On 6 December, Billington Cybersecurity hosted a webinar featuring CIA’s Associate Director for Digital Innovation (DDI) Jennifer Ewbank and AWS Federal Portfolio Director, Tom Lash for a discussion on how these two large organizations are dealing with their respective digital environments. Tom Billington served as the host and asked each of the two speakers a series of round robin questions to get at their key cyber priorities. Ms. Ewbank, who has been Director of DDI for over two years, has a rich and varied history primarily serving in the Agency’s Directorate of Operations throughout her career. Her background serves her exceptionally well to understand the Agency’s need for mastering the digital domain given its focus on overseas data collection and all source strategic analysis. Mr. Lash has served in a number of IT and Cyberservice C suites and has been with AWS throughout an incredible period of growth as the Federal sector embraces and incorporates cloud technologies to provide better data services and data protections to its numerous public services.
The Impetus Behind the DDI
The Directorate of Digital Innovation (DDI) was created in 2015, the first new large-scale organization created by the Agency in the past 60 years. Ms. Ewbank underscored that this new creation was driven by then Director Brennan’s foresight to get the CIA to embrace the fourth revolution—the rise of the digital age and the resulting explosion of data—and recognition that the CIA had to work differently to stay ahead of this change. The new Directorate incorporates the CIA’s IT, Open Source, and Cyber entities—both offense and defense—and the Agency’s very first Chief Data Officer; all of whom work side by side to integrate CIA’s approach to better leverage and protect the data that it needs to meet its many mission challenges. Ms. Ewbank highlighted a couple of key priority areas where her organization is currently focused on to include
- better leveraging data analytics—particularly Artificial Intelligence (AI);
- raising the digital acumen of every CIA employee;
- ensuring cybersecurity is embedded into every Agency workflow; and
- spending a lot of time thinking about how to understand and counter China’s rising threat to US technology dominance.
She also highlighted the DDI’s keen focus on figuring out better ways to engage with the private sector in better leveraging their ingenuity and innovation in technology developments that are essential for the Agency to meet its myriad and challenging missions.
AWS Mission Focus
When asked how AWS is leveraging its own ingenuity and innovation to help their customers modernize, Mr. Lash underscored acknowledged that this activity was the favorite part of his job and highlighted three key areas where his company was really making a difference. First, he was seeing a huge consumer demand for cybersecurity and a growing appreciation that migrating to the cloud would go a long way to meeting this need. Second, he believed that helping his customers better understand how to leverage the cloud through cost optimization was an incredible way to help them drive down overall IT costs putting more resources back into accomplishing their primary missions. Last, AWS was really focused on showcasing how the cloud can help with his clients agility and what he called “speed to mission.” One example of this speed was how the cloud—and its ability to spin up and spin down cycles instantaneously—is allowing programmers and project managers more ability to build and test out new ways of doing business faster while moving on from failed ideas more quickly and at much greater reduced costs. He highlighted how this clearly corresponds to the DDI’s own need to maximize their time as the mission of safeguarding the nation’s security faces faster and more complex challenges.
DDI Mission Priorities focused on Leveraging Data Faster to Counter Chinese Technology Push
When asked about how she prioritizes her obviously demanding job, Ms. Ewbank graciously highlighted the privilege of working and leading in such an important mission and at such a key pivotal time for the business of intelligence. She pointed out that the CIA could no longer afford to collect, process, and assess data simply via humans and that faster and more intelligent means need to be developed leveraging state of the art technologies and algorithms. She cited two key priority areas—China and emerging technologies—that the CIA is now focused on that will require faster means to harness the power of data. She cited that China has pushed to be the dominant player in the AI market by 2030 and highlighted its push to build and market Chinese indigenous technologies to replace the US’ current dominance as the world leader in technology. She also emphasized how this potential change could shift the world’s current open market and open standard system given China’s focus on information control, censorship, and closed standards. She emphasized her own organization’s priorities which were continued to find ways to off-set the increasingly harder job of collecting real secrets which included better leveraging open sources, better partnerships with industry, other intelligence and federal government agencies, the US military, and with their overseas allies. She was also very focused on better integrating her organization’s capabilities with the rest of the Agency and underscored how she sees this integration working everyday to solve tough problems in the Agency’s very complex world.
AWS Customer Engagement Key to Its Innovation
Mr. Lash wholeheartedly agreed with Ms. Ewbank about the role of integration which in his world meant doing more of what he loves to do everyday. He emphasized that spending time with his customers and listening to their key challenges was key to allowing AWS to be a part of this integration, particularly of allowing them the time to understand the challenges and seeing where AWS technologies and services could best be applied. “90 percent of AWS innovation comes from customer recommendations,” Lash highlighted, and this allowed AWS to provide this innovation in volume across a number of different customer sets. He also highlighted that AWS strategy usually worked best by showcasing how AWS could potentially solve recognized problems via press releases, and then engaging with customers to scope out their own needs leveraging this applied use.
Attracting and Retaining Talent
Ms. Ewbank also addressed a common concern among many technology managers; namely how her organization goes about attracting and retaining talent. While she acknowledged this challenge, she highlighted that the Agency was very competitive in attracting really smart and driven prospective employees given the organization’s compelling and incredibly interesting mission. “We attract a certain type: those driven by the lure of adventure; the love of travel; and figuring out complex, sometimes impossible problems,” she offered. While she highlighted her current focus on STEM talent, she was quick to point out the Agency’s focus on diversity, highlighting that it was clearly recognized by Agency seniors that a diverse workforce nearly always leads to better outcomes. She proudly cited that in 2020, the CIA was named employer of the year by the University of Miami due to this diversity focus. Ms. Ewbank was also effusive about DDI University; the training arm of the new Directorate, highlighting both its focus on technical acumen as well as its mandate to educate the broader CIA workforce on how to use and leverage technology.
AWS Also Focused on Workforce Development but also on Training a Broader Community of Cloud Users
Mr. Lash focused on AWS’ broad mandate to teach everyone about the Cloud and cloud security in an universal effort to up user knowledge with this revolutionary technology. He pointed out that AWS has given itself a goal of providing 25 million people with free cloud security training by 2025 and proudly highlighted that 6 million had taken them up on this opportunity in 2021 alone. He also highlighted AWS’ management training programs dedicated to getting supervisors to see the value of moving to the cloud. All of this training is done, of course, by leveraging the power of AWS’ own public cloud to include offering free space for hands-on actions to garner more session rich learning.
Moving the CISO into the DDI Family
This year, the Agency opted to move its CISO and the Agency’s cyber defense element under the DDI Directorate. Ms. Ewbank explained that, quite frankly, was simply completing some unfinished business and a move long overdue. To her, she has already seen the benefit of moving the defensive teams closer to the Agency’s IT and offensive cyber elements, particularly with the CIA’s all-source cyber strategic analysis. It has also elevated the entire digital mission focus to the Agency senior leadership and both the Director and Deputy Director are committed to making it their business to understand it and promote it. She also sees that the move clearly makes the Agency’s digital business better integrated with a shared vision and strategy. Lastly, she sees real value at being able to leverage talent from both the offensive and defensive sides to lead and drive their business models with a broader perspective. “Everyone now has an opportunity to refresh their skills, learn the cyber business in a more holistic way, and garner the value of lateral movements,” she highlighted.
How Can the Private Sector Help CIA’s Mission?
While Ms. Ewbank clearly saw a host of ways that the private sector could help the CIA, she pointed out that much of the work to garner it really falls on the Federal Government itself. She assessed that the Government has to recognize that industry is clearly moving ahead as an innovative technology leader and come up with better means to work with it at speed. She also pointed out that the CIA was interested in working with the entire private sector eco-structure, from the large system integrators to the new start-ups. Much of the innovation she was seeing these days was coming from those with an idea that only just now getting funded and tested with equity dollars. She did highlight that the DDI was trying to tap into this innovation in a number of ways to include hosting its own Digital Futures team dedicated to meeting with technology companies to potentially marry them up with Agency mission needs, and the DDI’s two Innovation Hubs, one located in Silicon Valley and the other in Northern Virginia; both of which are dedicated to working with companies to creatively try out new ways to help the Agency in an unclassified lab.
Where does the CIA fit into the larger Federal Government Cybersecurity Effort?
Ms. Ewbank is very excited about the Federal Government’s new cyber team and their focus on unified effort to thwart the adversary. She sees the Agency assisting in this mission on a number of fronts. She pointed out the CIA’s unique all-source analysis mission and highlighted that she was confident that the CIA had the world’s best strategic cyber analytical unit. It has been essential to help the Federal Government’s cyber and political leaders to better understand the threat and who is behind it. She also pointed to the CIA’s foreign intelligence collection mission and highlighted the cybersecurity threat as a key collection target. Lastly, she highlighted CIA’s powerful relationships with key US intelligence, law enforcement, DOD, and foreign partners could also add much in support of this effort.