Kenneth Bible walked into the DHS CISO job on January 3, 2021, with the agency still reeling from the SolarWinds hack. Now a board member at Crytica Security, the former DHS CISO and Marine Corps CIO joins the show to trace a career that started on nuclear submarines at the Charleston Naval Shipyard and ran through the NMCI transition to NGEN. He explains why governance, not technology, was the real fix after SolarWinds, how a Unified Cybersecurity Maturity Model helped 13 component CISOs prioritize roughly a billion dollars in requests, and why he pushed NIST to wrap governance around the entire Cybersecurity Framework rather than bolt it on as another pillar.
Then the conversation turns to the attack surface nobody owns. Ken makes the case that operational technology has become the adversary's preferred target, from port cranes and water meters to LNG tankers and a grid that spent four hours rebalancing after a single Northern Virginia data center dropped its AI load. He explains why a 600MB EDR agent will never fit on an 8MB PLC, why IT and OT teams still don't talk, and what it takes to bring OT risk to the board.Resources Mentioned in This Episode
Featured Guest
• Kenneth Bible, Board Member, Crytica Security, and former CISO, U.S. Department of Homeland Security
• Crytica announcement of Ken joining its board
SolarWinds and Federal Cyber Governance
• Executive Order 14028, Improving the Nation's Cybersecurity
• NIST Cybersecurity Framework 2.0
• CISA Known Exploited Vulnerabilities (KEV) Catalog
• CISA Software Bill of Materials (SBOM)
• CISA Binding Operational Directive 26-02
• Committee on National Security Systems (CNSS)
OT and Critical Infrastructure Security
• CISA advisory on Volt Typhoon targeting U.S. critical infrastructure
• NIST SP 800-82, Guide to Operational Technology Security
• CISA Industrial Control Systems resources
• National Rural Water Association
• DEF CON Franklin volunteers helping small water utilities
Recommended Reading
• The High-Velocity Edge, by Steven Spear
• Wiring the Winning Organization, by Gene Kim and Steven Spear
The Monday-Morning Takeaways (Ken Bible)
• Take care of the people, because they take care of the mission
• Build relationships with OT owners to expose blind spots, and help rather than dictate
• Have the conversation up the chain, with the risk, the plan, and the result
Related Episodes
• Episode 7 | When IT meets OT, with Matthew Shelbetter of Armis
• Episode 5 | GRU router hacking, Iranian PLC attacks, and Project Glasswing
The Hosts and Show
• Swish