Episode 48 of The Security Podcast of Silicon Valley aired on June 29, 2024, with Jon McLachlan hosting. The guest was Dr. Georgianna Shea, who goes by George, chief technologist at the Foundation for Defense of Democracies (Podbean). Jon’s introduction started with her last job.
“Looks like you were a chief engineer at MITRE.”
Jon McLachlan, at 0:21
Her FDD biography fills in the rest. She is chief technologist at FDD’s Center on Cyber and Technology Innovation (CCTI) and its Transformative Cyber Innovation Lab (TCIL), with nearly 30 years across the federal and commercial sectors. She served on the cyber-physical resilience working group of the President’s Council of Advisors on Science and Technology, is part of the CyberWire’s Hash Table of experts, and has taught at Colorado Technical University, the University of Maine at Augusta and Fusion Cyber. She holds a Doctor of Computer Science from Colorado Technical University, a master’s in computer and information sciences from Regis University and a bachelor’s in computer science from Hawaii Pacific University (FDD). Her LinkedIn dates the TCIL role to January 2021, her seat on the Cybeats advisory board to April 2023, her work on the Global Resilience Federation’s Operational Resilience Framework task force to 2021, and her membership in the Cybersecurity Canon to September 2021 (LinkedIn). Cybeats announced her appointment on April 20, 2023 (Cybeats).
For readers outside Washington, a few of the names. FDD is a 501(c)(3) nonprofit think tank in Washington, D.C. (Wikipedia). MITRE is an American not-for-profit organization that manages federally funded research and development centers for U.S. government agencies in aviation, defense, healthcare, homeland security and cybersecurity (Wikipedia). Those centers, FFRDCs, are public-private partnerships that do research and development for the government (Wikipedia). And PCAST is a council chartered in each administration to advise the president on science and technology (Wikipedia).
The tape doesn’t give a recording date. It fits 2023. George says Rick Howard’s book came out earlier this year, and Wiley published it in April 2023 (O’Reilly). She expects NIST’s post-quantum guidance next year, and NIST finalized its first three post-quantum standards on August 13, 2024 (NIST). She describes the PCAST working group as still at work, and PCAST released its report on February 27, 2024 (White House archives). And Jon says he recorded Feross Aboukhadijeh of Socket a couple of days earlier, for episode 36, which aired on February 1, 2024.
This page is the rest of it: a section for each part of the conversation with the sources beside it, nineteen figures, twenty-eight clips from the tape, the full transcript, and five tools: a quiz, a scorecard for whether you know what’s in your software and can keep running when it fails, a calculator for how many components the next Log4j would make you check, a timeline from 1984 to 2026, and a to-do list.
A note before the sections. A few names on the tape are hard to hear, and where the decodes disagree, the transcript marks its best guess in brackets and the page doesn’t quote those words. The stories about her pilots, the draft NDAA and the policies they reached are her account, and the page says so.
A Doctor of Computer Science
Jon had her degree down as a PhD. George corrected it, gently.
“Technically, it’s a Doctor of Computer Science.”
Georgianna Shea, at 0:41
“A doctor in computer science is more of a practitioner degree.”
Georgianna Shea, at 0:54
The point of the practitioner degree, she said, is that you work on the computers instead of only theorizing about them. Asked about her area of study, she named cybersecurity, which she has worked in for more than 20 years.
“I’ve been working in cybersecurity for over 20 years.”
Georgianna Shea, at 1:06
Information assurance is the practice of managing the risks around how information is used, processed, stored and transmitted, protecting its integrity, availability, authenticity, non-repudiation and confidentiality, and Wikipedia calls it a superset of information security (Wikipedia). The Cybeats announcement describes her doctorate as a Doctorate in Computer Science in Information Assurance from Colorado Technical University (Cybeats), a private university founded in 1965 whose students are about 92% online (Wikipedia).
Advance cybersecurity for the purpose of national security
Before the details, George wanted to explain what the titles meant. For most of her career she supported the Department of Defense: the Marine Corps, the Air Force, Space Force and the Office of the Secretary of Defense, operationalizing systems and making sure they were secure. FDD is a different job.
“It’s really to advance cybersecurity for the purpose of national security through recommendations to policy and legislation.”
Georgianna Shea, at 2:55
Her job at the think tank isn’t to build a system, audit one or check its controls. It’s to change the policy and law that every system lives under. A think tank, in Wikipedia’s definition, is an organization that does research and advocacy on topics like social policy, economics, the military and technology (Wikipedia).
At FDD, I get to work on whatever I want to work on
Jon asked what a typical day looks like. George’s answer started with the difference from her old jobs.
“At FDD, I get to work on whatever I want to work on.”
Georgianna Shea, at 3:42
At a company, she said, you work for a sponsor or a customer, and an idea outside the scope gets a manager’s answer: that’s not our job, we’re supposed to deliver A and B on this budget. That makes sense, she said, but it confines people. At FDD there’s no sponsor setting the agenda, because the work is paid for by philanthropy.
“I don’t have a person telling me this is what I need to work on.”
Georgianna Shea, at 5:26
So her days run on recurring sync meetings with experts she admires, every six weeks or every month or every quarter depending on their schedules, standing FDD meetings to find overlap with colleagues, and a set of community efforts outside the building.
A working group for cyber-physical systems resilience
The first community effort she named was PCAST.
“There’s a working group we’re working on for cyber-physical systems resilience.”
Georgianna Shea, at 5:59
“They’ve asked me to join this working group to identify recommendations to the president to ensure resilience of our cyber-physical systems.”
Georgianna Shea, at 6:02
She named some of the council’s members: Phil Venables from Google, Eric Horvitz from Microsoft, the former astronaut Kathy Sullivan and a former secretary of the Navy. Eric Horvitz is a Technical Fellow at Microsoft and its first chief scientific officer (Wikipedia). Kathryn Sullivan is a geologist and oceanographer who flew on three Space Shuttle missions (Wikipedia). Wikipedia lists Phil Venables as the chief information security officer at Google Cloud (Wikipedia).
Cyber-physical systems are mechanisms controlled and monitored by computer algorithms, where the physical and software parts are deeply intertwined (Wikipedia). The working group’s report came out after the tape, on February 27, 2024. It asked for performance goals with minimum delivery objectives, research and development including a national critical infrastructure observatory, an end to silos, and accountability for boards and executives (White House archives).
The Operational Resilience Framework
The second effort was at the Global Resilience Federation, which ties together the information sharing and analysis centers, the ISACs.
“They have a Business Resilience Council, the BRC, that has developed an Operational Resilience Framework that helps organizations recognize how to maintain resilience.”
Georgianna Shea, at 6:41
An ISAC is a central resource for gathering information on threats to critical infrastructure and sharing it both ways between the private and public sectors (Wikipedia). The Operational Resilience Framework reached version 1.0 on November 17, 2022, from the Business Resilience Council and a cross-sector team of security leaders. Its seven-step path includes defining the minimum viable service levels for each operations-critical and business-critical service, and its working group wanted downstream customers, partners and counterparties to keep operating too (Business Wire). George comes back to that last part near the end of the episode, with a hospital and a concert venue.
Defending Against Disinformation
The third effort was a standard at OASIS Open, an industry consortium that develops technical standards for information technology (Wikipedia).
“I’m working on a project called DAD-CDM, which stands for the Defending Against Disinformation Common Data Model.”
Georgianna Shea, at 7:09
She compared it to the standards that already exist for exchanging cyber threat information, but for information objects. The project’s charter says it builds on STIX 2.1 and the DISARM frameworks so defenders can share threat and mitigation data quickly and at scale, and that the name changed on November 21, 2024 to the Common Data Model for Defending Against Deception (GitHub). MITRE, her old employer, created ATT&CK, a guideline for classifying and describing cyberattacks, released in 2013 (Wikipedia).
Pilot projects that explain hard things
On top of the community work, George runs pilot projects. The purpose of the job, she said, is to bridge the gap between existing technology and policy and governance, so the change reaches legislation and decision makers. A pilot demonstrates how something works so it can scale, and it gives decision makers something concrete. Her examples of the hard things a pilot makes plain were quantum and SBOM, so that people understand what someone means when they say the words.
Jon asked her to explain both for the listeners. She started with the second.
So SBOM, it’s a software bill of materials
“So SBOM, it’s a software bill of materials.”
Georgianna Shea, at 8:28
She loves the topic, she said, because of where she came from.
“I have a test and evaluation background.”
Georgianna Shea, at 8:36
“So you have to understand, I think, first, how do you evaluate software and what does that look like?”
Georgianna Shea, at 8:38
A software supply chain is the set of components, libraries, tools and processes used to develop, build and publish a piece of software, by analogy with the supply chain for physical goods (Wikipedia). An SBOM is the list for one piece of it. Under section 524B of the Federal Food, Drug, and Cosmetic Act, for example, makers of cyber devices must give the FDA one that covers commercial, open-source and off-the-shelf software components (FDA).
Tippy-top secret
To explain why testing isn’t enough, George picked the hardest case: a program inside the Department of Defense, the highest classified system, a weapon system. Jon liked her term for it.
“Top secret, yes.”
Jon McLachlan, at 8:52
When a program builds or buys a system like that, she said, it goes through a test and evaluation process as part of acquisition. For the software, the tests are mostly functional. Does it work? Does it do A, B and C? Then comes one more.
“Does it have any known vulnerabilities?”
Georgianna Shea, at 9:20
“So I have to stress the word known.”
Georgianna Shea, at 9:23
“If it hasn’t been discovered yet, you’re not looking for it.”
Georgianna Shea, at 9:26
A vulnerability nobody has found passes the test. It’s still there, doing whatever it was doing.
Dormant and passive code
The third kind of test looks at the efficiency of the code. Is there dead code, a module someone started and then stopped, sitting in thousands of lines? Dead code, in one definition, is code that can never be executed at run time (Wikipedia). George’s worry was the opposite kind.
“But if there’s working dormant and passive code in there, you’re probably not going to see it”
Georgianna Shea, at 10:01
Nothing in the test plan tells anyone what to look for. Code that works, waits and does nothing visible passes all three tests.
Don’t reinvent the wheel
Then the analogy. Software is built like a car, she said. The company that sells the car doesn’t make the tires.
“They just go buy tires from wherever.”
Georgianna Shea, at 10:16
Software works the same way. A developer grabs open source objects off the shelf, a time function, a logging function, the commonly used pieces, and plugs them in. Jon knew the engineer’s version.
“As an engineer, one of the sayings that I’ve heard over and over again is, don’t reinvent the wheel.”
Jon McLachlan, at 10:36
George agreed, and then added the part an SBOM is for.
“But at least look at how the wheel was made.”
Georgianna Shea, at 10:43
“Who made the wheel? Where’d it come from? What’s inside the wheel?”
Georgianna Shea, at 10:44
“Is it made of rubber, or is it made of plastic?”
Jon McLachlan, at 10:50
An SBOM, she said, takes the general contractor who wrote the software for your system and lists all the components it got from someplace else.
Four components, then thousands
One of her pilots made it concrete. The software was developed by the Air Force itself, for a particular use. She had a company analyze it.
“So you’re like, oh, well, that’s not too bad.”
Georgianna Shea, at 11:28
That was the first answer: four underlying components. Then they dug into the four.
“there were then like thousands of other components.”
Georgianna Shea, at 11:33
Who wrote that code, where it came from and what it was doing were open questions for every one of them. Later in the episode she says she ran the pilot with Ion Channel. Her conclusion wasn’t to stop using open source.
“The argument isn’t to stop the use of open source software.”
Georgianna Shea, at 11:44
“The argument, from my standpoint, is if you’re receiving that software, know what you’re getting.”
Georgianna Shea, at 11:49
“Understand what the risk is. Ask the question, accept or deny that risk.”
Georgianna Shea, at 11:55
She has worked on SBOM, she said later in the episode, since right after the SolarWinds compromise. That 2020 campaign, suspected to come from a group backed by the Russian government, penetrated thousands of organizations around the world, including several parts of the U.S. federal government (Wikipedia).
I use the word resilience a lot
Jon pointed out that national security means thinking about adversaries most security people never meet. George agreed, and then named the word she keeps coming back to.
“I use the word resilience a lot.”
Georgianna Shea, at 12:38
“I really push for resilience.”
Georgianna Shea, at 12:44
“I wish it would be cyber resilience versus cybersecurity”
Georgianna Shea, at 12:47
Cybersecurity, as she described it, has frameworks and regulation for protection: put up the wall, put up the barriers that stop the attacker getting in. Cyber resilience is the ability to keep delivering the intended outcome despite cyber attacks, and Wikipedia notes it matters for IT systems, critical infrastructure, business processes and nation-states alike (Wikipedia).
The adversary isn’t following that checklist
Protection, she said, turns into a compliance job for much of the defense industry. Are the controls in place? Did you do the things you were supposed to do?
“it becomes a compliance job.”
Georgianna Shea, at 13:11
“You do this checkmark kind of exercise of, okay, we did all these things, so therefore we’re secure. No, absolutely not.”
Georgianna Shea, at 13:17
“the adversary isn’t following that checklist.”
Georgianna Shea, at 13:27
Nobody on the offensive side opens the book of NIST controls to see which ones they can get through, she said. Compliance requirements, regulation and legislation don’t matter to them. NIST’s best-known book of controls, Special Publication 800-53, is a catalog of security and privacy controls for information systems, written for U.S. federal agencies and, since its fifth revision, a standard for general use (Wikipedia).
A third-tier supplier
Supply chain is where the adversary looks for the new and novel way in, she said, and it’s one of the hardest things to test.
“How do you ensure that you don’t have a third-tier supplier that’s putting something into the supply chain that’s going to be dormant and passive?”
Georgianna Shea, at 14:03
“It’s going to pop up later”
Georgianna Shea, at 14:11
Or it activates when something else touches it. These are very advanced nation-state tactics, she said, and she would imagine such things happen. She was careful about it: she isn’t saying she has been read into anything, only that it’s not beyond the realm of possibility. Then she said what makes the field exciting.
“If you build it, you can break it.”
Georgianna Shea, at 14:38
I think I fell into it
Jon asked where the drive came from.
“I think I fell into it, honestly.”
Georgianna Shea, at 15:01
“I hate it when you trip and you fall into cybersecurity.”
Jon McLachlan, at 15:04
It started with math, as far back as sixth grade.
“I always liked math, because I was good at it.”
Georgianna Shea, at 15:22
You can’t be wrong in math once you know it, she said. Nobody finds two plus two and tells you it’s six. Jon finished the thought.
“It’s a closed system. There’s rules. It works.”
Jon McLachlan, at 15:38
“It’s very binary.”
Georgianna Shea, at 15:41
Literature and history in school felt like memorizing chapters and guessing what the teacher was looking for, the date or the name. Math was the easy class. In physics she didn’t memorize the formulas.
“I didn’t memorize them.”
Georgianna Shea, at 16:40
She derived them again each time from what she knew.
The Army the day after high school
“I ended up joining the Army the day after I graduated from high school.”
Georgianna Shea, at 16:50
“I was gone for four years. I got to see the importance of national security.”
Georgianna Shea, at 16:55
After the Army she went to college and chose math, because she was good at it, without a clear idea of the career. Then she found that the math classes she had taken were the ones a computer science degree required. A couple of programming classes later, she had a degree that transferred more easily into the workforce, with a minor in mathematics. She was clear that math careers exist, and Jon agreed that math is a stepping stone to many of them.
Presidential Decision Directive 63
Her timing was good. As she finished the degree, the government started worrying about how people were breaking into its networks.
“President Clinton had signed the Presidential Decision Directive 63”
Georgianna Shea, at 18:05
At the time, she said, there was no network monitoring across the Department of Defense, and the directive said to start looking at how people were breaking in. Presidential Decision Directive 63, signed in May 1998, set up a national program of critical infrastructure protection (Wikipedia). The Army’s Pacific computer emergency response team was standing up its first group, and while she was in her last classes, she interviewed.
“they hired me as a network analyst.”
Georgianna Shea, at 18:53
A computer emergency response team, a CERT, is an incident response team for computer security incidents (Wikipedia). She thinks she was hired because she had a secret clearance from her Army years and a computer science major with a math minor. They wanted a mathematician, computer science, an electrical engineer and prior military, and she fit a lot of those boxes.
“And I wasn’t military, but I still had to support the military.”
Georgianna Shea, at 19:50
My favorite was always Excel
“And I loved it, because I love numbers.”
Georgianna Shea, at 18:56
“I love looking at IPs. I love looking at patterns, and it was really looking at logs all day.”
Georgianna Shea, at 19:00
After a while she would recognize a strange IP address from a month before and remember what it had done, and the profiles built up from there.
“So it’s very human intensive.”
Georgianna Shea, at 19:17
There were tools for all of it, she said, but her favorite was a spreadsheet.
“but my favorite was always Excel”
Georgianna Shea, at 19:36
“I’ll find a million things to pull out of it.”
Georgianna Shea, at 19:43
She manipulated the data herself and threw it into pivot tables. A pivot table summarizes the values in a larger table into groups, as sums, averages or counts (Wikipedia), and Excel lists them among its features (Wikipedia).
I’m in
Jon said it sounded like she had led with her strengths. She said it was funny he put it that way, because the jobs she took were often ones she knew nothing about.
“I have no test and evaluation experience whatsoever.”
Georgianna Shea, at 20:47
“I’m like, I’m in.”
Georgianna Shea, at 20:50
She would flounder for the first couple of months, she said, and that was fine.
“but I guarantee after I’ve been there for a year doing it, I’m going to know something.”
Georgianna Shea, at 20:59
Jon’s answer was that outside the comfort zone is where good growth happens. George went to FDD for the same reason. After about 13 years at MITRE she felt she wasn’t going anywhere else.
“I don’t say I was topped out, but it’s harder to progress within the company when you’re not at the headquarters”
Georgianna Shea, at 21:24
At MITRE the customers were the Department of Defense. At FDD it’s every sector of critical infrastructure.
“It’s been just a huge firehose of exposure to so many different areas.”
Georgianna Shea, at 21:41
A three-degree sector of a circle
Jon suggested the new job gave her a broader impact. George went back to compliance.
“So I mentioned earlier that I find that a lot of the cybersecurity world is very compliance driven.”
Georgianna Shea, at 21:58
Laws, policies, directives and GDPR shape a narrow view, she said.
“a three-degree sector of a circle, and that’s what you look at the whole time.”
Georgianna Shea, at 22:19
“you see the richness of the full spectrum of cyber and how they can relate.”
Georgianna Shea, at 22:26
Her example of how the pieces relate was the software bill of materials again.
What do you do when you have an SBOM?
She works with the SBOM community, she said, on the questions it is still working out. How do we get people to adopt it? How do you transfer SBOMs, and how do you develop them? Is there a standard format for all of them? And one question comes up a lot: what do you do once you have one? An organization required to get one has it in hand and doesn’t know what to do with it. She isn’t sure the software developers who make SBOMs can answer that. The answer, she said, sits on the compliance side.
A natural integration point
Every federal system goes through the Risk Management Framework, she said, and the people who run it determine the baseline of controls under national standards. They aren’t software developers, and they don’t necessarily know anything about SBOMs. Put what an SBOM can do next to what the framework requires, she said, and the fit is natural.
“This is exactly where the SBOM should go.”
Georgianna Shea, at 23:49
“So in your Risk Management Framework, there’s seven steps of assessing a system.”
Georgianna Shea, at 23:51
You classify the system, decide which controls it needs, implement them, test them and send it for approval. Wikipedia lists the seven as prepare, categorize, select, implement, assess, authorize and monitor, from NIST Special Publication 800-37 (Wikipedia).
“But it doesn’t get into what’s the history of the software”
Georgianna Shea, at 24:07
The framework’s supply chain tasks ask who developed the system and what the requirements were, she said, but stop at one tier. The company that built it may have used open source software licensed for commercial use, and nobody asks. The continuous monitoring step could watch those open source components too. The Risk Management Framework is NIST’s process for building security, privacy and risk management into the system development life cycle, and it’s how a system gets its Authority to Operate (Wikipedia).
Do we have Log4j?
Her best argument for that was an incident everyone remembered.
“So Log4j was a huge deal that also helped put SBOM on the map”
Georgianna Shea, at 25:03
When a company heard it was vulnerable if it had Log4j, she said, the first question was the obvious one.
“The first question is, do we have Log4j?”
Georgianna Shea, at 25:14
They had a package of software and didn’t know what was in it, so they had to go through and find out. Log4Shell, CVE-2021-44228, was reported in November 2021 in Log4j, a popular Java logging framework. It allowed arbitrary code execution, was exploited as a zero-day, and had existed unnoticed since 2013 (Wikipedia). Federal systems already go through the Risk Management Framework, she said, and adding an SBOM to it would give a greater understanding of the risk.
“But those two communities are separate communities.”
Georgianna Shea, at 25:37
The SBOM people ask what RMF is, she said, and the RMF people ask what an SBOM is. Jon summed it up as security folks in silos, and she agreed.
No one asked for it
Jon asked how her recommendations turn into policy. She started working on SBOM right after the SolarWinds compromise, she said, and wrote draft legislation and recommendations for the National Defense Authorization Act. Jon wanted to know who had asked.
“Well, no, no one asked.”
Georgianna Shea, at 26:47
“That’s my job. I find the gaps, and then I push it.”
Georgianna Shea, at 26:50
She also spoke at a small technical roundtable for the Senate Select Committee on Intelligence, she said, on the one thing in tech and cyber that would really make an impact against compromises and hacking. Her answer was the software bill of materials. The committee, established in 1976, oversees the U.S. Intelligence Community (Wikipedia).
It’s where Jack Ryan works
Before FDD, she admitted, she didn’t know what a think tank was.
“I was not think tank smart.”
Georgianna Shea, at 27:27
“It’s where Jack Ryan works.”
Georgianna Shea, at 27:32
Helicopters, other countries, being so smart you know everything. Jack Ryan is Tom Clancy’s character, created in 1984 and the hero of fourteen of his novels (Wikipedia). The real job is quieter.
“We look at those future threats and the gaps in current policy, what’s going on in the practitioner world, and we try to bridge that gap.”
Georgianna Shea, at 27:45
Cyber survivability attributes
SBOM was one of those gaps, so she ran a pilot on it and wrote recommendations for federal requirements and for testing, especially for weapon systems. By her account, they reached the draft National Defense Authorization Act for 2023.
“There’s a whole bureaucracy behind it, but it was too much, too soon, so it got pulled out.”
Georgianna Shea, at 28:24
“But I was very thrilled that it made it into the NDAA.”
Georgianna Shea, at 28:29
“But it had a voice, and you were behind that voice.”
Jon McLachlan, at 28:33
She wasn’t alone, she said: a community of people, organizations and companies like Cybeats and Ion Channel push the same idea. The NDAA is the series of laws that sets the Defense Department’s annual budget and spending, the first passed in 1961 (Wikipedia), and once something is law, the Department has to meet it. Her recommendations didn’t become law, but the Department saw them anyway, and by her account they went into its policy on cyber survivability attributes, recommending SBOMs for systems under acquisition.
“that’s a good idea, we’re going to do it anyway.”
Georgianna Shea, at 29:31
“We don’t have to have a law.”
Georgianna Shea, at 29:33
FDA has put it in
Jon asked whether SBOMs would reach FedRAMP. George expected them to reach everything, and pointed to medical devices.
“FDA has put it in.”
Georgianna Shea, at 30:00
Jon’s reaction was the patient’s: if something goes inside his body, he doesn’t want it to have known vulnerabilities. The FDA’s requirement comes from section 524B of the Federal Food, Drug, and Cosmetic Act, added by the Consolidated Appropriations Act, 2023, which was signed on December 29, 2022. Makers of cyber devices have had to include an SBOM, a plan for postmarket vulnerabilities and evidence the device is cybersecure in submissions since March 29, 2023, and the FDA’s transition policy for submissions without that information expired on October 1, 2023 (FDA). FedRAMP, the program Jon named, is the government-wide compliance program for cloud products and services, which the government calls FISMA for the cloud (Wikipedia).
Other sectors, she said, don’t always have an owner to point to.
“there’s always a policy, a person, a belly button, something that you look to and point to.”
Georgianna Shea, at 30:13
That’s how it worked at the Department of Defense. In medical, water and energy, she found herself asking a different question.
“isn’t there an organization here that does penetration testing of these things?”
Georgianna Shea, at 30:26
Often there isn’t, she said. They recommend it. A penetration test is an authorized simulated cyberattack, performed live, to find a system’s weaknesses (Wikipedia).
A coalition of the willing
Jon played the buyer: a Series A or Series B startup that wants to do SBOMs right with no in-house expertise. Did she have a vendor she would recommend? She was open about her own seat first. She is on the board of advisors at Cybeats and recommends them, and she ran her pilot with Ion Channel. She described the people she works with on SBOM, companies and experts alike, as a coalition of the willing.
“it’s always a coalition of the willing.”
Georgianna Shea, at 31:22
People passionate about the process and the security, she said, not about selling a product or making a dollar. She would send a buyer to the people in those communities who are passionate about helping, and not to the salespeople.
Jon had a story about one of those people. He had just recorded Feross Aboukhadijeh, who started building something else, found he couldn’t secure it with anything on the market, and built the tool he wanted for the JavaScript world: SBOMs, known vulnerabilities and watching what comes in.
“And he open sourced the whole thing, and it has like billions of downloads.”
Jon McLachlan, at 32:43
The community, by Jon’s telling, became the company. That conversation is episode 36, with Feross of Socket.
A day at the Eisenhower Executive Office Building
Jon asked for her best day. A single best day was hard to pick, she said, but she has had some absolutely incredible experiences. The first was PCAST.
“So we had an in-person symposium on the White House grounds at the Eisenhower Executive Office Building”
Georgianna Shea, at 33:20
She spent the day listening to the government’s senior cyber decision makers, people from ISACs, think tanks and academia, react to the working group’s recommendations.
“This is incredible.”
Georgianna Shea, at 33:45
The Eisenhower Executive Office Building, once the State, War, and Navy Building, is part of the White House compound in Washington and houses agencies of the Executive Office of the President (Wikipedia).
A three-minute cartoon
The second experience was smaller. Her team at FDD made a short video on SBOM.
“it was a super simple three-minute cartoon video”
Georgianna Shea, at 34:27
“it breaks it down so that your six-year-old can understand it”
Georgianna Shea, at 34:39
Which means, she said, that a decision maker can understand it, and the non-technical person making the decision can see why it matters. Jon agreed it does.
The Cyberspace Solarium Commission
George also gave a plug to an organization housed at FDD.
“It’s the congressionally mandated organization that was stood up under John McCain to address cybersecurity.”
Georgianna Shea, at 35:46
The Cyberspace Solarium Commission was a bipartisan, congressionally mandated body created by the John S. McCain National Defense Authorization Act for Fiscal Year 2019, formed on August 13, 2018. It was sunsetted on December 21, 2021 and continued as a nonprofit, CSC 2.0, at FDD, led by Mark Montgomery, the commission’s former executive director (Wikipedia). She named Montgomery among her FDD colleagues who push its recommendations to Congress: securing the water sector, workforce development and more. She also described cyber as an issue both parties work on together. The recommendations matter, she said, because of who is in Congress.
“not a ton of cybersecurity experts in Congress.”
Georgianna Shea, at 36:30
Jon called it a huge shocker, and thanked the people who bring the issues to a national forum.
Problems don’t go away
Jon asked what success looks like.
“Yeah, I don’t think problems go away. Gaps don’t go away. Issues don’t go away.”
Georgianna Shea, at 37:02
“So success is really when I see that there’s been an impact, and someone understands something, and they can take action.”
Georgianna Shea, at 37:07
Her examples were the SBOMs in Defense Department policy and the draft NDAA, and a conversation a couple of weeks earlier with a medical device CEO who knew his strict testing requirements but not the software ones. The field doesn’t hold still, she said.
“We’ve got quantum computing, we’ve got artificial intelligence”
Georgianna Shea, at 37:57
The day of no secrets
Jon asked which part of the future excites her most. She asked whether he meant the problem part or the solution, and then took quantum first.
“Next year, NIST is supposed to be putting out the guidance for these post-quantum algorithms.”
Georgianna Shea, at 38:47
“It’s all of encryption, and it’s going to be changing.”
Georgianna Shea, at 38:53
“And if it doesn’t change, then it’s going to be compromised.”
Georgianna Shea, at 38:56
If people aren’t on board, if the window is missed or there’s no workforce to do the work, she asked, what does that mean for national security?
“I have a colleague from IBM. He calls it the day of no secrets.”
Georgianna Shea, at 39:12
Banking information, healthcare information and national secrets, all no longer secret.
“Everything is just wide open.”
Georgianna Shea, at 39:25
Most widely used public-key algorithms rely on problems that Shor’s algorithm could solve on a powerful enough quantum computer, and post-quantum cryptography is the work on algorithms thought, but not proven, to resist that attack (Wikipedia). Peter Shor developed the algorithm in 1994 (Wikipedia). NIST’s guidance came out on August 13, 2024, as she expected, with three finalized standards: FIPS 203 for key encapsulation, and FIPS 204 and 205 for digital signatures (NIST). Our post on harvest now, decrypt later explains why today’s encrypted data is already exposed.
A deepfake of your boss
Then she laid artificial intelligence on top.
“So the quantum just speeds everything up.”
Georgianna Shea, at 39:57
“So if it was going to take you a billion years before, now it’s going to take you a second.”
Georgianna Shea, at 39:58
Her first scenario was a deepfake of your boss on a video call, asking you to log into an account and send something. You saw the face and had a conversation, because the model can respond.
“So it’s no longer just tricking you through words”
Georgianna Shea, at 40:20
Her second was penetration testing. A pen tester spends a long time learning a system’s hardware, software and how it works before finding the way in. Feed that to a model trained on great hackers, she said, and the analysis comes back almost at once.
“Okay, two seconds later, here’s your attack surface analysis.”
Georgianna Shea, at 41:07
“That would have taken a year.”
Georgianna Shea, at 41:11
The model might even tell you which software version a target runs from a job posting that asks for experience with it. Deepfakes are images, videos or audio edited or generated with artificial intelligence (Wikipedia).
“No, that’s incredibly scary, incredibly exciting, all at the same time.”
Jon McLachlan, at 41:33
“I always tell people, like, it’s job security, and it’s always exciting.”
Georgianna Shea, at 41:38
Our posts on deepfake detection versus identity proof and on autonomous AI cyberattacks pick up both scenarios.
How do I continue to meet the mission in a compromised state?
Jon is an optimist. Smart people will think it through, he said.
“We’re going to be resilient.”
Jon McLachlan, at 41:54
“But I want to stress again, resilience.”
Georgianna Shea, at 41:58
Jon asked why it excites her, and she finished a thought she had started earlier. Protection is good, and still not enough.
“but you will inevitably be compromised.”
Georgianna Shea, at 42:25
“okay, how do I continue business as usual while I’m compromised?”
Georgianna Shea, at 42:34
“How do I continue to meet the mission in a compromised state?”
Georgianna Shea, at 42:40
Putting up a firewall doesn’t make you secure, she said. What matters is that the mission succeeds and the critical functions keep running, along with the systems that support them, even under adversary compromise or a black swan nobody saw coming.
“So it’s ensuring the mission success”
Georgianna Shea, at 42:56
A black swan, in the theory’s terms, is an event that comes as a surprise, has a major effect and is rationalized after the fact (Wikipedia).
The hospital and the concert venue
The Operational Resilience Framework, she said, goes a step further than your own requirements.
“But if you have downstream customers, what are they requiring from you to do their job?”
Georgianna Shea, at 43:34
Her example was a water provider during an incident.
“maybe one’s a hospital and one is a concert venue, and you provide water.”
Georgianna Shea, at 43:49
“Like, maybe you don’t provide water to the concert venue, you provide it to the hospital.”
Georgianna Shea, at 43:55
Knowing that in advance, and knowing where the priority data is, she said, is resilience for the customers and not just for you. Jon liked the holistic approach. The framework’s version 1.0 asks organizations to define minimum viable service levels for their critical services, and wants downstream customers, partners and counterparties to keep operating (Business Wire). Our blast radius playbook covers the same ground for a company after the breach.
I look for motivation
Jon asked what she looks for when she hires.
“I look for motivation.”
Georgianna Shea, at 44:44
At FDD she brings on interns, and she’s excited about helping young people get into the field. She doesn’t quiz them on facts like how the TCP handshake works or the OSI model.
“Those things you can memorize, and they don’t really mean anything to me.”
Georgianna Shea, at 45:18
“I need to know that you’re motivated, you’re curious, and you’re eager, and you’re in this space and you want to learn.”
Georgianna Shea, at 45:20
TCP is one of the main protocols of the internet protocol suite (Wikipedia), and the OSI model is a reference model the International Organization for Standardization published in 1984 (Wikipedia). She does ask her interns one question, about NIST. Students from very good universities often haven’t heard of it, she said, and by the end of the internship they know it, along with how to research, ask questions and find answers without waiting for direction.
Jon looks for the same drive, he said, even when the task is as specific as a C module for a hardware security module that talks to a Java server. George connected it to doing what you love, like her pivot tables.
“If you love what you’re doing, you never work a day in your life.”
Georgianna Shea, at 46:43
What she doesn’t want is the habit she saw in the Army, of playing dumb to avoid a task.
“And I love initiative.”
Georgianna Shea, at 47:43
“Don’t rely on me to lay out the breadcrumbs for absolutely everything.”
Georgianna Shea, at 47:50
When interns come with questions, she said, they teach her too. Jon added that newcomers ask the basic questions that make leaders revisit the fundamentals and think from first principles. Our posts on hiring a fractional CISO and on why hiring is now an attack surface cover the other side of hiring in security.
Cybersecurity First Principles
Jon said first principles, and George had the book right there.
“So I have to plug this book”
Georgianna Shea, at 48:34
The book is Rick Howard’s Cybersecurity First Principles: A Reboot of Strategy and Tactics, published by Wiley in April 2023 (O’Reilly). It gets past compliance to the principles, she said, and approaches security holistically with a strategy. She’s in it.
“That’s my claim to fame.”
Georgianna Shea, at 49:00
She first met Rick Howard when he was an Army leader in cyberspace, she said, before his time at Palo Alto and his podcast at the CyberWire.
“So I’ve known Rick for probably 20 years.”
Georgianna Shea, at 49:19
He also founded the Cybersecurity Canon, she said, and she has done interviews and papers with him and reviewed one of his chapters. Her LinkedIn lists her as a Canon member since September 2021 (LinkedIn). Jon called the field a small world.
One book in the entire store
“It really is a small world”
Georgianna Shea, at 49:44
In 2000, at her first job, her boss gave her and a colleague a credit card.
“Go to the bookstore, buy every book on computer security.”
Georgianna Shea, at 49:55
“There was one book in the entire store”
Georgianna Shea, at 50:13
It was Stephen Northcutt’s book on intrusion detection, and she remembers it being about Snort. Jon asked whether it was a Cisco book. Northcutt’s book was Network Intrusion Detection: An Analyst’s Handbook, from New Riders, reviewed on Slashdot in September 1999, and the review mentions his work with the Navy’s Shadow intrusion detection team (Slashdot). Snort itself, a network intrusion detection and prevention system, was created in 1998 by Martin Roesch, who founded Sourcefire (Wikipedia). Jon’s Cisco guess has a reason: Cisco bought Sourcefire for $2.7 billion in July 2013 (Wikipedia). Borders, one of the stores she named, was founded in 1971 in Ann Arbor, Michigan (Wikipedia).
Now there are shelves of security books, and she knows the authors.
“Oh, I know that author.”
Georgianna Shea, at 50:47
“So it really is amazing when I look at what’s out there now, and how much the field has grown.”
Georgianna Shea, at 51:02
Don’t wait for permission
Jon’s last question was what she would tell her younger self. She checked whether he meant her career, and he said it could be way earlier. Her first answer was to invest in Google or Microsoft.
“Oh, there you go. Okay.”
Jon McLachlan, at 51:39
Jon added the part about buying them with a $20 allowance, and she added three cents of spare change. Then the real answer, for her early career years.
“don’t wait to take the initiative, and don’t wait for permission for taking an initiative.”
Georgianna Shea, at 52:00
At a company, she said, there’s a hierarchy. You bring an idea to your manager, hear that it’s not in scope, and move on. Networking meant knowing people in other departments of the same company.
“But the world is so interconnected now.”
Georgianna Shea, at 52:23
Nothing stops anyone from joining a community outside their company, she said, and the people there don’t ask for your rank.
“No, no one cares.”
Georgianna Shea, at 53:26
The trap is the rat race, she said, where you wait to be recognized, and Jon agreed it’s easy to get sucked into the grind. Doing your best doesn’t break you out of it. People just come to expect it.
Write things down
Her other example was about being heard.
“I’m more of an introvert.”
Georgianna Shea, at 54:41
She is the quiet person in the meeting, she said, thoughtful and analytic, and quiet people get dismissed. Earlier in her career, someone else would repeat her idea.
“I’m like, I literally just said that, and he just rephrased it.”
Georgianna Shea, at 55:06
Or the group reached her conclusion two months later. Her answer was to write things down.
“Don’t be dismissed by other people. Don’t be discouraged by other people.”
Georgianna Shea, at 55:22
“So you don’t have to be right, but you can definitely pursue direction and explore things without permission.”
Georgianna Shea, at 55:31
Jon’s version was that leaders have to repeat themselves, because people listen from where they are. Asked for a final word, she kept it short.
“Pursue what you’re passionate about, and find a way to make a difference.”
Georgianna Shea, at 56:29
After the tape
Several things George talked about have moved since the tape.
PCAST released the working group’s report on February 27, 2024 (White House archives). NIST published FIPS 203, 204 and 205 on August 13, 2024 (NIST). The DAD-CDM project took the name Defending Against Deception on November 21, 2024 (GitHub). And on June 22, 2026, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, set December 31, 2030 for federal high-value assets and high-impact systems to move key establishment to post-quantum cryptography and December 31, 2031 for digital signatures. It also directs CISA, with NIST, to publish the minimum elements of a cryptographic bill of materials (White House).
That last part brings the two halves of the episode together. On October 8, 2026, George and Shaun C. Six of UTSI International published A Practical Path to Post-Quantum Readiness in Operational Technology, nine decisions in three phases, and the third decision is to build a cryptographic inventory, or CBOM (Automation.com). It’s the SBOM argument again, for the cryptography inside the system. Operational technology is the hardware and software that monitors and controls industrial equipment and processes (Wikipedia). She posted about it the same day.
Post-quantum readiness in operational technology requires careful attention to safety, reliability, long service lives, and vendor dependencies.
Georgianna Shea · October 8, 2026
Two weeks later, on October 22, 2026, she published a TCIL technical note with Cason Smith and Sydney Johnson, Beyond Encryption: Reducing the Value of Exposed Data, on vaultless, keyless pseudonymization as an extra control at the data layer (FDD). The automation.com biography now describes her as a U.S. Army veteran and a coauthor of Post-Quantum Leadership: Knowledge and Practical Perspectives on Post-Quantum Readiness (Automation.com).
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it, and where it is on the tape.
-
Which word did George say she has to stress about the vulnerability test?
- Critical
- Known
- Exploitable
b. "So I have to stress the word known." Transcript, 9:23.
-
The Air Force software in George's pilot had four underlying components. What was under them?
- Nothing else
- About a dozen more
- Thousands of other components
c. "there were then like thousands of other components." Transcript, 11:33.
-
What did George say to do when you receive software?
- Know what you're getting
- Stop using open source
- Rewrite the components yourself
a. "The argument, from my standpoint, is if you're receiving that software, know what you're getting." Transcript, 11:49.
-
When Log4j hit, what was the first question, by George's account?
- Who wrote it?
- Do we have it?
- Is there a patch?
b. "The first question is, do we have Log4j?" Transcript, 25:14.
-
Before FDD, where did George think think tank people worked?
- On Capitol Hill
- At a university
- Where Jack Ryan works
c. "It's where Jack Ryan works." Transcript, 27:32.
-
What does George's colleague from IBM call the day quantum computers break today's encryption?
- The day of no secrets
- Q-Day
- The crypto winter
a. "I have a colleague from IBM. He calls it the day of no secrets." Transcript, 39:12.
-
What does George look for first when she hires?
- Certifications
- Motivation
- Knowing the OSI model
b. "I look for motivation." Transcript, 44:44.
Do you know what you’re getting?
George’s two tests for any organization are whether it knows what’s in its software and whether it can keep running when that software fails. Eight questions on both.
Scorecard · eight questions
Do you know what you're getting?
Answer for how your company works today. If two answers fit, pick the lower one.
-
Do you have an SBOM for the software you ship, and do you ask for one from the vendors you buy from?
- Neither
- One or the other
- Both, and we keep them current
"So SBOM, it's a software bill of materials." See So SBOM, it's a software bill of materials.
-
If a Log4j-style advisory landed today, could you say within an hour which of your systems contain the component?
- No, we'd have to search by hand
- For some systems
- Yes, from our SBOMs
"The first question is, do we have Log4j?" See Do we have Log4j?.
-
Have you named your critical services and the minimum level each has to keep running at during an incident?
- No
- Informally
- Yes, written down and tested
"How do I continue to meet the mission in a compromised state?" See How do I continue to meet the mission in a compromised state?.
-
Does your supplier review look past your direct vendors to the components and suppliers they depend on?
- We stop at the vendor
- For our most critical vendors
- Yes, down the tiers
"How do you ensure that you don't have a third-tier supplier that's putting something into the supply chain that's going to be dormant and passive?" See A third-tier supplier.
-
Do you monitor the open source components in production continuously, not just when a release ships?
- No
- At each release
- Continuously
"But it doesn't get into what's the history of the software" See A natural integration point.
-
Does your testing look for code that does things it shouldn't, not just for known vulnerabilities?
- Known vulnerabilities only
- Sometimes, on critical code
- Yes, routinely
"So I have to stress the word known." See Tippy-top secret.
-
Do you know which customers depend on you most, and who you would serve first in an outage?
- No
- We have an idea
- Yes, it's in the plan
"But if you have downstream customers, what are they requiring from you to do their job?" See The hospital and the concert venue.
-
When a control passes its audit, do you still test how an attacker would get around it?
- Passing the audit is the goal
- For some controls
- Yes, we test against attackers
"the adversary isn't following that checklist." See The adversary isn't following that checklist.
You can't yet say what's in your software or what keeps running when it fails. This month, get an SBOM for your main product, ask your top three vendors for theirs, and write down your three most critical services.
Some of the inventory exists. Next, make SBOMs part of every release and every purchase, monitor the components continuously, and set a minimum service level for each critical service.
You know what's in your software and how you'll run while compromised. Keep testing against attackers rather than checklists, rehearse the outage plan with your customers in mind, and start your cryptographic inventory for the post-quantum move.
How many components would the next Log4j make you check?
George’s Air Force pilot found four components that turned into thousands. This calculator starts from her four and counts what you would have to search by hand without an SBOM. Every default besides the four is our example, not a benchmark.
Calculator
How many components would the next Log4j make you check?
Four numbers: the applications you run, the components each one depends on directly, the components under each of those, and the share of applications with a current SBOM.
With 20 apps of 4 direct components and 500 more under each, you run about 2,004 components per app and 40,080 in all. Without a current SBOM for 15 of those apps, the next Log4j means searching about 30,060 components by hand.
The 4 is from George's Air Force pilot, where four underlying components turned into thousands. The 20 apps, the 500 components under each direct one and the 25% are our examples, not benchmarks. Put in your own.
From the OSI model to a cryptographic bill of materials
Everything on this page sits on one timeline, from 1984 to George’s papers in 2026. Filter it by thread.
Timeline · 1984 to 2026
From the OSI model to a cryptographic bill of materials
Filter by thread. Dates are from the public record except where marked as George's account or part of this show.
- The OSI model
The International Organization for Standardization publishes the reference model (Wikipedia, on this show).
- Jack Ryan
Tom Clancy creates the character (Wikipedia, on this show).
- Shor's algorithm
Peter Shor develops the quantum factoring algorithm (Wikipedia, on this show).
- Presidential Decision Directive 63
A national program of critical infrastructure protection (Wikipedia, on this show).
- Snort
Martin Roesch creates the network intrusion detection system (Wikipedia, on this show).
- Network Intrusion Detection
Slashdot reviews Stephen Northcutt's analyst's handbook (Slashdot, on this show).
- One book in the entire store
George's first job, and a credit card to buy every security book, by her account (on this show).
- ATT&CK
MITRE releases its guideline for classifying cyberattacks (Wikipedia, on this show).
- The Log4j flaw
The vulnerability later called Log4Shell exists unnoticed from this year (Wikipedia, on this show).
- Cisco buys Sourcefire
The maker of Snort-based appliances, for $2.7 billion (Wikipedia, on this show).
- The Cyberspace Solarium Commission
Formed under the John S. McCain NDAA for fiscal year 2019 (Wikipedia, on this show).
- SolarWinds
A campaign penetrates thousands of organizations, including parts of the federal government (Wikipedia, on this show).
- FDD
George becomes chief technologist of the Transformative Cyber Innovation Lab (LinkedIn, on this show).
- The Operational Resilience Framework task force
George joins the Global Resilience Federation's work (LinkedIn, on this show).
- The Cybersecurity Canon
George becomes a member (LinkedIn, on this show).
- Log4Shell
CVE-2021-44228 is reported in the Java logging framework (Wikipedia, on this show).
- CSC 2.0
The commission sunsets and continues as a nonprofit at FDD, led by Mark Montgomery (Wikipedia, on this show).
- Operational Resilience Framework 1.0
Released by the Global Resilience Federation's Business Resilience Council (Business Wire, on this show).
- Section 524B
The Consolidated Appropriations Act, 2023 adds cybersecurity requirements for medical devices, an SBOM among them (FDA, on this show).
- SBOMs in device submissions
The requirement applies to submissions from this date (FDA, on this show).
- Cybersecurity First Principles
Rick Howard's book is published by Wiley (O'Reilly, on this show).
- Cybeats
George joins the advisory board (Cybeats, on this show).
- The FDA transition ends
The agency expects device submissions to include the section 524B information (FDA, on this show).
- Episode 36 airs
Feross Aboukhadijeh of Socket, the founder Jon mentions (episode 36, on this show).
- The PCAST report
The council's strategy for cyber-physical resilience (White House archives, on this show).
- Episode 48 airs
On Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- FIPS 203, 204 and 205
NIST finalizes its first three post-quantum standards (NIST, on this show).
- Defending Against Deception
The DAD-CDM project takes its new name (GitHub, on this show).
- Executive Order 14412
Post-quantum deadlines for federal systems, and guidance on a cryptographic bill of materials (White House, on this show).
- Post-quantum readiness in OT
George and Shaun C. Six publish nine decisions in three phases (Automation.com, on this show).
- Beyond Encryption
A TCIL technical note on reducing the value of exposed data (FDD, on this show).
What to do this week
Five things, in the order the episode suggests.
- Find out whether you know what you’re getting. Take the scorecard with whoever owns engineering and whoever owns security, and compare answers.
- Size the next Log4j before it lands. Run the calculator with your real numbers, generate an SBOM for your main product, and ask your top vendors for theirs. Our post on the AI data bill of materials compares SBOMs with the same idea for training data.
- Plan to run while compromised. Name your critical services, the minimum level each must keep, and which customers come first. Our posts on immutable backups and the blast radius playbook cover the recovery side.
- Start the cryptographic inventory. The post-quantum move starts with knowing where your cryptography lives. Our post on harvest now, decrypt later has a four-step plan.
- Get help with the parts you can’t staff. Our Product Security team builds SBOMs into your release process, our Penetration Testing team tests what an attacker would try instead of a checklist, our FedRAMP team works through the federal frameworks, a vCISO can own the program, and you can book 15 minutes with us.