►
Description
From Norwich University:
This event includes panel discussions on Department of Defense (DoD) Cyber Institutes, future technology in cybersecurity, and the state of cybersecurity in Vermont.
Moderator: Annette Redmond, Deputy Assistant Secretary for Intelligence Policy and Coordination, Bureau of Intelligence and Research
Panelists: Ashleigh Chambers, Mary Knapp, John Wintrow
8/16/2022
https://linktr.ee/townmeetingtv
Town Meeting TV is a free speech forum and the ideas expressed do not necessarily reflect the views of the Town Meeting TV trustees and staff. If you have a different perspective to share, we invite you to join the conversation! Create your own program or cover a community meeting or event. Contact maketv@cctv.org or call 862-3966.
Thank you for tuning into Town Meeting TV! Please subscribe to our YouTube channel and visit our website for more videos and information about how we open the doors to local government using community media. www.Ch17.TV
This video belongs to http://www.cctv.org and published with permission under Creative Commons License CCTV Center for Media & Democracy Programming is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
A
Additionally,
she
provides
strategic
direction
to
the
department
of
state's
support
to
the
intelligence,
community
and
foreign
policy
oversight
of
sensitive
intelligence
operations.
Ms
redman
has
previously
received
the
intelligence,
community
and
department
of
defense
for
more
than
30
years,
both
as
a
retired
army
officer,
well,
probably
as
an
army
officer
and
and
a
senior
civilian.
A
She
is
in
the
senior
executive
service
positions
in
the
army
and,
most
recently
army
intelligence
cio.
Ms
redman
holds
a
ba
in
criminal
justice
from
norwich
university,
a
masters
of
science
and
strategic
intelligence
from
the
national
defense
university
and
the
chief
information
officer
chief
information
officer
certification.
C
Very
good,
okay,
so
we'll
leave
it
up
here.
So
I
have
a
great
panel
with
me
today
and
I'm
very
happy
to
be
home
at
my
alma
mater.
I
haven't
spent
an
awful
lot
of
time
here
as
rich
schneider
used
to
give
me
a
very
hard
time,
but
the
last
couple
of
years
have
been
absolutely
wonderful
in
my
engagement
back
here
at
norwich,
I
have
a
guest
panel,
as
I
mentioned.
C
Her
left
is
ashley
chambers,
who
is
a
data
analyst
for
missing
and
exploited
children,
and
she
is
also
on
nu's
board
of
fellows.
So,
thank
you
all
for
coming
I'd
like
to
ask
each
of
you
to
give
us
a
thumbnail
of
your
expertise
and
how
it
applies
to
the
problem
set
at
hand,
which
is
you
know,
as
senator
leahy
laid
out
for
us.
Cyber
security
has
been
a
very
persistent
problem
and
how
do
we
apply
new
techniques
and
technology
to
help
fill
the
shortfall
so
with
that
john.
D
D
I've
I've
been
with
norwich
for
about
a
year
and
it's
started
into
applying
some
new
approaches
in,
as
you
know,
the
institutes
that
are
here
potentially
another
institute,
that's
focused
in
human
trafficking
and
my
invitation
here
all
the
way
from
arizona
was
to
speak
about
attribution
part
of
my
background.
Former
secret
service
worked
in
the
intelligence,
community,
retired
military
as
well,
and
so
have
a
substantial
background
in
that
and
some
of
the
questions
that
we'll
feel
today,
hopefully
I'll,
be
able
to
talk
about
two
primary
things:
training
and
tools.
E
E
I
got
my
master's
degree
here
at
norwich
university
that
makes
this
extra
special.
It's
a
great
honor
to
be
here
sitting
on
this
panel
today
I
got
my
start
in
information
technology
way
back
at
augusta
state
university
in
augusta,
georgia,
where
I
got
a
computer
science
degree
and
was
in
I.t
and
switched
over
to
cyber,
when
I
had
the
opportunity
to
get
my
master's
here
and
have
been
really
passionate
about
cyber
ever
since
so
I'm
happy
to
be
here
to
answer
questions.
F
Hi,
can
you
all
hear
me,
I'm
ashley
all
right,
so
I'm
ashley
chambers,
I
currently
work
at
the
national
center
for
missing
and
exploited
children
with
it
being
a
non-profit.
I
wear
a
lot
of
hats,
but
primarily
I'm
a
data
analyst,
so
I
was
hired
as
a
data
analyst
there,
but
I
also
do
a
lot
of
their
kind
of
data
science
tool
development.
F
Previous
to
that
I
was
at
the
national
security
agency
for
a
couple
years,
while
there
I
worked
in
cryptanalysis
and
then
also
vulnerability,
research,
so
two
different
teams,
while
I
was
there
as
such
cyber,
definitely
holds
a
special
place
in
my
heart.
I
did
love
my
time
at
the
agency
and
then
in
my
current
role.
I
think
I
get
to
see
a
lot
of
machine
learning
and
how
kind
of
the
future
of
that
so
talking
about
future
technology
is
definitely
something
that's
interesting
and
I'm
so
glad
y'all
had
me
here.
C
What
I've
found
in
my
five
years
at
state
is
that
cyberspace
often
is
a
hybrid
operation
that
doesn't
just
involve
cyber,
and
I
think,
john,
that
you
come
at
this
in
a
hybrid
approach,
applying
new
and
unique
techniques.
So,
if
you
could,
could
you
define
your
work
on
attribution
for
the
audience?
What
does
attribution
mean?
How
is
it
related
to
cyber,
and
how
can
we
apply
those
techniques
to
make
us
stronger.
D
Okay,
that's
an
excellent
question.
I
wonder
yeah
so
two
pieces
of
my
background
that
I
did
not
reference
one
also
national
defense
university,
graduate
in
counterterrorism
and
homeland
security
leadership
and
also
worked
at
twitter.
I
was
their
head
of
threat,
intelligence
and
investigations.
Attribution
came
in
in
a
massive
way
in
that
capacity.
D
Specifically,
you
would
have
anonymized
accounts,
people
would
make
death
threats
and
they
would
need
to
be
investigated,
but
the
person
is
there's
no
email
or
phone
number
or
anything
of
that
nature.
Back
in
the
past,
so
analytic
methodologies
were
developed
to
be
able
to
understand
who
the
actual
person
is
behind
those
where
they're
physically
located
and
then
assessing
the
capability
of
carrying
out
those
threats.
D
Years
later,
had
the
the
pleasure
of
working
with
some
folks
that
worked
in
that
arena,
but
were
cyber
specific
former
background
for
those
folks
were
in
the
alphabets
and
they
wanted
to
know
the
art
of
attribution.
Now,
it's
both
an
art
and
a
science
part
of
after
leaving
twitter,
I
got
recruited
by
ibm,
I
was
doing
work
with
them
became
a
data
scientist
and
so
after
30
years
of
law
enforcement.
Once
I
understood
how
these
tools
worked,
I
had
a
lot
a
lot
of
input
of
how
to
simplify
the
technology.
D
In
the
end,
when
it
comes
to
attribution,
cyber
will
identify
down
to
the
port
they'll
make
arrangements
or
adjustments
there.
So
that's
no
longer
breached
attribution.
Is
the
art
and
science
of
finding
out
who
the
person
is
behind
such
an
attack?
Is
it
a
12
year
old
kid
in
his
grandmother's
basement?
Is
it
a
nation
state
actor?
D
Is
that
a
a
dry
run
for
something
larger,
coming
down
the
road
etc?
So,
attributing
it
to
people
behind
the
threat,
the
threat
actors
themselves
gives
another
layer
of
information
to
be
able
to
accurately
assess
that
risk
that
threat
and
the
risk
associated
with
it
over
the
years
once
working
with
technology.
D
We're
I'm
currently
involved
in
helping
develop
technology
to
the
point
where
you
don't
have
to
be
a
data
scientist
or
you
don't
have
to
be
an
engineer
or
an
analyst
for
that
matter,
tools
being
simplified
when
you
see
a
two-year-old
that
can
pick
up
an
iphone
swipe
through
it
put
the
code
in
get
to
the
app
that
they
want.
That's
intuitive.
So
the
more
intuitive
we
make
these
technologies,
the
more
people
that
can
use
them,
and
I
have
more
to
speak
about
a
little
bit
later
on.
C
This
is
especially
true
for
health
and
wealth
organizations
like
the
one
that
you
work
in
as
two
sectors
that
often
are
targeted
the
most
specifically
private
health
care,
related
data
and
sensitive
payment
information.
Private
health
records
can
be
worth
a
fortune
credit
card
data
can
be
used
for
fraud
or
sold
on
the
black
market.
What
approach
from
your
perspective
can
assist
to
protect
this
data.
E
I
would
say
one
of
the
things
to
consider
is
just
don't
reinvent.
The
wheel
use
one
of
the
frameworks
that
are
out
there,
nist
iso
ffiec
cat,
but
adhere
to
one
of
those
frameworks
which
is
easier
said
than
done
right.
So,
if
you're
in
one
of
these
organizations,
especially
in
healthcare,
a
lot
of
those
facilities
are
understaffed.
E
They
don't
have
the
budget
to
just
say
sure
I'll
adhere
to
that
framework.
They
don't
have
the
cyber
and
I.t
resources
so
align
yourself
with
an
mssp,
and
they
can
worry
about
the
framework.
They
can
worry
about
what
kind
of
security
you
have
in
place
and
instead
of
having
internal
resources,
if
that's
not,
if
that's
not
something,
that's
feasible
for
your
organization,
that's
the
next
best
way
to
have
a
cyber
guard
dog,
and
I
think
that's
probably
one
of
the
best
moves
for
people
that
really
feel
like
they
don't
have
cyber
in
place.
C
F
F
Out
of
that,
we
see
two
kind
of
large
type
of
exploits
or
ways
that
there's
vulnerability
there.
One
is
from
the
user
themselves.
I
mean
you're,
always
going
to
be
the
biggest
threat,
so
you're
your
own
biggest
threat
in
social
media
and
one
way
is
over
sharing.
So
that
can
look
like
a
few
different
things.
Over
sharing
can
be
letting
people
know
when
you're
on
vacation
kind
of
threatening
that
physical
security
people
now
know
you're,
not
home
you're,
leaving
yourself
kind
of
open
to
that
exposure,
and
then
second,
is
that
personal
oversharing.
F
So
people
learning
things
like
your
mother's
maiden
name
or
your
favorite
dog's
name,
those
type
of
things
that
can
be
used
for
security
questions,
which
makes
it
a
whole
lot
easier
to
figure
out
your
passwords.
If
all
of
a
sudden,
you
know
everything
about
the
person
that
you're
researching
you
no
longer
really
have
to
hack
into
their
account
or
anything,
because
you
can
just
directly
figure
out
their
password
or
act
like
them,
and
so
out
of
that
you
see
a
lot
of
identity
theft.
F
Kind
of
another
risk
is
obviously
fishing,
so
we've
all
heard
of
phishing
you'll
get
sometimes
those
text
messages
that
say
something
like
you've
been
locked
out
of
your
account
click.
This
link
or
another
common
one,
is
called
just
the
lol
phishing
attack,
and
so
that's
when
you'll
get
a
link
and
it'll
say
something
like
lol
or
hey,
and
then
you'll
just
get
this
link
with
no
other
context
from
a
friend
a
lot
of
times.
If
you
click
those
you're
giving
access
directly
to
your
data
to
your
phone
as
someone's
able
to
install
malware.
F
So
we
see
that
and
then
also
with
fishing
there's
a
different
type,
so
people
have
typically
heard
of
catfishing
or
have
seen
catfish
the
tv
show.
That's
when
somebody
pretends
to
be
somebody
else
online
and
at
first
glance
that
sounds
kind
of
harmless,
but
we
especially
at
my
job.
We
see
a
lot
of
that
within
dating
apps,
where
someone
will
pretend
to
be
somebody
else
and
then
ask
for
things
like
illicit
photos.
F
Obviously
I
do
will
deal
with
teenagers,
but
you
can
see
it
across
the
spectrum
and
so
just
teaching
that
that
is
a
risk
and
that
the
person
you're
talking
to
online
isn't
always
who
you
think
they
are
so
out
of
that,
I
would
say
those
main
risks,
there's
kind
of
four
or
five
different
things
that
you
can
do
to
start
thinking
about
those
in
a
more
secure,
better
way
on
social
media,
so,
first
of
all,
just
like
commonly,
if
you're
connecting
a
device.
Let's
think
about
protecting
it.
F
Also
make
sure
that
who
you're
sharing
information
with
is
who
you
think
it
is.
So
you
can
limit
your
privacy
settings.
You
can
obviously
disable
things
like
location
service
and
then
don't
send
any
private
information
that
you
wouldn't
wouldn't
say
to
someone
face
to
face
or
that
you
wouldn't
give
a
stranger,
because
strangers
can't
see
what's
online.
F
F
C
D
Absolutely
when
I
my
the
first
course
that
I
taught
here
at
norwich,
dr
travis
morris,
if
he's
in
the
audience,
can't
tell
he
had
asked,
how
do
we
make
more
of
you?
How
do
you
teach
that,
and
so
I
figured
out
a
way,
let's,
let's
define
intuition
first,
so
quick
and
ready
access.
Excuse
me
quick
and
ready
insight.
D
So
when
you
see
data
and
if
you
have
the
again
training
and
tools
and
as
soon
as
you
see
that
data,
you
recognize
it
for
the
value
that
it
is
for
example,
what
can
you
do
with
an
ip
address?
You'll
see
folks,
investigators
that
will
subpoena
data
come
back
and
now
they
have
it
now.
What
do
they
do
with
it?
If
they
don't
have
the
right
tools
or
they
don't
even
understand
what
that
data
is
metadata
from
a
phone
ip
addresses?
What
can
you
do
with
an
ip?
D
What
can
you
do
with
latitude
and
longitude
etc,
and
so
what
I'm
trying
to
teach
here?
Actually,
what
I'm
succeeding
in
teaching
here
is
how
to
be
intuitive,
and
the
basis
of
that
is
any
of
the
data
that
you're
examining
you
have
an
instant
understanding
of
what
it
is.
You
may
not
be
the
world
subject
matter
expert
on
it,
but
you
recognize
it
for
its
value
and
you
actually
know
what
you
can
do
it
with
a
latitude
and
longitude
it's
not
just
a
cross-section.
D
It's
also
can
be
converted
to
an
address.
You
can
go
to
elevation
to
figure
out
what
floor
that
person
is
based
on
that
as
well.
Ip
addresses
you
can
look
at
analyze,
an
ip.
Let's
say
it.
We
have
a
death
threat
that
comes
in
and
you
look
at
that
ip
and
you
want
to
analyze
what
that
ip
is
in
the
other
set
of
ips.
D
If
that
other
activity
is
related
to
criminal
activity,
and
this
one
is
just
related
to
that,
is
it
a
university
or
a
you
know,
a
coffeehouse
that
has
laptops
in
it?
Things
like
that,
so
intuition
is
experience
and
it
can
be
taught
I'm
teaching
it
here.
Ideally,
law
enforcement
online
will
get
the
same.
So
I
went
into
law
enforcement
in
1988,
and
I've
had
the
benefit
of
the
last
30
years
of
seeing
what
law
enforcement
looks
like
today
and
it's
very
similar.
They
don't
teach
this
kind
of
stuff.
D
Was
it
a
conference
two
weeks
ago,
the
international
association
of
human
traffickers,
one
of
our
business
partners
and
we're
talking
about
children
from
age?
Four
and
up.
Let
me
repeat
that
age,
four
and
up.
Why
is
this
not
something
that
our
nation
is
just
inundating
with
resources
and
training
and
whatnot
we're
far
behind
the
ball,
and
so
in
2017?
D
D
D
You
would
do
a
knock
and
talk
my
partner,
I
go
up
to
a
door
knock
and
talk,
they're,
saying
that
you're
doing
drugs
in
the
neighborhood
mind
if
we
come
in
and
look
around
well
at
that
time,
we
could
have
been
standing
in
a
meth
lab
until
you
got
the
training
to
say.
Okay,
these
are
the
things
that
you're
doing.
Human
trafficking
is
no
different.
All
of
it
comes
down
to
training
and
tools,
intuition
learning
the
tradecraft
there's
a
huge
gap
in
I'm
trying
to
make
a
difference
in
that.
C
So,
from
murder
to
cyber
security,
here
we
go
so
at
state
department.
I've
been
a
very
strong
advocate
for
supply
chain
risk
management,
and
the
government
is
starting
to
get
much
more
serious
in
this
arena.
So
mary,
we
know
even
unsophisticated
hackers
will
automate
their
strategies
in
their
efforts
to
infiltrate
vulnerabilities,
both
in
companies
and
other
organizations.
C
E
So,
statistically
speaking,
if
you're
going
to
have
a
data
breach,
it's
probably
going
to
be
with
a
vendor.
So
really,
I
think
right
now,
any
organization
probably
has,
by
definition,
probably
hundreds
of
vendors
and
the
best
way
that
you
can
really
kind
of
get
a
handle
on.
That
is
to
have
a
very
strong
vendor
management
program
at
the
bank.
I'm
responsible
for
that,
and
I
think
the
easiest
way
to
do
that,
because
you've
got
hundreds
of
vendors.
How
do
you?
How
do
you
categorize
all
of
them?
E
How
do
you
look
after
all
of
them,
so
you've
got
to
break
them
down,
define
them
by
risk.
You've
got
to
defi
to
find
your
your
highest
risk,
vendors
and
focus
on
them,
and
you
need
to
focus
on
those
high-risk
vendors
and
look
at
their
due
diligence
documentation.
Do
they
have
any?
Are
you
comfortable
with
their
cyber
security
posture?
Are
they
doing
things
the
way
that
not
only
you're
comfortable
with
but
by
regulation?
E
Are
they
meeting
those
standards?
You
need
to
make
sure
you're
getting
access
rights
on
these
companies,
the
the
logins
for
these
companies
and
all
of
your
users.
You
need
to
make
sure
annually
you're
looking
at
this
or
whatever
frequency
that
you've
deemed
appropriate
for
that
vendor
and
when
you're
looking
at
vendors
cyber
and
it
need
to
be
involved
very
early
on.
E
I
can't
tell
you
how
many
times
with
other
organizations
I've
seen
somebody
buy
something
and
then
go
to
I.t
and
cyber
and
say
here
make
it
work
and
that's
just
not
the
best
practice
for
making
sure
that
your
vendors
are
properly
vetted,
that
your
supply
chain
is
going
to
be
there,
that
they're
not
higher
risk
and
that
they're
not
putting
you
at
higher
risk
and
in
an
industry
where
you're
regulated.
This
is
something
that
will
be
scrutinized.
C
F
F
Okay,
I'm
gonna
spend
some
time
and
I'm
gonna
create
my
own
video
game,
and
so
I
think,
first
of
all
find
what
you're
passionate
about
and
then
be
willing
to
actually
spend
some
time
on
it.
So
maybe
that's
an
hour
a
week
that
you
can
dedicate
to
actually
working
on
projects,
so
I
would
say
find
that
passion
is
the
first
thing.
F
Second,
you
do
need
to
develop
some
technical
skills,
a
lot
of
cyber
kind
of
builds
on
itself,
so
programming,
for
example,
you're
not
going
to
go
from
writing
hello
world
to
all
of
a
sudden
having
beautiful,
efficient
code.
So
I
would
recommend
spending
a
little
bit
of
time.
Maybe
it's
just
20
minutes
each
morning
I
know
in
college.
F
It
is
a
fastly,
highly
evolving
field,
both
cyber
and
data
science,
and
so
with
that
you
want
to
keep
up
with
the
current
trends.
So
maybe
that's
attending
conferences.
Maybe
it's
participating
in
things
like
capture
the
flags
or
hackathons.
A
lot
of
both
workplaces
and
school
have
opportunities
to
get
certifications.
F
C
D
D
Now,
you
have
two
different
disciplines
and
to
her
point,
if
you're
passionate
about
it,
I
can
reference
a
couple
of
folks
that
were
cyber
experts,
the
the
alphabets
and
they
had
asked
me
to
train
them
in
attribution
and
once
I
did
that
they
shifted
from
cyber
and
went
into
human
trafficking.
There
was
data
that
they
were
familiar
with
to
my
point.
You
know
the
intuition
they
knew
it,
they
understood,
but
they
didn't
know
how
to
take
it
further
and
when
you
do
that
they
also
had
the
the
skill
set
of
being
developers.
D
So
we
would
run
into
a
problem
and
they
would
literally
from
scratch,
build
the
technical
solution
to
overcome
that
problem.
Well,
tradecraft
is
nothing
more
than
how
you
know
how
to
do
something
that
works
for
you
to
overcome
certain
problems
in
a
huge
variety
of
ways,
and
so,
if
you
have
that
multi-disciplinary
education
or
experience,
whether
it's
formal
or
passionately
developing
it
on
your
own,
when
you
get
in
front
of
somebody,
you
can
speak
to
all
these
different
backgrounds
and
things
that
you
bring
to
the
table.
It's
not
just
a
certificate
or
experience
or
x.
D
Number
of
years
doing
this,
you
have
a
develop
a
diverse
spectrum
of
skills
to
apply
to
solve
the
problems,
the
more
perspectives
that
you
apply
to
something,
especially
if
you've
already
overcome
problems
in
those
areas,
the
more
successful
that
you
will
be
so
I
highly
advocate
developing
your
skills
in
ocean,
develop
your
own
trade
craft.
How
do
you
deal
with
certain
problems?
It
could
be
any
number
of
things.
D
C
Thank
you,
john,
so,
mary
today
we
understand
that
hacking
has
evolved.
It
used
to
belong
only
to
those
with
specialized
trade,
crafts
and
skills
security
teams
are
outnumbered.
A
hundred
to
one
and
the
industry
faces
a
huge
talent
shortage.
This
needs
to
and
will
change
in
the
future
with
the
help
of
places
like
norwich
university.
E
I
think
that
we
need
to
look
at
cyber
culture
and
we
need
to
invest
in
people.
I
think
we
need
to
invest
a
lot
more
in
people
and
I
think
we
need
to
start
it
a
lot
earlier.
If
you
think
mentioning
cyber
security
to
your
elementary
school
kids
is
too
early
you're
wrong.
Ask
your
kids!
What
age
they
got!
Their
first
email
address
at
school.
E
Ask
your
kids,
what
kind
of
things
they're
doing
on
their
computer
and
what's
required
to
be
done
on
a
computer
when
in
school
that
whole
cyber
culture
needs
to
start
to
be
ingrained
a
lot
earlier,
and
then
we
need
to
start
teaching
those
skills
to
our
kids
a
whole
lot
earlier.
This
is
a
long
sales
cycle.
I
get
it!
This
isn't
something
that
we're
going
to
say.
You
know,
let's
start
doing
this
and
then
tomorrow
we're
going
to
start
pumping
out
more
professionals.
E
E
We
need
to
start
talking
about
cyber
security
with
our
kids
and
then
we
need
to
make
it
available
in
the
elementary
schools
in
the
middle
schools
in
the
high
schools.
There
are
a
lot
of
kids
coming
to
college
and
they're,
seeing
cyber
security
for
the
first
time
as
something
that
they
can
even
learn
about,
and
I
think,
if
that's
already
something
that's
ingrained
in
them.
That's
part
of
their
cyber
culture.
E
Let
them
learn
with.
You
find
the
really
good
workers
that
maybe
don't
have
the
skill
set
yet
and
let
them
build
that
with
you,
but
give
them
a
chance.
I
don't
really
think
the
gap
would
be
as
bad
as
it
is
right
now.
If
people
would
look
at
some
of
these
folks
here
that
have
a
fresh
degree
and
give
them
a
chance.
C
F
Yeah,
so
I
think
this
is
a
great
question.
It
immediately
made
me
think
of
the
fact
I
my
first
week
at
my
new
job,
so
I
swapped
over
to
a
non-profit
about
three
months
ago
and
the
first
week
I
got
there.
I
got
an
email
that
was
like
review
your
order
from
amazon,
and
I
was
like.
Oh,
I
don't
remember
ordering
something
from
amazon.
I
clicked
on
it
having
just
come
from
a
job
in
cyber
security
like
I
knew
better,
I
clicked
on
it
and
it
was
like
hey.
F
You
would
have
just
failed
this
fishing
test.
It
was
like
from
my
new
workplace
and
I
was
like.
Oh
that's
such
a
good
reminder
that,
like
even
somebody
who
knows
something
about
it
is
still
likely
to
click
on
something.
So
I
would
say
the
top
thing
is
be
aware:
keep
that
security
mindset,
even
when
you're
in
a
new
environment
or
where
it's
something
where
you're
not
having
to
think
about
it.
So
three
once
again
of
like
the
kind
of
main
failures
we
see,
is
that
phishing
attempt.
So
we
talked
about
it
earlier.
F
It's
the
same
thing
with
that
link.
That
was
supposedly
from
amazon
or
a
lot
of
times.
We
see
it
in
advertisements
too.
So,
if
you're
on
a
website
a
lot
of
times,
we'll
see
like
the
zeus
virus
recently
was
caused
by.
If
you
click
on
an
advertisement
that
had
a
link
in
it,
it
would
download
malware
to
your
computer,
which
then
would
search
for
banking
information
directly
on
your
computer,
so
be
really
mindful
of
where
you
click.
F
Lastly,
once
again
is
the
threat
of
malware
so
being
aware
of
what
we're
clicking
on
so
in
order
to
stop
some
of
those
it's
some
of
the
things
we
talked
about
earlier,
but
you
can
also
make
sure
that
you're
continuously
patching
and
keeping
up
to
date
with
the
security,
the
most
current
security
software,
because
you'll
see
that
a
lot
of
times
when
vulnerabilities
are
released,
they
will
patch
it,
but
we,
as
the
user
a
lot
of
times,
don't
feel
like
updating
our
security.
It's
like!
F
Oh,
no,
it's
I'm
going
to
have
to
shut
down
my
computer
and
all
my
work's
open
or
I
don't
want
to
have
to
plug
in
my
iphone
overnight,
while
the
new
operating
system
installs,
but
all
of
those
are
what
keep
us
secure
and
safe
from
those
vulnerabilities
and
those
patches
that
we
know
about
other
than
that.
You
should
be
encrypting
your
sensitive
data.
So
if
you
have
sensitive
data,
we
want
to
use
some
sort
of
manager
to
actually
encrypt
that
other
than
that.
D
Part
of
that
would
be
students
that
are
working
on
a
minor
or
a
major
degree
and
working
in
that
center,
where
law
enforcement
does
not
have
the
training
or
tools
that
those
cases
active
cases
can
be
worked
by
students
here,
there's
a
lot
of
a
whole
lot
that
goes
behind
that,
but
simply
stated.
That's
one
initiative
that
we're
looking
at
and
that
can
be
in
the
capacity
of
human
trafficking.
Cold
case
homicides.
Any
number
of
different
things,
so
part
of
that
would
be
expanding
the
course
work
that
we
have
right
now.
D
That's
focused
just
on
attribution
alone,
which
is
mastery
of
ocean
understanding,
all
the
synths
and
the
application
of
it,
and
through
that
potentially
offered
online
to
law
enforcement
so
that
that
ticks,
the
box
of
the
training
gap
that
I
spoke
of
earlier
and
the
other
is
the
tools
this
is
the
company
I
work
for.
Has
the
tools
to
do
that:
i2
also
known
as
analyst
notebook,
if
you're
familiar
with
it
or
not
we're
pretty
much
in
all
of
the
alphabets
globally
for
intelligence
and
investigative
capabilities.
D
So
that's
something
we're
working
towards.
We've
got
the
right
people
involved,
and
I
want
to
throw
one
more
thing
about
when
we
were
talking
about
passion,
I
I
consider
passion
is
equivalent
to
talent
some
of
the
most
talented
folks
that
I've
seen
it
wasn't
about
their
formal
education.
Although
that
education
is
invaluable,
you
can't
replace
it
with
something
else.
D
So
if
someone
doesn't
have
that
opportunity
and
they've
developed
those
skills
within
instead
of
if
I
am
looking
to
hire
somebody,
it's
not
necessarily
okay,
well
you're,
a
sme
or
subject
matter
expert,
it's
the
talent
that
they
bring
again.
That
makes
them
so
much
more
diverse
in
what
they
see,
what
they
understand
and
what
they
can
do
with
it,
and
so
I
encourage
everybody,
find
your
passion
and
move
forward
with
it
and
as
we
continue
with
with
our
efforts
in
the
academic,
fusion
center
or
human
trafficking,
whatever
ends
up
becoming
titled.
D
I'm
excited
for
that.
I've
stated
before.
In
other
circles,
I've
got
about
10
more
years,
left
in
me
in
the
fight,
I've,
retired
law
enforcement,
retired
military,
and
this
is
my
focus
and
I'm
with
the
right
group
noah,
which
is
the
only
place.
I
can
see
the
other
successful
institutes
that
we
have
we're
in
the
right
place
to
do
this,
and
thank
you.
D
C
C
E
I
would
say
that
one
of
the
biggest
things
you
can
do
again,
if
you
don't
have
the
internal
resources,
is
to
align
yourself
with
a
really
good,
mssp
they're
invaluable,
and
it's
not
something
that
you
should
try
to
just
you
know
kind
of
half
at
it.
You
really
need
to
have
strong
cyber
posture
in
place.
The
threats
are,
are
constantly
changing.
E
They're
coming
at
you,
24
7
365.,
and
if
you're
going
to
handle
it
internally,
make
sure
you've
got
the
right
tool,
sets
make
sure
you've
got
the
right
technologies
and
the
right
people
in
place
to
make
use
of
those
technologies,
for
instance
having
a
sim
in
place.
That's
something
that
if
you've
got
a
powerful
sim
and
then
you've
got
somebody
who
knows
how
to
operate
it
and
the
right
people
watching
your
systems,
they
can
catch
things
before
they
ever
become
an
issue,
and
then,
on
top
of
that,
you
really
need
policies
and
procedures.
E
So
you've
got
your
technical
controls,
but
then
you've
got
the
policies
and
procedures
so
that
the
the
human
aspect,
where
that's
where
your
biggest
threat
is
in
any
organization
you've
got
them
all
doing
things
in
a
secure
way,
or
at
least
they
should
be.
According
to
the
policy
and
the
procedure.
The
technical
controls
are
wonderful
to
catch.
E
Some
of
the
things
that
that
people,
maybe
will
forget
or
do
on
accident,
but
that
that
insider
threat
is
is,
is
a
huge
risk
area
for
your
organization,
so
having
training
in
place
the
policies
and
procedures,
the
technical
controls.
All
of
that
you
need
to
just
layer,
your
defenses
and
and
make
sure
that
you're
looking
at
your
cyber
posture
holistically
and
from
all
of
the
different
aspects
of
it
and
then
the
other
thing
is
the
training
and
the
testing.
I
think
that's
really
important.
E
It
keeps
people
more
aware,
it
keeps
people
on
their
toes.
It
keeps
people
thinking
and
again.
All
of
this
is
part
of
that
cyber
culture,
where
everybody
is
focusing
on
cyber,
because
one
of
the
things
that
that
we
say
is
no
one
person
is
more
important
than
the
next.
When
it
comes
to
cyber
security
at
your
organization,
I
don't
care
who
you
are,
what
you
do,
what
your
job
is,
where
you're
at
everybody
is
just
as
important.
Everybody
could
be
that
weakest
link
so
that
cyber
culture
keeps
everybody
kind
of
thinking
about.
E
Well,
is
this
really
something
that
I
expected
to
have
emailed
to
me?
Is
this
something
that
I
should
click
on?
Maybe
I
should
pick
up
the
phone
and
call
this
person,
but
without
that
cyber
awareness
and
that
culture,
and
that
constant
training
and
testing
people
might
not
think
about
it
and
just
click
on
it
and
go,
and
then
that's
where
the
start
of
the
next
news
headline
is.
So
I
think
that
layered
defense
and
the
holistic
approach
is
kind
of
the
best
way
to
look
at
things.
C
So
I'm
going
to
ask
ashley
one
question
and
then
we're
going
to
turn
to
the
audience
and
if
any
of
you
have
questions
for
our
panel
audience,
members
in
the
auditorium
should
come
to
the
microphone
set
up
in
the
aisle.
Our
live
stream
audience
should
email
their
questions
to
cybersymposium
at
norwich.edu
and
we'll
read
them
aloud
so
ashley.
While
all
of
you
are
thinking,
can
you
talk
to
as
a
data
analyst
at
the
center
for
national
center
for
missing
and
exploited
children?
F
Yeah,
I
can
definitely
expand
a
little
bit
more
on
my
job
and
what
that
looks
like
and
how
we're
adding
to
the
cyber
world.
So
the
national
center
for
nursing
exploit
children
gets
lots
of
data.
We
get
data
from
law
enforcement
from
different
esps
so
from
electronic
service
providers.
So,
like
facebook,
instagram
tick,
tock
twitter,
we
get
a
lot
of
information
when
they
see
child
exploitation
or
else
missing
children,
and
so,
within
my
role,
we're
developing
tools
to
help
analysts
be
able
to
more
quickly
process.
F
Those
a
lot
of
the
data
comes
in
these
long,
free
free
text
fields
and
we
get
millions
a
year.
So
there's
our
analysts
don't
have
time
to
read
through
every
single
report
and
so
within
myspace.
In
my
sphere,
I've
been
working
on
tools
to
use
natural
language
processing,
to
kind
of
shift
through
that
and
to
streamline
some
of
the
analyst
workflows.
F
So,
overall,
it
leads
to
a
lot
of
tool:
development
within
those
esps
as
well
they're
able
to
integrate
some
safer
measures
for
children,
and
you
see
out
of
that
improved
cyber
security
protocols
coming
out
of
a
lot
of
like
meta's
criteria
or
the
way
that
they
handle
imagery.
So
lots
of
cool,
exciting
stuff
going
on
there.
G
G
More
specifically
for
me
personally,
I
love
developing
malware
and
offensive
security
tools,
so
I
can
of
course
put
that
on
my
resume
as
in
hey,
I
know
how
to
do
this,
but
if
I
wanted
to,
let's
say,
prove
it
right,
meaning
I
would
release
source
code
and
things
like
that.
I
personally
cannot
do
that.
Ethically.
D
Loosely
described
the
team
that
I
work
with
a
bunch
of
talent,
again,
passion
equals
talent
and
one
of
the
things
that
that
we
would
do
is
we
call
it
a
puppy
challenge
and
what
that
started
with
was
a
colleague
of
mine
who
was
the
ceo
of
the
company.
His
wife
bought
a
havanese
puppy
online
for
500.,
and
this
is
during
covid.
So
when
it
was
all
said
and
done,
it
was
about
seven
thousand
dollars
and
the
puppy
never
existed.
D
The
website
that
she
went
to.
So
I
asked
him
I
said
what'd,
you
do
he
was
well.
I
called
the
local
law
enforcement
they're
like
what?
What
do
you
want
us
to
do?
He
notified
federal
law
enforcement.
They
said
yeah,
sorry,
and
so
he
said.
What
can
you
do
so?
I
applied
my
skill
set
to
it
developed
it
got
it
so
far
and
threw
it
to
my
cyber
guys
and
said:
what
can
you
do
and
so
they
took
that
it
went
from
all
of
the
websites
that
I
identified
based
on
the
data.
D
So
it's
just
not
a
person,
it's
the
it's.
The
websites
multiple
websites
same
domain
shipping
company,
which
is
all
the
websites
are
doing,
is
driving
you
to
the
shipping
company.
That
gets
you
past
the
500
and
get
you
into
the
seven
thousand
dollars
and
they
want
it
in
pre-loaded
credit
cards,
you
know,
visas,
etc.
So
there's
no
attribution
to
them.
The
long
and
short
of
it
is.
I
threw
a
puppy
challenge
at
my
my
peers,
my
my
team,
once
they
got
past
what
I
had
done
and
they
got
to
okay.
D
Well,
this
went
through
nigeria.
We
actually
know
the
names
of
the
people
there.
It
went
over
to
an
account
in
china
and
so
on
and
so
forth,
and
so
that
passion
when
they
had
a
problem,
they
demonstrated
their
passion
by
developing
certain
technology
on
the
fly
to
overcome
the
problems
that
I
was
discussing,
and
so
in
any
spectrum,
if
you're
aligned
with
people
like
that,
if
you
don't
my
nephew's
another
example
he's
I
introduced
him
to
that
group.
D
Puppy
challenge
comes
his
way,
similar
to
what
I'm
teaching
I'll
throw
a
problem
at
you,
so
that
I
can
see
what
you're
going
to
do
if
you're
passionate
equals
talent.
You're
going
to
see
it
you're
going
to
understand
it
you're
going
to
overcome
it.
There's
your
bona
fides
right.
There,
you're
you're,
functional
you're,
successful
in
your
approach
and
what
you're
doing,
and
so
I
would
recommend,
if
you're,
putting
the
stepping
stones
between
you
a
strategy
is
nothing
more
than
how
you
get
from
a
to
b
right,
exactly
yeah.
D
I
flunked
that
question
in
grad
school
because
I
gave
the
dictionary
definition
all
it
is
is
how
to
get
from
a
to
b,
if
you're
a-
and
you
know
what
b
is
work
backwards
from
that.
What
are
the
stepping
stones
to
get
you
there?
Your
education,
aligned
you've
got
students
all
around
you.
Some
of
them
may
be
passionate
equal
they're
working
on
their
own
projects,
they're
developing
their
own
stuff,
it's
working
outside
the
box.
That
makes
you
that
that
that
monetizes,
your
passion
again
equalized
as
talent.
So
that
would
be
my
short
answer.
H
We've
been
listening
to
how
kids
are
getting
hands-on
devices
a
lot
earlier
and
how
it's
super
intuitive,
to
go
on
youtube
and
search
up
whatever
you
want
to
look
for,
and
I've
noticed
with
discussions
with
a
lot
of
people
common
sense.
Security
measures
such
as
mfa
are
considered
this
big
hassle
that
no
one
wants
to
deal
with,
and
yet
a
lot
of
cyber
security
tools
that
are
accessible
need
to
be
used
by
more
people
to
just
make
their
make
their
digital
lives
a
lot
more
secure.
H
C
So
you
probably
don't
know
what
cocoa
melon
is.
I
have
a
two
and
a
half
year
old
grandson
who
can
walk
up
to
the
tv
and
put
it
on
user
interfaces
today
are
far
easier
than
they
ever
were,
but
I
would
imagine
one
of
the
two
ladies
might
have
some
thoughts
on
specifically
ways
to
make
cyber
security
applications
easier.
E
I
think
education
is
one
of
the
first
things.
People
don't
know
about
it.
I'll
talk
to
my
family
members
about
the
password
managers.
You
know
what
you
know,
what
you're
making
all
of
your
things
this
one
password
when
I
ask
well,
you
know
how
do
you
get
into
this?
Oh,
my
password
is
this
for
everything
and
and
they
don't
know
what
a
password
manager
is.
That's
not
their
fault.
E
That's
not
a
common
thing
that
we
all
go
out
and
have
coffee
and
talk
about,
but
if
it
was
something
that
we
had
a
little
more
education
about,
that
was
a
little
more
readily
accessible
and
it
was
out
there
a
bit
more.
I
think
everybody
would
go.
You
know
what
this
isn't
that
hard
to
use.
This
is
really
easy
to
use.
It
secures
all
my
information.
It
keeps
me
from
having
to
remember
the
passwords
and
a
lot
of
these
password
managers
too.
You
can
put
your
credit
card
information
in
there.
E
C
B
I
Being
able
to
teach
passion,
I
think,
is
hugely
important,
and
I
think
that
if
you're
looking
to
hire
people
attitude
and
passion
and
the
willingness
to
keep
learning,
because
you
can
go
to
school
and
get
a
degree,
but
that's
not
the
end
of
it,
you
know
I'm
nearing
retirement,
I'm
still
going
to
courses
and-
and
you
know
getting
more
education.
My
question
is,
as
we
have
these
issues
with
lack
of
workforce
availability.
I
F
C
Thanks
so
I
think
that
pretty
much
wraps
up
our
panel,
I
just
would
like
to
say
to
the
students
that
are
still
in
the
room,
I'm
extraordinarily
jealous
as
an
old
core
member.
I
didn't
have
these
kinds
of
opportunities
when
I
was
here,
take
advantage
and
learn
everything
you
can,
because
you'll
find
this
place
really
will
set
you
up
for
success.
So
thank
you.