Thread by @RobertMLee

To the security professionals facing difficulties getting an entry level job, being properly resourced, facing internal policy issues, being beaten down by competing frameworks/guidance/advice even from USG...the “if NSA could monitor your networks we’d fix it” is insulting.

I really do like the NSA; having served there I know the amazing work they do. I’m also a privacy advocate as many there are. There’s real roles and responsibilities for government to help private sector. More surveillance isn’t the answer. Actually there is no one answer.

When you’re in USG (NSA/DHS/DOD/etc.) you hear that people need help. You have insights and training. You want to help. It’s awesome. But the problems aren’t that simple. You also see rising threats but don’t see the closure that happens inside those companies. It creates angst

There’s really important government led changes needed. But there’s also board and CEO level management of risk needed. No government can scale to these problems. No company can. You have to build and incentivize and ecosystem wide approach.

You have *the* answer? How does it scale to 55,000 water companies to start with most who don’t have an IT person let alone a security team? That’s just one sector. NSA would love, out of good intentions, to monitor US infrastructure. It won’t put a dent in cybersecurity.

What I’d love to see is clear communication from government at CEO level on what they want private sector companies to do and invest in. Then for USG to focus on USG mission space. Our weapon systems, federal owned infrastructure, government networks, etc. are not consistent.

USG needs to fix USG mission space. Then tell everyone loudly what worked and didn’t work for them. Share insights. But when you have SolarWinds in USG, OPM, etc. please don’t tell others you can help them with the same problems you don’t have under control.

I’m a huge fan of CISA. I agree with @C_C_Krebs testimony recently on making CISA the federal CISO. Give them the resourcing *and* authorities to hunt and enact change across USG mission space. Tons of national security impacting work to be done.

When theres a short term mission set to pick up (e.g. election security) go for it and help. But long term mission sets you must be careful on. If you say “I’ve got the ball” you’ve got to have it. Others will stop investing. And frankly there’s too much work in USG for much else

NSA has important Title 50 missions. Candidly I think CYBERCOM and NSA should split. And we should keep NSA focused on the amazing SIGINT work it does and out of domestic cybersecurity. To all my govt peers I know this isn’t easy stuff.

For national security needs - not cybersecurity needs - USG wants to know certain things like how far wide impacting is a threat, do the entities know about it, etc.? That can be solved for separately but shouldn’t be conflated with “we’re doing this to help make you cyber safe”