they launched experiments. They tried to fail fast.

Speaker 1 16:28
We were at the Billington Cybersecurity Summit here, and and Island has a booth, I S L A N D, and you can go to the website island.io. Is there maybe a white paper, a document, or maybe a blog article you may direct our listeners to. Yeah,

Speaker 2 16:42
I would actually more fun than that. There’s a short video from Hendrick Motorsports, who has who has has allowed our use of the their name and imaging, and they talk about the speed of data in particular as it relates to their race team. You think about intellectual property and you think about data hurtling at you at 200 miles an hour. The video is fun, and it talks about not only why they need to protect data, back to Miss Frank’s point, but also how they do it. Fascinating, a two-minute video. It’s fun.

Speaker 1 17:14
So the homework for listeners is watch a fun video, yeah, and then go to the Billington website and see if you can get maybe a summary or a transcript or maybe a video of this building resilient zero trust architecture in federal space, because you get all kinds of angles from people who work for the government, who used to work for the government, and people you know been beat up and knocked around the commercial world and trying to apply lessons and and you know I think it what they say in the military they say if you want to go fast, go alone. If you want to go far, go with the team. That’s right, and that’s what you got here. You got six different opinions and six different skill sets, huh?

Speaker 2 17:49
Nah, that’s exactly what happened. Good,

Speaker 1 17:50
good, good. Unfortunately, we are running out of time here. You have been listening to the Federal Tech Podcast. Like to thank my guest Scott Montgomery Monty, General Manager U.S. Federal at Island I S L A N d.io.

Transcribed by https://otter.ai