Trey Herr's guest appearances

Trey Herr

CyberCast

Acquisition Talk

What Lies Beneath

Andrew Hunter

Karen Evans

Todd Harrison

Jim Miller

Matt Nelson

Nick Beim

Gerry Connolly

Peter Levine

Dan Ward

Paul Cunningham

John Zangardi

John Whitley

Tate Nurkin

Katherine Boyle

Chris Krebs

OwlTail

Simon Handler

Resilience

Trey Herr and Simon Handler from the Atlantic Council's Cyber Statecraft Initiative joined me on the Acquisition Talk podcast to discuss how the Department of Defense can improve the mission resilience of its systems. The three pillars of resilience are robustness, responsiveness, and adaptability. In that description, resilience is more than about responding to adversity, but capitalizing on opportunity. Oversight agencies should take note that that adherence to plan is nowhere in that definition. During the episode, we discuss:- How mission resilience metrics differ from CMMC- The costs of excessive classification to security- How Netflix uses the chaos monkey to find failure modes- Comparing CIA's Corona satellite development to that of F-35 ALIS- How the BattleLab idea can increase recombinatorial innovationDuring the episode, we dive into a recent paper Trey and Simon wrote in conjunction with folks from MIT Lincoln Labs and Boston Cybernetics called "How do you fix a flying computer? Seeking resilience in software-intensive mission systems." https://www.atlanticcouncil.org/in-depth-research-reports/report/how-do-you-fix-a-flying-computer-seeking-resilience-in-software-intensive-mission-systems/ They recommend a new Center of Excellence for Mission Resilience in the DoD. The purpose would not be to duplicate cybersecurity initiatives, but rather to create metrics which can be put on contract to better verify that firms are using modern development processes like DevSecOps.In order to have adequate status, such a Center of Excellence require a Senate-confirmed position, a dedicated budget account, and quick access to the DepSecDef. But ultimately, it shouldn't be a Top Secret project creating DoD-unique rules and processes. Instead, the Center should adopt the thought leadership from the commercial and academic sectors as to what makes organizations resilient.This podcast was produced by Eric Lofgren. Soundtrack by urmymuse: "reflections of u". You can follow us on Twitter @AcqTalk and find more information at https://AcquisitionTalk.com.

Trey Herr and Simon Handler from the Atlantic Council's Cyber Statecraft Initiative joined me on the Acquisition Talk podcast to discuss how the Department of Defense can improve the mission resilience of its systems. The three pillars of resilience are robustness, responsiveness, and adaptability. In that description, resilience is more than about responding to adversity, but capitalizing on opportunity. Oversight agencies should take note that that adherence to plan is nowhere in that definition. During the episode, we discuss: - How mission resilience metrics differ from CMMC - The costs of excessive classification to security - How Netflix uses the chaos monkey to find failure modes - Comparing CIA's Corona satellite development to that of F-35 ALIS - How the BattleLab idea can increase recombinatorial innovation During the episode, we dive into a recent paper Trey and Simon wrote in conjunction with folks from MIT Lincoln Labs and Boston Cybernetics called "How do you fix a flying computer? Seeking resilience in software-intensive mission systems." <a href="https://www.atlanticcouncil.org/in-depth-research-reports/report/how-do-you-fix-a-flying-computer-seeking-resilience-in-software-intensive-mission-systems/" rel="nofollow" target="_blank">https://www.atlanticcouncil.org/in-depth-research-reports/report/how-do-you-fix-a-flying-computer-seeking-resilience-in-software-intensive-mission-systems/</a> They recommend a new Center of Excellence for Mission Resilience in the DoD. The purpose would not be to duplicate cybersecurity initiatives, but rather to create metrics which can be put on contract to better verify that firms are using modern development processes like DevSecOps. In order to have adequate status, such a Center of Excellence require a Senate-confirmed position, a dedicated budget account, and quick access to the DepSecDef. But ultimately, it shouldn't be a Top Secret project creating DoD-unique rules and processes. Instead, the Center should adopt the thought leadership from the commercial and academic sectors as to what makes organizations resilient. This podcast was produced by Eric Lofgren. Soundtrack by urmymuse: "reflections of u". You can follow us on Twitter @AcqTalk and find more information at <a href="https://AcquisitionTalk.com" rel="nofollow" target="_blank">https://AcquisitionTalk.com</a>.

Mission Resilience with Trey Herr and Simon Handler

Cybersecurity expert Trey Herr, director of the Cyber Statecraft Initiative at the Atlantic Council, explains why IT and cloud supply chain security is a national security issue — and what federal agencies can do about it.

Cybersecurity expert Trey Herr, director of the Cyber Statecraft Initiative at the Atlantic Council, explains why IT and cloud supply chain security is a national security issue — and what federal agencies can do about it.

Season 3 Episode 7 - Supply Chain Security With Atlantic Council's Trey Herr

Stewart Scott

On this episode of What Lies Beneath?, we talk with Trey Herr, &amp; Stewart Scott, co-authors of the recent Atlantic Council report, “Breaking Trust: Shades of Crisis Across an Insecure Software Supply Chain.”  For too long, when people have talked about supply chain security, it’s been all focused on the physical hardware. Where is the physical box? What chips make up that box? Who built it? Where does it live? But the digital supply chain is something that needs to be paid attention to.  Attacks against the digital supply chain can impact nearly any company, but the defense organizations are particularly susceptible to these kinds of attacks. But why is that? Is it similar to the reasons we see for other kinds of supply chain attacks?  Trey &amp; Stewart spend the better part of this episode talking us through their report, and highlighting, among other things:  -Why digital supply chain security is so crucial -Why defense organizations are especially vulnerable to these attacks -Untrusted technology, specifically in the 5g space -Why you can't talk about 5g security without accounting for software security  You can access the Atlantic Council paper  here!

On this episode of What Lies Beneath?, we talk with <a href="https://www.linkedin.com/in/trey-herr-87678654/" rel="nofollow" target="_blank">Trey Herr</a>, &amp; <a href="https://www.linkedin.com/in/stewart-scott-9968a318b/" rel="nofollow" target="_blank">Stewart Scott</a>, co-authors of the recent Atlantic Council report, “Breaking Trust: Shades of Crisis Across an Insecure Software Supply Chain.”  For too long, when people have talked about supply chain security, it’s been all focused on the physical hardware. Where is the physical box? What chips make up that box? Who built it? Where does it live? But the digital supply chain is something that needs to be paid attention to.  Attacks against the digital supply chain can impact nearly any company, but the defense organizations are particularly susceptible to these kinds of attacks. But why is that? Is it similar to the reasons we see for other kinds of supply chain attacks?  Trey &amp; Stewart spend the better part of this episode talking us through their report, and highlighting, among other things:  -Why digital supply chain security is so crucial -Why defense organizations are especially vulnerable to these attacks -Untrusted technology, specifically in the 5g space -Why you can't talk about 5g security without accounting for software security You can access the Atlantic Council paper <a href="https://www.atlanticcouncil.org/in-depth-research-reports/report/breaking-trust-shades-of-crisis-across-an-insecure-software-supply-chain/" rel="nofollow" target="_blank"> here</a>!

Breaking Trust: Shades of Crisis Across an Insecure Software Supply Chain w/ Trey Herr, & Stewart Scott