[ Music ]
Female Speaker: Our next speaker is Kevin Briggs,
who is the Chief of Continuity Assessment and Resilience
at the National Coordinating Center
for Communications within CISA.
He leads teams that assess and work to mitigate risk
to the communication infrastructures from threats
such as EMP, SS7, rogue cell towers,
earthquakes, and solar storms.
He also oversees several Federal Continuing Communication
Programs, such as the SHARES Program,
the Federal Continuing Communications Plan,
and the Department and Agency Continuing Network
and the Title Globe Assessment Program.
I am butchering your bio here.
I apologize.
He also leads CISA's 5G Capacity Building Team
and several R&D efforts to identify
and mitigate mobile cyber threats.
And I will...
[ Applause ]
Kevin Briggs: Okay, well, thank you to the S&T
for this opportunity to talk about the 5G race and some
of the challenges that we have.
Let me make sure I've got the clicker under control here.
I'm Kevin Briggs.
I'm with CISA, and today, I'm going give you some perspectives
on the 5G race, and in particular,
I'm going to be focusing in some of the safety
and security aspects of 5G.
Some of you, probably back in April, saw the press conference
with President Trump where he was talking about the 5G race.
A couple things I wanted to highlight out of that is
that he said it's a race that America must win,
and he went a little further and emphasized the security aspects
and said, "Secure 5G, those networks,
are an absolutely vital link in America's prosperity
and future national security."
So, we look at the security aspect is vital.
You're amplifying everything under 5G.
You're amplifying the speeds, the availability, the, you know,
every dimension, but,
if you don't also concurrently handle the security,
your amplifying issues there, as well, and risk.
A couple other things that the president discussed is
that he's looking to streamline the deployment of 5G.
He's working with the FCC
so that the approvals don't take years as they have in the past.
That going into the future, it should be done
within 90 days approval or disapproval, and by the end
of 2019, the President pointed out that we should have
about 92 communities within the United States with 5G services,
and that that is leading the world.
He said the closest next competitor was South Korea.
There's a whole lot of other dimensions that could be brought
in as to how many people you've actually got covered
and percentage of population.
But those are the measures that are brought out right now.
One other thing, before leaving that thought is
that he wants this to be ubiquitous, and he does talk
about the importance of getting it to the edge
and into our rural communities.
Now how do we win the 5G race?
Is it all about bits and bytes
and how fast they move and how far they go?
I think the answer is that it's a whole lot more than that,
and as the president said, our 5G networks must also be secure.
They must be strong, and when I say strong,
and I think our community, as we look at it, we're talking
about where you're available and resilient under all conditions.
Everywhere, you know, I mean the goal would be everywhere,
anytime, anyplace, and any condition,
to include all natural disasters and going all the way
up through wartime conditions.
It's a big order, and obviously, is always going to be a goal.
We believe without good 5G security,
we cannot be safe from our enemies.
Again, we're amplifying benefits,
but we're also amplifying risks
if we do not handle all the security aspects,
and winning the race, then, you know,
what is the answer to that?
It means that you're providing the most benefits while ensuring
the least risks.
Now, I wanted to go through some examples that put some flesh
onto these ideas, and I'm going to just go through some
of the proposed benefit areas, but then kind of flip it
and say, okay, if this benefit isn't well secured,
what might be some of the consequences?
So, if you look at autonomous vehicles, you know, a great,
new capability, but if they are being controlled or monitored
or tracked, it opens up all sorts of other vulnerabilities
to include crashes and other unwanted consequences.
The telemedicine.
We're hearing about a --
you want to bring in the best doctor anywhere in the world
into your room and actually using the scalpel to help.
Well, again, you don't want that to be cut off mid operation,
and you want to maintain control of the scalpel.
National security, each of these areas I won't go
through in detail.
Let's just say you need to have the national security
information everywhere and to the edge, but if you have a lack
of security on your 5G, you have an exfiltration of data
and mess at any location.
So, you have to secure it carefully.
First responders, Rob went through that very well.
You want to make sure that they get the timely information they
need as they're heading into a building or into a situation.
On the contrary, you don't want people blocking
that are giving you false information
and steering them incorrectly.
Industrial controls, whether it be smart factories,
smart cities, Internet of things, you've got a whole range
of controls that you need
to maintain the whole cyber ecosystem around,
or there's indeed, a great consequence of harm potentially.
So, last couple things, as far as privacy,
you want to ensure privacy in all dimensions
versus having your voice, video habits of life,
and other dimensions of your life being exposed
through networks that connect back into other countries.
Bottom line, with good cybersecurity on 5G,
we're going to save a lot of lives, save a lot of money,
and make America greater in a lot of ways.
Without that good security, it is not a pretty picture.
So, we have to do our jobs here.
Now for the next few slides, I wanted to focus on some
of the unique challenges.
Rob covered a lot of this already.
So, I'm going to focus in on some high points,
as far as policy and in the international scene here.
So, the US government has serious concerns
about allowing any product or vendor
into the 5G infrastructure that can be compromised and has laws
that force their companies to cooperate
with intelligence organizations and things that would not be
in the best interests of the United States.
In particular, and you probably, if you're watching the news
on these things, there's been a whole lot about the concerns
with China and Huawei going into networks.
We believe those concerns are very valid,
and they're not easily mitigated.
Given the consequences of a 5G compromise in any
of those areas, for example, that I was just describing,
those are unacceptable.
And while the US has been outwardly discussing more
of the Chinese threat here, when you're getting into supply chain
and opening up back doors, those that are technologically savvy
in other countries can piggyback right onto those,
and unfortunately, in this situation,
I can't go into details, but we have seen a lot
of that over the years.
We have a very, large attack surface even today,
with the 4G networks, 3G, 2G.
It's a network based on trust between all countries, and yet,
you do have cyber controls in there, but they are not anywhere
to the degree that we see on the computer side of the equation.
So, a lot of concerns, and hence, we have concerns,
too about our strategic partners.
As we share information with them, you know,
if it's national security-related information,
we share it with one of our 5G
or other 5 Values partners or others.
We need to make sure that that's not going
to then go out into the wild.
Some other unique aspects and Rob did touch
on the complexities of the software-defined networks,
the operators are going to lose some of the visibility
that they have into all the dynamics
of making this network adapt in real time
to whatever the situation is.
In addition, if you have hardware, firmware,
software that is not trusted, then you've got more routes
of exfiltration and compromise
than you have resources to mitigate.
I can guarantee you, if a piece of equipment is built
in a country and in a place that's untrusted,
the numbers of ways that they can make that device,
in a sense, compromised, go beyond the dollars that we have
to try to vet all of that.
You can mitigate it, but you can't eliminate that threat.
There was excellent report by the Huawei Cybersecurity Center
of Excellence, their oversight board, and they talked about,
you can bring in technical mitigations,
even if you do bring in Huawei gear or other things
like ZT equipment, but for national security
and where you have life and safety on the line,
that's just something that we cannot say, oh,
that's guaranteed that that's good enough.
A few last thoughts, is and I'm going to talk
about backdoor issues and some specifics
to put a little more meat onto the bone here in a minute,
but we don't see that they're going to have a smoking backdoor
where it's obvious, you know, they've labeled it in a way
that it looks and says backdoor, but if you have,
and I like the term bug door, if you have poor security practice,
just being baked in to every element of your hardware,
firmware, software, then you have plausible deniability,
and yet, you still have full access to everything.
So, that is a huge concern, and we know, again,
that the Russians and others are largely aware
of where these vulnerabilities and access points are,
and unfortunately, they do use those against us.
Now, as far as what is CISA doing, the Cybersecurity
and Infrastructure Security Agency,
we've got several initiatives ongoing right now.
One of them is on the government side.
We have the Federal Acquisition Security Council.
We also, on a joint industry and government perspective,
we have like the ICT, the Information
and Communications Technology Task Force.
So, we're working in partnership across government
and with our industry partners and others
that are in the community.
Just within CISA, we've got the National Risk Management Center
that's been stood up here not too long ago,
and they are doing a broad-based 5G risk assessment.
Hopefully that will be out a little later this year,
and we're tapping into other expertise centers throughout
government, like the Idaho National Labs as a test lab,
and we appreciate very much the partnership with S&T
and with our other partners in government.
The S&T has been very good about, you know, working with us
to say we've got a problem.
Let's develop some pilots to look at how do we address these
in a cost-effective way?
I wanted to just point out one study.
There's many, many studies on these things,
but it's a recent one.
I'm not saying that the department endorses every aspect
of this or whatever, but I use it as an illustration
of why we're concerned.
You know, some people think, oh, why are you picking on Huawei
or why are you picking on ZTE or the like?
And here's some of what we can talk about in a public setting
that would give us concern.
I also point out at the bottom of the slide, here's the source.
It's a Finite State assessment.
That's a company that's done an assessment
that was published last month.
Huawei has put out a rebuttal, and so I invite you
to read both sides of the thing, but I do believe there's a lot
of information in there that's useful.
One is that almost 10,000 of the firmware images
that they surveyed that was in the Huawei equipment,
this is over 500 pieces
of different Huawei gear, had a lot of issues.
In this case, roughly 55% of those firmware images had
at least one potential backdoor associated.
I think, and I'm not going to go through every line here,
but notice that it's almost 30% had things
like one default username and password stored in the firmware.
You know, that's just like the key to your house thing.
You don't do that, and there's --
I'm not saying it's all with intent,
but if you are not instituting good software engineering,
you know, principles and practices, this is what happens.
You take something off a low cost, you know,
source and stick it into your code, and there you go.
Now, Huawei devices have a high number
of security vulnerabilities, at least according to this study.
On average, Huawei devices had -- and let me go one more.
Due to time, I'm not going to go through the whole thing,
but I gave you some other things in your spare time you can look
at if you're interested.
On average, Huawei devices had
over 100 known vulnerabilities inside their firmware.
Now that's per device.
That's just incredible, in a way.
The Huawei engineers systematically made poor
decisions, at least in our opinion,
with regard to security.
I'll only point out maybe a couple more here.
Sometimes they used 10-year-old versions of libraries and the
like when there are known vulnerabilities associated
with those.
They didn't take the time to clean them up
or use the more current patched and improved software.
And in some cases, they actually saw that they had like a call
with a function that was vulnerable.
They know that there's a newer one that's better.
They renamed, in the software, that it was the newer one,
but in actuality, the backend is the old one.
So, if you're doing IV&V, independent verification
and validation, and thinking you're looking through it.
Looks good.
Oh, yeah, that's the latest.
That's why we need tools that go through carefully
and say, wait a second.
This, this is not lining up.
It says it's this, but it's actually the old one that's
very vulnerable.
So those are a few examples of why we're concerned
with using Huawei or other gear in our sensitive areas.
I hope that helps a bit.
I want to go into a couple other things outside
of the standard security area
and into more of the safety area.
I just want to highlight that we've got a whole lot more
in the way of 5G spectrum being put
out there, 5 gigahertz worth.
I mean, it's just a lot of spectrum going out there.
So, with that, in particular,
like the 24-gigahertz spectrum that's been put out there,
even just very recently, there are concerns in other parts
of government who said, wait, wait.
If we take that, and don't appropriately design your
networks, you don't have somebody
like Rob Dew helping you design it end-to-end, you're going
to interfere with other government functions,
like NOAA's ability to use the weather prediction off
of their satellites.
And, you know, some have gone so far as to say, oh, you're going
to push back our ability to predict hurricanes by, you know,
like what we did back in the 80s.
So, we need to move forward intelligently.
Nobody's arguing that we move forward into the 5G race,
but we need to do these things with not just, you know,
rushing headlong into things
without carefully considering the consequences.
Another thing on this slide, the spectrum here is very vast,
and a lot of it's new territory for us.
The human experiment of 3G, 2G, 4G,
we're going to see the same thing with 5G.
It's going to be into new areas
where we haven't had ubiquitous 24, 28 gigahertz,
all the way up to 90 gigahertz.
And cellular heating and things like that,
some of the SAR criteria that the FCC currently uses,
we may need to evolve that.
That's where we need help, as well, because --
okay, I've got to speed up a little here.
The -- I've got about a minute.
I'll touch on a couple of things.
There's, as Rob pointed out, there's likely
to be a whole lot more points of presence,
as far as in your neighborhoods and on buildings.
The coverage of a low-frequency
versus high-frequency is pretty dramatic.
And so, you may have millions of more points of a 5G.
You know, versus having something that's a mile away
on a cell tower.
Now it's right in your home, and what's it going to be doing?
The health effects, I wish we had a little more time.
I'll just say, the next couple of slides gives some studies.
In the past, like the 2011 World Health Organization,
people said, oh, it's just a lot of poor rats in this case
and other rodents being exposed on a very high level,
but when you go down to like at the bottom of the slide,
there was Ramazzini, or however you pronounce that,
Institute Study, that was at a much lower level,
and we were seeing the same types
of brain/heart tumors, other things.
And now, there is a move afoot
by many well-respected scientists
across the world saying we need to be careful here.
We could have a real health problem.
The references are there for you.
There are calls with many that said we need
to reclassify this into a category one.
So, last takeaway is that the challenges I've gone
through here are many with 5G.
The benefits are great,
but we need to go forward intelligently, and so,
we're asking for everyone's help.
This is a whole-community effort.
We can't -- the government doesn't have the solutions You
know, we can help facilitate, but the solutions are out there.
So, with that, I'll close, and if you have any questions,
I can entertain those now.
Yes, hey Bill.
If we can wait for the mic.
You're about to get a mic.
Woman: And do you mind standing up?
Man: So, Kevin, a question about the relationship
between 5G and the global submarine cable system
that carries 99% of intercontinental communications.
So, I recently talked to the publisher of SubTel Forum,
who's up to date on the statistics.
There are between 700 and 800 lamping sites
for these commercial intercontinental systems,
and if there were not even a purposeful like EMP attack,
if the North Koreans just did a test over the Pacific Ocean
to see what EMP effects there are,
there is no financial incentive less --
in place now to protect the commercial.
Not the national security systems
but the commercial systems, and so,
that could have a huge impact on availability of 5G
for international supply chains and business.
Is that of concern?
The intersection between 5G and the submarine cable systems
that are pretty well protected from solar storms
but wouldn't necessarily make it for high-altitude EMP?
Kevin Briggs: There's a lot of waterfront
on that question, no pun intended.
But yes, we are very concerned about all dimensions of 5G.
5G takes you into, I think there's 12000 satellites planned
over the next few years that will also be tied in.
It's, whether it's a, in a sense, the access point
for a lot of information that then goes
under the undersea cables,
I will point out, you mentioned EMP.
That's one of my favorite subjects.
When it comes to public safety, there is a new standard
that has come out for public safety that allows --
this is the NAVCO standard that came out about two weeks ago
that says that EMP is a consideration now,
and how to do it.
So, yes, we are concerned that the 5G access, as well as core,
and things like FirstNet and others made,
that they be protected against these things.
But yeah, it all interconnects, you know, whether it be
in undersea cable or satellite or 5G brand.
Yeah, I hope that helped to answer your question.
Yeah?
Man: Can you hear?
You mentioned a lot about supply chain attacks in terms
of our resilience, and our cyber resilience for 5G.
Are you also working on the deployment, the operation?
A lot of the attacks don't necessarily use
third-party vulnerability.
They actually just operate within the environment
to get their goals without vulnerability
in the equipment itself.
Are you looking at it from a more global,
operational perspective?
Kevin Briggs: And I'm not sure I fully understood
that question.
Are you saying that the avenues for --
Man: I'll give you an example.
Kevin Briggs: Okay.
Man: My company's a cybersecurity company.
A month ago, we published a Chinese operation
against a big telecom provider, different country.
But they were like 12 countries that were operating.
They walked in through a completely unregulated system
in the building -- I'm sorry, on the web front.
Walked inside the environment until they got to the core
and had complete control of the core,
where they could do everything they wanted out of operations.
So, even no vulnerability in the LTE core,
in that case, was used.
The Chinese operator, in this environment,
had complete control of their environment.
The we're using that for individual tracking,
tracking people's whereabouts and the call records,
but they could easily do it for any other kind of manipulation.
It's a much more wholistic problem than just do we bring
in a third-party vulnerable assets to the game?
Kevin Briggs: Absolutely, and I would concur
that it's a much more complex equation,
and because it's backward --
5G is backward-compatible with all the other vulnerable aspects
of 4G, 3G, 2G, it's well-known that there's lots of tools
and techniques to use that --
and the back doors on the databases that are in all
of the com networks is another, you know, huge issue.
I want to point out one quick thing,
and it jogged my brain here.
The biggest subscriber-shipped network
in the world isn't the Internet.
The biggest one is the com networks, the SS7 networks,
the diameter -- when you add up all the subscribers there,
we've got them beat by billions, and we need to bring
in the same cyber controls, end-to-end, whether it be
in the core network or at the, you know, managed databases
and other, you know, points.
Yes? Okay, I'm getting the -- that may be the last question.
Woman: One more.
Kevin Briggs: Oh, one more, okay.
One more question.
Man: Hi, so, we're talking about security
in heterogeneous networks.
Currently the carriers can't even protect all the phone calls
that are coming through.
This is only going to compound the matter
and then also introduce the current vulnerability
that the Internet poses.
So, I see security risks going tremendously,
exponentially greater without changing the actual
infrastructure platform integrity itself,
which we haven't done since 1978.
So, just to as far as security goes, how do you expect
that we're going to be able to handle it?
Kevin Briggs: Well, again, a very large question,
but I'll say there are practices that are commonly used
in the IT computer world that need to be brought more
into the bigger data network, as far as subscribers,
things like SSF and Diameter,
where you're not monitoring people's voice and data
and whatever, but you are looking at the controls,
whether it be at a signaling transfer point
or at your international gateways
or in your rural interconnects.
There needs to be the same discipline and security controls
of monitoring appropriately.
Not, you know, where you're getting into people's privacy,
but we need to bring in that same level of expertise
that the community does have to all of our telecom things.
But yeah, if we don't up our game there, yeah,
we introduce huge vulnerability.
Okay, I think that's it.
Thank you.
[ Applause ]
[ Music ]