Outrunning the Storm: Cyber Resilience Lessons from the CIA's Digital Transformation

Outrunning the Storm: Cyber Resilience Lessons from the CIA's Digital Transformation

Speakers: Jennifer Ewbank (Former Deputy Director of CIA for Digital Innovation); Rich Baich (SVP & CISO, AT&T)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=GghuBGDrmTI

Overview

In an era where the cybersecurity landscape increasingly resembles a tempestuous sea, organizations are constantly battling evolving threats and relentless attacks. At Black Hat MEA, Jennifer Ewbank, former Deputy Director of the CIA for Digital Innovation, and Rich Baich, SVP & CISO of AT&T and former CISO of the CIA, shared invaluable insights on building cyber resilience under extreme pressure. Their talk, "Outrunning the Storm: Cyber Resilience Lessons from the CIA's Digital Transformation," framed cybersecurity challenges as a perpetual storm, emphasizing that waiting for calmer seas is not an option for mission-critical organizations.

The fireside chat offered a unique perspective, drawing directly from their experiences at the Central Intelligence Agency – an environment characterized by a "no-fail mission" and relentless, sophisticated adversaries. The discussion transcended typical security advice, delving into the cultural, leadership, and strategic shifts required to not just protect systems, but to actively enable organizational success in the face of continuous cyber threats. Their transition from government to prominent roles in the private sector also provided a rare bridge, highlighting how lessons learned in the highest echelons of national security can be translated and applied to drive cyber resilience across diverse industries.

Ewbank and Baich underscored that true cyber resilience is not merely about defensive fortifications but about constant adaptation, strategic innovation, and a profound understanding of the adversary. They challenged conventional thinking, advocating for a holistic approach that integrates offensive intelligence into defensive strategies, fosters a culture of continuous improvement, and leverages emerging technologies like AI to maintain an edge. This talk served as a compelling call to action for cybersecurity leaders to embrace the storm, build stronger "ships," and navigate with unwavering purpose.

Background

▶ Watch: Introduction and unique CIA environment (0:00)

The Central Intelligence Agency operates under a "no-fail mission" concept, meaning operations must be maintained 100% of the time, 24/7, with zero tolerance for outages or failure. This unique operational imperative forms the bedrock of the challenges discussed by Ewbank and Baich. When Rich Baich transitioned from the private sector to the CIA as CISO, he was struck by the agency's distinct environment, recalling anecdotes of new hires quitting upon realizing cell phones were prohibited – a stark contrast to typical corporate settings. His experience securing "a rock in the middle of the desert" highlighted that while environments might seem unique, the fundamental principles of risk management and IT inventory understanding remain universal.

Jennifer Ewbank, leading innovation at the CIA, faced the formidable task of driving change within an organization that demands absolute operational continuity. This required building immense trust and credibility, delivering incremental changes, and, crucially, fostering a deep understanding of the threat landscape among the workforce. The CIA, being perhaps one of the most heavily targeted organizations globally, necessitates an unparalleled focus on understanding adversary motivations, capabilities, and tactics. This constant pressure and dynamic threat environment meant that cybersecurity could never be a static "program" with a defined end, but rather a process of continuous adaptation.

The speakers also touched on the pervasive stereotypes that often hinder collaboration between government and industry: government as slow and bureaucratic, industry as fast and reckless. They argued that neither stereotype holds true, and both sectors possess unique strengths. Government excels in discipline, mission clarity, and operating under extraordinary pressure, while industry thrives on speed, creativity, and continual innovation. The core challenge, and indeed a significant opportunity, lies in bridging these two worlds to harness their combined power for enhanced cyber resilience. This context sets the stage for their proposed strategies, which aim to transcend these traditional divides and cultivate a more integrated, proactive, and resilient security posture.

Key Findings

▶ Watch: Driving innovation in a no-fail mission (3:08)

The talk unveiled several critical findings and strategic shifts derived from the speakers' experiences at the CIA, offering a blueprint for enhancing cyber resilience in any organization:

1. Reframing Cybersecurity as a Mission Enabler: A fundamental shift was made from viewing cybersecurity solely as a protective or cost-center function to seeing it as a direct enabler of the organization's core mission or business objectives. Rich Baich articulated this through the simple yet powerful mantra: "Know it, get it, and use it." This meant collecting only necessary information, understanding its audience, ensuring rapid refresh cycles, and prioritizing speed in decision-making. The goal was to align security efforts directly with mission success, rather than merely preventing failure.

1. Adversary-Centric Defense: Jennifer Ewbank emphasized the paramount importance of deeply understanding the adversary. This involved knowing "what your adversary out there is trying to do to undermine your organization," including their capabilities, resources, and motivations. This deep intelligence, derived from offensive insights, became the driving force behind defensive strategies, ensuring that security measures were directly aligned with preventing the most potent and relevant threats.

1. Offense-Defense Fusion (Purple Teaming): A transformational finding was the integration of offensive and defensive cyber operations. The speakers advocated for breaking down traditional silos between "blue teams" (defenders) and "red teams" (attackers), creating what they termed a "purple team" environment. This involved cross-training personnel, placing individuals with offensive backgrounds into defensive leadership roles (and vice versa), and fostering deeper collaboration. The objective was to leverage offensive insights to strengthen defense proactively, moving beyond theoretical exercises to practical, intelligence-driven security.

1. Leveraging Attack Simulation with Adversary Intelligence: Building on offense-defense fusion, the CIA significantly advanced its use of attack simulation. This wasn't merely generic testing but simulations "informed by what you understand of your most capable adversaries." The simulations aimed to demonstrate whether controls worked, identify weaknesses against specific threat scenarios, and broaden the horizons of defensive teams by exposing them to realistic attack vectors. This approach significantly improved the team's strength and preparedness.

1. Driving Cultural Change through Transparency and Gamification: To embed cybersecurity deeply within the organizational culture, the CIA tapped into the competitive nature of its workforce. Rich Baich described using gamification and public dashboards that displayed individuals' or teams' security achievement levels. This transparency and healthy competition proved highly effective in driving desired security behaviors and fostering a collective sense of responsibility.

1. The Power of Partnerships: Both speakers highlighted that resilience is heavily dependent on strong partnerships. This includes internal collaboration across departments, partnerships between businesses, between government and industry, and with international allies. In an increasingly complex threat landscape, no single entity can know everything, making the sharing of knowledge, strengths, and intelligence through collaboration absolutely critical.

1. AI as a Defensive Imperative: A forward-looking finding was the necessity of leveraging Artificial Intelligence (AI) for defensive purposes. While adversaries are already using AI to operate at "machine speed" (as noted in reports like the Anthropic study mentioned by Jennifer Ewbank), defenders must also adopt AI to counter this speed advantage. Rich Baich underscored that AI is a critical enabler for the mission, and cyber defenders must understand its risks while harnessing its power to stay ahead.

These findings collectively underscore a proactive, intelligence-driven, and culturally integrated approach to cybersecurity, moving beyond reactive measures to build inherent organizational resilience.

Technical Deep Dive

▶ Watch: Reframing cybersecurity for mission success (5:55)

While the talk primarily focused on strategic and cultural aspects, it implicitly outlined several technical approaches and methodologies crucial for achieving cyber resilience, particularly within a "no-fail" mission context. These technical elements are less about specific tools or code and more about the architectural and operational design of a robust security posture.

A foundational technical principle discussed by Rich Baich was the imperative of understanding the IT inventory. This seemingly basic task is, in fact, a critical technical prerequisite for any effective security program. Without a comprehensive and accurate inventory of all assets – hardware, software, network devices, cloud instances, and data repositories – it is impossible to consistently deliver cybersecurity protocols and controls. This involves not just listing assets but understanding their configurations, interdependencies, and the data they process, forming the basis for a risk management framework. The challenge, as Baich noted, is to apply these controls effectively across diverse and often "unique" environments.

The concept of Offense-Defense Fusion, or Purple Teaming, represents a significant technical and operational architectural shift. Instead of separate, often adversarial, red and blue teams, the CIA actively integrated these functions. Technically, this means designing security operations centers (SOCs) and incident response teams (IRTs) to incorporate insights directly from offensive intelligence and red team engagements. This involves:

• Shared Tooling and Platforms: Implementing common platforms for threat intelligence sharing, incident management, and vulnerability tracking that are accessible to both offensive and defensive teams.
• Integrated Threat Intelligence: Direct ingestion of cyber collection (offensive intelligence) into defensive systems, allowing for real-time adjustments to security controls, detection rules, and incident response playbooks.
• Cross-functional Training: Technical personnel from defensive teams participating in offensive exercises, and vice versa, to understand attack methodologies from the adversary's perspective and defensive blind spots from the defender's view. This practical experience directly informs the development of more robust security architectures and detection engineering.

Central to this fusion is attack simulation, which Jennifer Ewbank highlighted as being "informed by what you understand of your most capable adversaries." This isn't just running automated vulnerability scans but involves:

• Threat Emulation: Technically mimicking the tactics, techniques, and procedures (TTPs) of known, sophisticated adversaries. This requires detailed intelligence on specific malware families, exploit kits, command and control (C2) channels, and persistence mechanisms used by state-sponsored or advanced persistent threat (APT) groups.
• Control Validation: Testing the efficacy of various security controls – including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoint detection and response (EDR) solutions, and security information and event management (SIEM) rules – against these emulated attacks.
• Scenario-Based Testing: Developing complex, multi-stage attack scenarios that mirror real-world campaigns, allowing teams to evaluate their detection, analysis, and response capabilities under pressure. This goes beyond individual control testing to assess the entire security kill chain.

The discussion also veered into the technical implications of AI in cybersecurity. Rich Baich emphasized that AI is a "huge enabler" for the mission, but its use by adversaries to achieve "machine speed" significantly reduces the time available for defenders to react. This necessitates a technical counter-response:

• AI for Automated Defense: Deploying AI-powered security solutions for tasks like anomaly detection, threat hunting, malware analysis, and automated incident response. Jennifer Ewbank specifically mentioned autonomous decision-making in defense "to close the gate, raise the drawbridge, stop an attack, and then bring in humans" – implying AI-driven, real-time blocking capabilities that operate faster than human intervention.
• Risk Management for AI Systems: Developing robust frameworks for assessing and mitigating the risks associated with deploying AI in critical security functions, including issues of bias, explainability, and adversarial AI attacks against the defensive AI itself.
• Data-Driven Security Posture: The "Know it, get it, and use it" principle inherently relies on sophisticated data collection, processing, and analysis capabilities. This includes deploying advanced telemetry from endpoints, networks, and cloud environments, and using analytics platforms to derive actionable security intelligence.

In essence, the technical deep dive, though implicit, points to an advanced security operations model that is intelligence-driven, highly integrated, continuously tested against realistic threats, and increasingly augmented by artificial intelligence to match the speed and sophistication of modern adversaries.

Demo / Proof of Concept

▶ Watch: Bridging government and private sector strengths (12:15)

As a fireside chat format, the presentation "Outrunning the Storm: Cyber Resilience Lessons from the CIA's Digital Transformation" did not include a live demonstration or a proof of concept. The discussion focused on strategic insights, leadership principles, and organizational changes rather than specific technical implementations or tools.

Defensive Implications

▶ Watch: Optimism for cybersecurity's future, despite AI threats (16:15)

The insights shared by Jennifer Ewbank and Rich Baich offer profound implications for cybersecurity defenders across all sectors, urging a shift from reactive protection to proactive, mission-aligned resilience.

1. Reframe Cybersecurity's Value Proposition: Defenders must articulate cybersecurity's role not just as a cost center or a barrier, but as a direct enabler of business and mission success. By aligning security initiatives with organizational objectives, CISOs can gain executive buy-in and integrate security thinking from the outset of projects, rather than as an afterthought. This means understanding what the business needs to achieve and then securing that pathway.

1. Cultivate an Adversary-Centric Mindset: Go beyond generic threat models. Defenders need to deeply understand their specific adversaries – whether they are nation-states, organized crime, or competitors. This involves continuous threat intelligence gathering to understand their motivations, capabilities, common TTPs (Tactics, Techniques, and Procedures), and typical targets. This intelligence should directly inform security investments, control placements, and incident response planning, ensuring resources are allocated to counter the most pertinent threats.

1. Implement Offense-Defense Fusion (Purple Teaming): Break down silos between red and blue teams. Organizations should actively foster collaboration by creating "purple teams" or cross-training initiatives. This could involve rotating security analysts between defensive and offensive roles, sharing threat intelligence feeds, and having red team findings directly inform blue team detection and response strategies. The goal is to build a defender's understanding of how attackers operate, leading to more effective and efficient defense.

1. Embrace Intelligence-Driven Attack Simulation: Move beyond basic vulnerability scanning. Defenders should regularly conduct attack simulations that emulate the TTPs of known, highly capable adversaries relevant to their sector. These simulations should be used to test the effectiveness of existing controls, identify gaps in detection and response capabilities, and train security teams under realistic pressure. This iterative process of testing, learning, and adapting is crucial for continuous improvement.

1. Drive Cultural Change through Transparency and Gamification: Leverage internal competition and transparency to elevate security awareness and adherence. Implement internal dashboards or reporting mechanisms that highlight security posture improvements, compliance rates, or successful incident responses. Consider gamification strategies to incentivize secure behaviors, making security a shared responsibility rather than solely the domain of the security team.

1. Prioritize and Foster Partnerships: Recognize that no organization can stand alone against sophisticated threats. Defenders should actively build and nurture partnerships – internally across departments (IT, legal, HR), externally with industry peers, threat intelligence sharing organizations, and government agencies. Collaborative intelligence sharing, joint exercises, and mutual support are vital for enhancing collective resilience.

1. Strategically Adopt AI for Defense: Acknowledge that adversaries are already leveraging AI for speed and scale. Defenders must strategically invest in and deploy AI-powered security solutions to match or exceed this pace. This includes AI for threat detection, anomaly analysis, automated response actions (like blocking or quarantining), and threat hunting. However, this adoption must be coupled with robust risk management frameworks for AI systems, ensuring ethical use, transparency, and human oversight.

1. Elevate Cybersecurity to a Board-Level Priority: Ensure that cybersecurity is consistently presented as a critical business issue at the highest levels of the organization. This involves communicating risks in business terms, demonstrating ROI on security investments, and advocating for security to be integrated into strategic planning from inception. This ensures that security receives the necessary resources and attention to be truly effective.

By adopting these principles, organizations can move beyond simply reacting to cyber threats and instead build a dynamic, adaptive, and highly resilient security posture capable of navigating the perpetual "cyber storm."

Key Takeaways

• Cybersecurity is Mission Enablement: Reframe cybersecurity from a cost center to a critical enabler of organizational mission and business success, integrating security into strategic objectives from the outset.
• Know Your Adversary: Develop a deep, intelligence-driven understanding of specific threat actors, their motivations, capabilities, and TTPs, to proactively inform and prioritize defensive strategies.
• Integrate Offense and Defense: Break down silos between offensive and defensive teams (purple teaming) through cross-training and collaboration, leveraging red team insights to strengthen blue team detection and response.
• Practice Intelligence-Led Attack Simulation: Regularly conduct realistic attack simulations that mimic sophisticated adversary TTPs to continuously test, validate, and improve the effectiveness of security controls and incident response capabilities.
• Cultivate a Security-First Culture: Drive enterprise-wide cultural change through transparency, gamification, and leadership emphasis, making cybersecurity a shared responsibility and a source of competitive pride.
• Harness AI for Defensive Speed: Proactively adopt and integrate AI technologies into defensive strategies to counter the machine-speed operations of adversaries, while establishing robust risk management for AI systems.
• Build Strong Partnerships: Recognize that collective resilience depends on strong internal, cross-industry, and government-industry partnerships for intelligence sharing, collaboration, and mutual support.

About the Speaker(s)

Jennifer Ewbank served as the Deputy Director of the CIA for Digital Innovation, where she was responsible for leading the agency's efforts in IT, data, and AI. Her background includes extensive experience working globally with foreign partners on information collection, which profoundly shaped her perspective on understanding adversaries. Since leaving government in 2023/2024, she has transitioned into board and consulting roles in the private sector, focusing on bridging government and industry insights for enhanced cyber resilience.

Rich Baich is currently the SVP & CISO at AT&T, bringing extensive experience from both the private sector and government. Prior to his role at AT&T, Baich served as the CISO for the Central Intelligence Agency, a position he took after having been CISO at three other large companies. His diverse background provides a unique perspective on managing cyber risk and driving security transformation across highly varied and complex environments.