Coming to you from Google Cloud Next 2024 in Las Vegas, Nevada, I'm Billy Mitchell. Thanks so much for tuning in. Today we have a special podcast recorded from the Mandalay Bay Resort and Casino on the Vegas Strip, home of Next 2024 with more than 30,000 attendees. For this podcast recorded from the sidelines of the Next Conference, I sat down with Mike Garrity, the State of New Jersey's Chief Information Security Officer and the Director of the New Jersey Cyber Security and Communications Integration Cell.
During our conversation, we touched on everything from election security and generative AI to inter-government partnership and the Cyber Security Workforce. This is one of many interviews captured at Google Next, so make sure to tune into the others' release throughout this week. Now, without further ado, here's my interview with Mike Garrity. Mike, thanks so much for joining me.
It's great to meet you and chat with you at Google Next 2024 in Las Vegas. Thanks for having me. I'm excited to be here. So let's start with, you know, it's election year.
It's one of the biggest election years globally ever, and it's obviously a big state challenge. It's something that the states have to do a lot and focus a lot of effort on. So as we go into the election year, I'm sure it's something that's been underway for quite a while now, but in the heat of it, post primaries and gearing up for November, how are you prepared to defend New Jersey's election security infrastructure in your state, both from direct cyber threats, but also, you know, there's all this, you know, new level of other malicious influencing with AI and things like that that are going on. So how are you thinking about all that?
Yeah, great question. And so I'm going to go back to the 2016 presidential election. And that's when there was first reports of Russian interference in the elections. And what we did is we created an election security coordination task force with the state, the counties, federal government and private sector partners to actually secure the elections infrastructure in New Jersey.
And we all have a role to play, and it wasn't just on the cyber side. It's also on the physical side. So all the voting locations and the polling locations and those types of things. But also what happened in 2016 was the start of that misinformation and disinformation.
So in New Jersey, cyber security is organized under our office of Homeland Security and preparedness. And so we think of all threats, all hazards, all the time. And then the election security function is actually under my purview as well within the end-jake. So I'm sure lots of preparation.
And is it going to just heat up more and more as we close to November? Or is it a lot of the heart of what you've been dealing with kind of already past? Where are you at, I guess, in the scope of this entire election security issue? So I think we're going to see more focus on the elections as we go forward after the primaries and the conventions and we get closer to November.
But everything that we've been doing, we've just been scaling to prepare for it. Last month, we had a statewide tabletop exercise with all of the 21 counties to make sure they're prepared. We threw every sort of incident at them so that they could practice in responding to those types of incidents. So we're going to see more and more focus.
We'll see more and more cute events around the elections. But I think we're in a pretty good shape. We've had this task force in place since 2016. We meet regularly, almost quarterly, not just not election years, but we do elections almost every week in New Jersey, local school board elections, fire.
They use the same infrastructure. They don't obviously have the same threat levels or interest. Yeah, that makes sense. So at the conference, we've been hearing a lot about Gen.
A.I. Obviously it's one of the biggest topics in the technology space and really the world right now. What are you seeing as the biggest opportunities for New Jersey to bolster its security with A.I.? Yeah, so great question again.
And so I'm going to take it from the security perspective. Any tool that we use in cybersecurity, we have this mantra of trust but verify. We're not there yet with Gen. A.I.
Whether it be bias, whether it be hallucinations or those types of things. But it's early days for the technology. Gen. A.I.
obviously there's lots of development that have gone on with it. But the release of chat GPD really focused Gen.A.I. in the sense that it was creating content. So we're looking at it in a lot of ways to help our analysts natural language and queries of big data sets.
Being able to ask questions like that. Being able to get answers back. Doing a lot of automation around AI so that we don't burn out all the analysts that we have. Because there's more and more threat activity going on.
And obviously that's taking a toll on the limited personnel and resources you have. So being able to bolster and use that Gen.A.I. as a force multiplier is really what we're looking at. But again, we need to have that comfort level that when we ask it a question, it's going to give us the right answer.
Yeah. So staying on the topic of what is really hot I guess in the cybersecurity sense. Especially the state and local level. Ransomware is a big threat that it seems to permeate the state and local level a lot more than maybe the federal level and some other levels.
But how are you preparing and thinking more about as you see more and more states or localities that are falling victim. What are the lessons learned there and how are you thinking about preparing for that next threat. And so all those unfortunate victims that were hit with Ransomware, we do study how they were hit. And making sure that we're learning lessons from those issues and stuff.
But one of the approaches we took in New Jersey is this whole-of-state approach. We realized that local school districts and municipalities probably don't have the resources to fend off such attacks. And so what this whole state approach is doing is we're collectively working with them and providing them tools, technologies and services to help them. It's in a school district, the person responsible for IT may be teaching FIZED in the fifth market period and then mowing along later on.
So he's not focused. He doesn't have that 24-7 focus on cybersecurity. That's what we're trying to help is that shared service, if you will. New Jersey is what we call a home-world state where each town has their own police department, each town has their own school system, and they like it that way.
But each town doesn't have a cybersecurity function, so this is a great area to provide those shared services. Yeah, I'm glad you mentioned that because you spoke on a panel earlier and one of the big things you keyed in on was this notion of collective defense. And it strikes me as something that is more important than ever, particularly that partnership with the FEDs, the state, the local, any of those different shades of variety of government. And obviously the commercial sector and everybody in between as well.
But how are you working with partners, whether it be some of your adjoining states or the localities you mentioned, or even the federal level, whether it's a CISA or FEMA or the big DHS? How are you working with all those different partners to ensure that those services are shared and that the supply chain of threats is not kind of putting each one of those layers at risk? Yeah, and so we've got a strategic plan for cybersecurity in New Jersey. And one of the third strategic objectives is that pervasive partnerships.
We know that we can't do it alone at the state level, so we need help from the federal government, from the private sector, from international partners, from locals. They're going to see things that we may not see. We're going to see things they don't see. Being able to share that information, share the threat intelligence and respond together is really what's going to make us stronger.
Last night was the end of the NCAA championships, Yukon won. But I go back to Mike Hyszewski, who was the coach at Duke University, and he was the commencement speaker at my son's high school graduation. He used to hold up his hand into five fingers, and each one of these fingers is strong, but when you put them all together and make a fist, you're actually a lot stronger together. And so that's the concept and that's the mantra that we have as far as partnerships.
We're stronger together. One of the worst cap secrets, I think, in any space, especially government is that there's this lack of cyber talent right now. So as the CISA for the state of New Jersey, how are you thinking about ensuring that you have the workforce you need for that cyber mission? I disagree with the lack of cyber talent.
There's a lot lack of people at the CISA level that know how to spot the talent and develop the talent. A lot of us want to be lazy and just have these unicorns come in and be all skilled up and trained up. We have to invest in developing them. And we've done that in New Jersey.
We have high school internship programs, any other college internship programs, and the way we look at it is that we can train anybody to do cyber. And we're better off for it, at least, in the state of New Jersey. So yeah, I think it's more just recognizing that there's talent out there and being willing to invest in them rather than there's a lack of talent. And finding creative ways to attract that talent.
So as we close out, I have questions I'd like to ask everybody I'm talking to, we're at a conference sort of forecasting what's next, Google Next. And I'd be curious from your perspective as this is, what New Jersey, what are some of the topics, trends, themes, developments that you're most excited about or that you think will shape your space for the rest of 2024 or beyond? I think all those things that we've already talked about, election security is a big thing. The critical infrastructure, so we talk about the water sector, the energy sector and the grid and everything.
But the other thing that we talked about is this generative AI. And in cyber security, just a couple of years ago, the big buzz phrase was zero trust networks and zero trust this and zero trust that. And with generative AI, it's implicit trust. And I'm afraid that rather than being the first to implement it, what we really need to do is the first to implement it correctly.
And I think there's going to be a lot of mistakes made by those making decisions to implement generative AI without doing the testing that needs to be done. All right. Well, excited to see regardless where you land on that, but a lot of exciting, I guess, development. So thanks so much for your time, Mike.
Thanks for having me.