Total Security: Investigative Perspectives from Public to Private Sector

### Overview In this panel session, three former federal investigators—Shawn Henry (President of CrowdStrike Services and CSO of CrowdStrike), CJ Moses (Deputy CISO at AWS), and Mary Galligan (Managing Director at Deloitte)—discuss the evolution of the cybersecurity landscape and how their public-sector investigative experience applies to private-sector security practices. They reflect on the transition from handling website defacements and denial-of-service attacks in the early 2000s to managing modern threats like ransomware, destructive malware (such as NotPetya), critical infrastructure intrusions, and software supply chain attacks. The discussion highlights the necessity of viewing security through a comprehensive 'total security' model covering physical, personnel, and operational attack surfaces.

### Key Topics - **Cultural Differences and Actionable Threat Intelligence**: In the federal government, awareness of nation-state adversaries and cross-agency intelligence sharing were standard operational procedure. In the private sector, organizations historically struggled to acknowledge nation-state threats or view intelligence as directly actionable. Translating threat intelligence into operational actions—such as dynamic patching and business risk prioritization—fosters an organizational culture where business owners take active ownership of security. - **Risk Communication and Business Impact**: Communicating security risk to boards and C-suite executives requires translating threats into business impact. Emphasizing resilience and operational disruption (e.g., inability to produce products or service clients) engages leadership more effectively than purely technical metrics. - **Attribution as a Defensive Strategy**: While some in the private sector historically questioned the necessity of threat actor attribution, understanding the human adversary behind an attack provides vital context regarding motivation, capabilities, and toolsets. Attribution enables organizations to be proactive rather than merely reactive, illustrated by historical patterns such as Iranian DDoS campaigns against the financial services sector following U.S. sanctions. - **The Total Security Framework and the 360-Degree Attack Surface**: The role of a CISO extends beyond traditional IT boundaries. True security governance requires stewarding across data center physical security, operational technologies, personnel, and the software supply chain. - **Managing Insider Threats**: Employees typically fall into three insider risk profiles: ignorant (unaware of policies), indifferent (circumventing rules for convenience or speed), and malicious (willfully exfiltrating data or tampering with systems). Addressing these risks requires holistic organizational coordination across Human Resources, legal, and operational leadership beyond standard phishing training.

### Technical Details - **Software Supply Chain Defense**: To counter self-upgrading threats and third-party code risks within CI/CD and DevOps pipelines, organizations must employ defense-in-depth mechanisms, including structured code reviews, fuzz testing, and behavioral monitoring. CJ Moses highlights that AWS deploys CrowdStrike Falcon on edge devices to monitor for communication aberrations between systems. - **Least Privilege and Access Controls**: Limiting exposure across both insider and supply chain attack vectors involves moving toward continuous authorization and just-in-time (JIT) access, granting minimal access based on strict parameter sets for limited durations before revoking them.

### Takeaways - Organizations must dismantle silos across business, legal, HR, and technical teams to manage risks effectively. - Collaboration and intelligence sharing across industry peers (such as ISACs and ISAOs) and with government entities remain essential to counter common advanced persistent threats, as demonstrated historically by multi-agency efforts like the Moonlight Maze investigation.