Interview with One of My Three Wise Men

Tony Sager from the NSA is one of my Three Wise Men. (Dan Geer and Ross Anderson are the other two.) Eric Parizo from SearchSecurity.com interviewed Tony this week and posted the video online.

Tony notes that the escalation in threat activity during the last few years is real. He is in a position to know, given he has worked at NSA since the 1970s. Tony says the threat activity is getting people's attention now, especially at more senior levels of the government and industry. Now targeted organizations are thinking beyond the question "does this affect my company" to "does this affect my industry?"

Tony explains that a generational effect may account for the change in awareness. More senior leaders grew up with technology, so they know how to think about it. There is also more public reporting on serious security incidents today.

My favorite quote was:

"If you're not a little concerned, you haven't been paying attention."

Since Tony is Mr Reasonable, I think that's a significant statement!

Eric asked Tony for his opinion on APT, and he replied that APT isn't that useful a concept for his line of work. That's possibly because his agency uses the original intrusion set names to manage threat intelligence, rather than an unclassified, "umbrella" term for discussing threat actors in private industry. Tony did explain that the "advanced" aspect for him means conducting operations in multiple "domains," e.g., escalating to physical, non-digital attacks when necessary.
Tweet