Podcast Transcript

Welcome to Cyber at the Top, a podcast from RSAC that unpacks real experiences, lessons learned, and practical strategies from CISOs at some of the world's leading organizations.

Hello, everybody, and welcome to this edition of Cyber at the Top. Thanks for listening in. I'm your host, Hugh Thompson, executive chairman of RSAC.

Speed is becoming one of the most decisive factors in cybersecurity as high performance computing and AI reshape both how organizations defend themselves and how hackers operate.

In this episode, I am absolutely thrilled to be joined by the incredible doctor Phyllis Schneck, vice president and chief information security officer at Northrop Grumman, to explore how high performance computing is reshaping cybersecurity from real time detection and response to the infrastructure and discipline required to make speed an advantage. We'll discuss how increased compute power is changing incident response, accelerating automation, and raising the bar for defenders preparing for the next wave of threats. Let's get into the discussion. Phyllis, thanks for being here.

Hugh, it is so great to get to talk with you, and thank you so much for this opportunity and to participate with RSAC. It's exciting.

Oh my gosh. It is always great talking with you, and I love this topic. I love this topic. Before we get into it, though, just for context, can you start by telling our listeners just a little bit about your role and your mission at Northrop Grumman.

So thank you. So I am the chief information security officer for Northrop Grumman, and that means I lead the team that's charged with the protection and defense of our electronic assets.

And what that means to the Lithoformian is protecting a company that helps make things safe for the warfighter, for our products, and is one of the top technology companies in the world.

So when you think about what worries us day to day is protecting that mission and protecting the cyber parts and the technology parts, but first and foremost, that enable the great mission for Northrop Grumman and our technology.

That is awesome. Northrop is so lucky to have you. I'll say that from, you know, knowing you for years and knowing the incredible things that Northrop does to defend this nation and many nations.

And so let let me ask you about high speed computing. So it's it's changing so many industries.

What does it mean, though, specifically for cybersecurity? How do you think it's gonna change the landscape over the next three to five years?

So if I back up a little bit in the context of Northrop Grumman and we talk about the things that we build, leading the world in military and space exploration, the need to act at speed in our manufacturing, in our thinking, in our design, in our process, in our user experience. The cybersecurity that goes into that is about protecting that business and that experience and enabling new technology to really be a part of our world and our culture and to do it safely. And the way that I see high speed computing changing that for our industry or any industry is I'll put it into three areas. One is if you can have more compute power, you can make decisions faster. Computers are not smart.

They're super fast. So what you have to think about is I get more math. I get more calculations.

I get potentially better decisions. I get more pattern recognition.

But in the end, I also get more attack surface or decision space I have to really think about as risk mitigation. And so the faster we move, the faster and more clever we have to think about what our protections are so that they're enablers and they don't get in the way. I say twenty years ago, we we really got in the way as cyber in many ways. We had a good time doing it. We blocked everything. But I think now it really is about... In the past ten years, it's about risk mitigation and about enabling that business. So one way high performance computing can affect cyber is just the speed.

The second part is fast computing is what's enabling artificial intelligence.

So the main driver and the main innovation behind artificial intelligence is in two parts. It's in math, and it's in the computing that enables that math.

And there's the adversary that can also leverage that. So they are manufacturing zero days, like their jelly beans right now, and it's much easier, right, if you can write a high school essay with this. You can also think about... Extrapolate how you'd use it to also put probabilistic content together to create code that can find an exploit. So you've lowered the bar as far as an exploit and a sophisticated one even in the world's best code that could potentially grab the next instruction to be fetched, which is when when you execute your will on somebody else is when you own them.

And I think the third, piece on the hard part is it lowers the bar to compromise. So even if you're not able to go ahead and be the next instruction on my set or find a spot in memory where I now control you, if I can engineer a prompt the right way, I'm in because I'm still controlling what you're doing or what you're manufacturing or what I'm asking for or what I can look for. I'm still doing something on your network. I just didn't work as hard.

But the flip side is this technology is fantastic. And so part of protecting it is you use high performance computing to protect high performance computing. You use AI to protect AI in many cases. So we can use, as we all have for many years, very high speed analytics in our threat analytics at our cybersecurity operation centers.

We always have.

You can also use it to proactively find other exploits and seal them. And we can use AgenTik AI to automate a lot of processes that, frankly, we don't always wanna do, kind of like the Roomba. Most people don't like to vacuum. I say most because I got called out once.

I know somebody now that loves to vacuum. But if you take a task that most people don't wanna do and automate it so that you can put your bigger brains onto things that matter more and check that automated work, you get a balance. So high performance computing is enabling AI. It's enabling the adversary.

It's enabling our ability to protect the adversary. But, again, it's enabling our business, and that's why we're here.

I love it. And and I just... For the record, so, know, have two people, I actually find that can be very therapeutic.

The... Remember, I just don't I just don't get that same level of satisfaction that I've completed a row or so. I I... But but I get the analogy.

I firmly welcome to to vacuum.

Thanks. Okay. Thanks. I'll remember that when I come over. So let... But let let me dig into maybe some specifics of what you said.

If you think about this, then arms race, the good guys are getting faster. The bad guys are getting faster. AI is enabling both.

How do you think about high speed computing accelerating AI, specifically automating actions, for example, within cyber operations? Like, just give us a window into how you're thinking about that.

It's a great question. I think with all this compute power, the world runs on data. That's our fuel.

And the more we can do with that data to not just find patterns, but tie things together that we never had the resources to do before, and I mean the speed, it's a little bit like, ten or fifteen years ago, I studied a high speed weather forecasting. And you look a lot at tornado modeling because not everything is random.

And if there's a chance you can see rotation or certain parameters that are lining up in a harmful way, even minutes sooner, you save lives. And so there... A lot of work went into the same kind of philosophy, and it still is. There's a lot of applications scientifically here. You can apply that to cybersecurity. Are there events, all over the world that are one, two, three, seven events that might tie together to a greater pattern later. In the in the old days, denial of service attack... Distributed denial of service attacks showed themselves with first a little test bump in the traffic and then the big delivery because the adversaries of that attack wanted to make sure their infrastructure worked.

And those that were able to detect that sooner were able to prepare. So a lot like weather forecasting, this speed will give us analytics. It gives us hints we never knew we could find before. I I firmly believe that. On the flip side, we have to be ready for a different kind of cyber incident response.

Not just faster, but when you look at a poisoned large language model, how do you get to last known good very quickly? It's different than in a cyber event where where data's destroyed because you have a backup.

In AI, you have backups in these models, but you have to be very meticulous about how those are taken and kept and when something was disrupted because all the activities and all the data and decisioning that was based on that model could be offset once it's compromised.

So your job is not only to refresh the data with something that isn't compromised, but to understand, my goodness, what happened as a result of the decisions that were made also at speed. And so it's going to reframe how we have to look at electronic incident response.

I love your analogy of weather because in my mind, it's just so chaotic, and there's there's signal. There's noise. You're trying to just deal with so many parameters at once. And I... I'm I'm curious. How do you feel that the security industry, like the vendors, for example, are responding to this? Are you seeing innovation happen in some of the very large vendors, or is a lot of the innovation coming from start ups that are coming into the ecosystem given just rapid adoption of AI? How do you feel about the pace of innovation coming from the community to be able to respond to this?

You know, it's it's a great question. I remember we were vendors when... I mean, I was a vendor. I was a... Your competitor way way back when?

Right. But as a CTO, it's a bad tech. Yeah. I remember.

It's a different view, I think, as the consumer from a large vendor. We expect so much, and I always try to... Whenever I'm I'm in these positions to say this, Stuff works 90 something, 99% of the time. You can be on your phone in an Uber and walk into an airport still on the phone, only dropping it for security to be back on your iPad before you get on the plane, and stuff just works. And we don't stop enough to say, I appreciate that because that is a success.

And I always say that before I say this. I think it's very difficult right now to be a security vendor or an infrastructure vendor because highly paid, very smart individuals have all the resources in the world to poke one hole in you, and then we complain. But the the reason that we complain is because we wanna keep our business up. And so I do think, and I have seen a lot of innovation.

I can speak mostly to the, IT infrastructure and cybersecurity parts of of the large vendors, but a lot of attention to critical infrastructure, a lot of attention to cybersecurity, a lot of attention from large vendors saying, hey. These are the problems that we are facing. Let's work this together. These are the challenges we have.

And I do see a lot of innovation there, from the speed perspective.

I think we as a community have to think about what is AI going to demand of us next and be part of shaping those requirements. I'm very careful. I don't like to... And I know you don't either. We're we're not the ones that are out there complaining that somebody got compromised. They're victims. I do think, though, this is an effort of community going forward to get our head around what high speed computing will do before the adversary does that for us. And I think that's a... We do that together.

Oh, it's it's such a great framing. And and, you know, this community really has stepped up in the past for big challenges and come together.

And it's it's interesting to think about it from the adversary side too.

How are you seeing this reshape how the adversary is thinking about attack? Or you talked about the rapid pace of discovering of zero days, for example.

How is this access to this kind of computing through the cloud or elsewhere changing the behavior of the adversaries, or how might it change it?

So I'm not an adversary, so I won't pretend to know.

Okay. That's good. That's very good.

So one large thing I've noticed, and and I I think my my peers are seeing this together with me, more zero days. And in a prior life, there was a phrase called burning a zero day. And what it meant was... You know this. This exploit has value. So are you going to, quote, waste it on something where you won't learn much, or are you really going to use that cyber weapon on something where you can either cause a large, effect or gain a lot of knowledge?

And now I see it as not just burning a zero day. It's it's kind of like potato chips. There's always another one in there, and they're using a lot. They're much more frequent, and they're at a similar level of sophistication. And my... I surmise that there's some automation in designing and finding those exploits.

It's a different different world. It's just a different way of of thinking about things. And and I I wonder, you know, the... These things often come so real with examples. Can you share an example where you feel like speed was the difference between containment and escalation of some incident?

It's speed of how quickly we connect as a community. It's speed of how we have.

I I would think back to...

Put it in sort of the eras tour here. If you think back to the time of Code Red, we didn't have the kind of computing visibility. We didn't have the kind of logs. We basically chased that thing by where it showed up next, and it was crazy.

Had we had the visibility we have today and the speed of compute that gives you the ability to go through logs, the storage capacity that lets you have all those logs, we would have nailed that. Right? If you go forward to where there was a a series of large ransomware events. Right?

Even then, we didn't have all the procedures in place. By the way, speed isn't just a stack of processors. It's also how we practice and how we exercise. We do a lot as you know in the community, tabletop exercises with partners, with colleagues.

Our speed is how quickly we react to mitigate risk and how we're no longer afraid as a community to say, that's an incident and not wait four hours to try to convince ourselves it's not an incident.

And to really move out, I think that's people speed and that's our reaction to technology speed. And I think that's key. And and just to go forward now to modern day when we think about a lot of understanding of what we bring on a network. For for me, I'm all about prevention and detection and engaging methodology where success for us is mitigating a risk.

It's not preventing everything because I know how to do that. I'll unplug the network, and people won't be so happy or productive. Right? But if you're...

Hardest part, I think, of what we do view every day is helping people have a good user experience and build the amazing products that they build, and not getting in the way, but understanding what the risks are and accepting them.

And speed helps us understand what those risks are. We can run calculations. We can do simulation. We can understand even from cost perspective, how much are we investing in protecting something and using it versus not using it? And what is the difference in the business?

And so for me, it's what is the effect my team and I can have to help this amazing business at Northrop Grumman? And a lot of that is assessing risk and saying, this as a company we're willing to do for the good of our work, and this we will not. But those calculations are the difference that speed's making every day.

That's such a great way to frame it. And I could see what you're saying. If we're more agile with our speed and we're able to take all these factors into account, we could possibly adjust the things that a human might have to do or, you know, even lessen some security controls in some circumstances if you feel absolutely confident about it after these calculations.

And and and I'm wondering, you know, I'm imagining somebody listening to this podcast. They're thinking about their own one year, two year, three year plans for defense.

How should they be thinking about the kind of infrastructure they need to build behind it? Like, what what does a secure high performance environment need at its foundation?

So that... That's core.

For me, it means looking out, as you said, a few years, and looking deep. It's not just the vendors you use. It's how are you structured? Do you have some redundancy?

So how your data flows. Are you running on data centers that are physically located? Are you running on...

With you? Are you running on someone else's data center? How much is in cloud? How much, for example, are you able to support with remote work?

We had this interesting snow event here on the East Coast and most of the country, and infrastructure didn't flinch. But that's because people designed it not to flinch, and that was thoughtful. And it's balancing where your traffic is flowing and where the demand is and follow the sun to make sure that work goes on. And not just typing, but video.

Video is computationally expensive, making sure, you know, we don't look...

There's a friend of mine calls digital on a on a really enabling business. So good design, number one. I'm a former coder, and they always used to yell at us requirements definition first.

I think two is not falling into that trap, and we all love this trap. It's very exciting and enticing. Hey. It's still running.

Why fix it? Right? I had a 20 something year old car in grad school. I kept my next car to almost the same age, and I'm also the proud owner of a 2006 Mustang still.

So I don't always replace my automotive infrastructure, but I do believe in replacing your IT infrastructure. Infrastructure. And it's very tempting to keep it because it still works. But if you are keeping things that are obsolete, and we all have a cycle.

No one is perfect, and we're all on this journey together. What I think we're learning as a community is it's very hard for those large vendors to keep the older models updated. And so while it seems economically better in some cases to run it because it's still working, I do think that one of the things we have to figure out as a community is how to make it cost effective to to go ahead and get a new one, because it's easier to secure. So that infrastructure is there for you because the speed of computing has to match the speed of the network flow.

And if one of those is out of alignment, you're still going to have the lowest common denominator for speed.

And when you do these calculations and things burn hot, your infrastructure includes cooling and includes power for that cooling. And so all of this has to get designed holistically. And I do think that's going to be a very specific and sophisticated expertise that we're only just beginning to develop in the next generation of networking. And I think as we've often said, success in cybersecurity is putting yourself out of a job.

It's making it so that we don't need the discipline. We're clearly not there, and thank you for that. I love my work, but the networks of the future will have more self learning, self healing capabilities just like our our routers talk to each other right now and make sure everybody's still up. I think we'll be doing that in security going forward.

It's...

I I could see it being really easy for folks to make missteps along this journey. Right? And and you you highlighted two of them just now. Right?

One one misstep or maybe, you know, just a bad thought is that something's running great, doesn't have any problems right now, but I'm not thinking about the future. So I'm not replacing and keeping it current. You also mentioned bottlenecks. Like, you might have the great compute infrastructure, But if you don't have the communications upgrade and the bus speeds, you you can't really take advantage of it.

What what are some other common missteps that you've seen companies make while they try to pursue speed and innovation, and maybe they don't have a strong foundation?

You can address some of the things I... I've looked at with colleagues all over the country and in different areas and even academically. One of the... You look at some of the stock trading applications, because that's a very high speed application we can all relate to, and it's true in manufacturing too. It's important to design your infrastructure. If you're going to use very fast mathematics or high speed computing to do calculations that literally create what they call a digital twin or instead of having to, if if an object is going to fly and you want to know if changing it a bit is going to fly the same way, thirty years ago, you had to make a new model and try it out. Now you do a digital simulation. That is hard.

That is billions of calculations to emulate one small change in the physical model.

If you're going to do that in real time, it turns out the distance from your computing infrastructure to where you're watching it matters.

So the time, the speed of light, the time it takes to get the result to you for the simulation matters. So you wouldn't be doing something like that based on a data center overly far away.

Now most applications don't have that much sensitivity, but some of the digital twin and simulation and certainly a lot of the financial applications do. And that's something that I I think from an academic and scientific mind, those are fascinating problems to look at right now.

And they go into how we design our infrastructure in in all of our companies.

And you you bring up such such a fascinating point because folks usually don't think about that without a lot of experience in making those mistakes in the past or, you know, they've they've seen all these best intentions but haven't thought about it end to end.

And I'm I'm wondering what advice would you give to an organization that wants to harness a high performance computing. They wanna be able to defend quickly. They wanna look at all these signals as you mentioned and be able to calculate risk, act.

How do they do that responsibly where they can get speed but not introduce new weaknesses that the adversary may take advantage of? It's an age old... You know, do we actually wanna automate response? And if we do, how do we make sure that the attacker doesn't take advantage of that automation and trick us into shutting something down that we shouldn't?

How do how do you think about that?

You've raised, like, 50 great questions in there.

I know. Sorry. Sorry. Yeah. That's, like, a a compound question.

If I go from the last one, so an automated response, and we're gonna think about our operational technology too, that is connected. In some cases, it's not connected. In some cases, it needs to be for monitoring.

But how we protect that and ensure that it is segmented so that it doesn't face outward and is not subject to the wild west of the Internet, I think, is one piece where you can mitigate risk and add a lot of automation to that.

The other risk in there, though, of course, is accuracy, not just adversarial problems, but making sure... If you make a mistake, there's a time frame to correct.

If you make a mistake at high speed, that mistake propagates very quickly. And so how you design these things and and as we grow as a community and look at this is holistic. It's... If I'm a small company, I would outsource when I would get high speed computing, and I would understand what the distance has to be for the last discussion. But that... That's something that's readily available all over. If you're a large company, you still... You have a balance of what you outsource and what you bring in for a variety of reasons.

And then you look at sensitivity and you look at how am I able to manage this and cost and facilities and geographic balance and disaster recovery. So I think a lot of it depends on financial models for your size too, But I've never underestimate not every risk with high performance computing is caused by an intentional adversary. Some of it is escalated because we're running so fast, and it's a mistake.

And I think we have to be wary of that too and understand how to recover.

I'll I'll ask you this, which is kind of an age old question in cyber, and I'm curious if high performance computing changes this in any way. And you you alluded to this at the beginning of our discussion. Twenty years ago, we were seen as the people that stop things, the the ministry of no inside of the business. You know, it's it's kind of how the security office was branded at some point.

And I I reflect back on, for example, when the iPhone introduced Touch ID.

It was one of those really rare occasions where somebody could be more secure and also have more delight or get into the phone faster because maybe they didn't have a PIN on the phone. And now they'll put a PIN on, but all they have to is touch it, and now they're inside of the device.

Do you see high performance computing enabling us to further delight the user or ease the path of the user? Basically... And, you know, again, another compound question, but how do you design security and does high performance computing impact that so that employees can move quickly without needing to think about the threats behind the scenes?

That's the holy grail. It it could be considered career limiting, but I did commit to creating more secure solutions that are more enjoyable to your point. And one of the... I did, because I believe that's where we have to go to exactly your point. If someone doesn't like something, they're not going to use it. And in a company that moves as quickly as Northrop Grumman for the mission that we have from outer space to microchips, we can't expect our employees to have a... Have to climb over an infrastructure to get their work done.

So one of the things that's just a great example is we are implementing pins instead of passwords.

So I can ask you to memorize a bajillion character password, and I'm not popular for this because we did that for a while. It's actually very secure. Or I can have you memorize a not so onerous number that you're probably never gonna forget because you choose it.

And it's better because it's tied cryptographically to your identity.

And I can cover all the corners of multifactor authentication because I can either do a a have, no, or an r, but it covered... It's not just cryptographic. And it's the high performance computing and the progress we've made in computing in general that lets us do that crypto fast enough. And I'll I'll give you some humor.

My PhD thesis at Georgia Tech, I'm a way back machine here, was on high performance computing for cryptography. And it was just how do I make the computer do the calculations quicker than it's supposed to be able to do?

Right? And now we have hardware that does all of that. So what we tried to do back then, which we did successfully do, and I I...

I'm thankful for my graduation for that. But...

No kidding. But that touch, that iPhone, we couldn't do that twenty years ago. The processor in your iPhone is calculating a key that's far longer than your your...

Any password and is far better protection. And that's...

So you nailed it, Hugh. That's more of what we want to get as far as the security experience, and nobody's there yet.

But I do think there are lots of touch points that can make that better, and and that is an example of one.

That's awesome. I I love a hopeful story for the user. Because I, you know, I I I I completely agree with you. If the user is in pain, they're gonna do unexpected and probably very unwanted things.

So I... I'm completely aligned with your career limiting statement as you as you put it.

Nothing more interesting or more risky than telling a bunch of smart people you can't do that. And it will be far more insecure, unsecure, and far more risky than anything you would want.

And so the the trick is...

Really, it is about a human experience.

If...

For example, there's a lot of security software on all of our laptops everywhere.

If you open up that laptop and it takes twenty minutes to light up for you, you're gonna go to your phone.

So where is the the secret sauce in making that stuff run faster or, mitigate some of that experience? Because I would never expect someone to work with equipment that was unpleasant because you just can't think about what matters when you can't even log in, and I'm very sympathetic to that.

My gosh. You you you definitely nailed it on the creativity of people if you tell them no. And, you know, Phyllis, I've got five young kids. What what... Whatever I tell them not to do, the kinds of ways they can figure out to get it done are just unfathomable. Like, it's an unbelievable creativity. And so if we can... If we can avoid spurring that in the user base, that would be a massive breakthrough for cyber everywhere. One more question to ask you, and it's it's it's the advice question.

So if you had one message for CSOs that are listening or technology leaders that are listening about preparing for the future, and it was a big open ended question, what would it be?

Think about what you're here to project.

And before you think about vendors and requirements and regulations and acronyms, think about why you're here and your purpose in that role.

And and for me, I learned very quickly within the first couple of weeks of being at Northrop Grumman. My first visit out of the building where the great year was to our operations center, of course, and just met that amazing team.

And soon after, they brought me out to one of our factories where I got to walk this amazing floor and watch them put together pieces of a fighter jet.

And that wasn't cool enough. Just talk to the people putting it together and explain how every little part or everything is digitally guided and everyone had such an expertise on their small part of this big beautiful bird.

That to me gave me as a human being, not just a seesaw, a lot of purpose.

It's a mission that motivates. And, Phyllis, I I I can't thank you enough, not not just for being here, but for everything that you've done and you continue to do to keep really, our way of life safe. And you're such an asset to the... This community. Thank you for everything that you do, and I wanted to also thank our listeners for tuning in.

I'd invite you to please keep the conversation going on our RSAC membership platform by visiting 1rsac.com/membership. And be sure to check 1rsac.com for new content posted year round. Phyllis, it's so great to see you. Thank you so much for being a part of this.