---
id: "workshop:protecting-the-digital-frontier-lessons-in-cybersecurity-from-the-public-sector"
type: "InnovateUS workshop"
title: "Industry Series: Protecting the Digital Frontier: Lessons in Cybersecurity from the Public Sector"
url: "https://innovate-us.org/protecting-the-digital-frontier-lessons-in-cybersecurity-from-the-public-sector"
date: "2024-10-23"
duration: "60 minutes"
language: "English"
instructors: ["Veronica Pugin","Chike Aguh"]
recording: "https://www.youtube.com/watch?v=-P_N1hplTik"
transcript: "automatic, from the recording"
source: "InnovateUS (innovate-us.org)"
licence: "CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/), as stated on innovate-us.org"
---

# Industry Series: Protecting the Digital Frontier: Lessons in Cybersecurity from the Public Sector

InnovateUS workshop · 23 October 2024 · 60 minutes

Chike Aguh will interview Veronica Pugin to discuss their journeys into cybersecurity and the top issues leaders need to think about to secure the digital frontiers of their agencies, communities, and states.

## Learning goals

- Learn how you can create a career journey in cybersecurity

- Learn the top issues that cybersecurity leaders need to tackle to secure their agencies

- Learn the "around-the-corner" or "issues on the horizon" that determine how secure we are in the future

## Speakers

- **Veronica Pugin**, Manager of Strategic Programs, Okta
- **Chike Aguh**, Former Chief Innovation Officer at the US Department of Labor & Senior Fellow at The Burnes Center for Social Change

Recording: https://www.youtube.com/watch?v=-P_N1hplTik

## Transcript

Automatic transcript of the recording: names and terms can be misheard, and the times can be a few seconds off. Each time links to that moment of the video. The transcript alone: https://innovate-us.org/protecting-the-digital-frontier-lessons-in-cybersecurity-from-the-public-sector.txt (plain text) and https://innovate-us.org/protecting-the-digital-frontier-lessons-in-cybersecurity-from-the-public-sector.json (every segment with its start and end second).

**Chike Aguh**

[0:00](https://youtu.be/-P_N1hplTik?t=0) This is a state between many of you and the end of the day, so we appreciate you, and I expect we'll have more folks joining us along the way. For those of you who have not gotten to meet, my name is Chike Agu, currently a senior fellow here at Northeastern University working with the Berne Center for Social Change and Innovate US. Prior to that, I served in the Biden Administration as the Chief Innovation Officer at the U.S. Department of Labor under current Acting Secretary Julie Hsu, where myself and our colleague, who you'll hear from today, were colleagues. We're really honored to have Veronica here with us today. And so what I'll do is walk through just a quick roadmap for our time today, then we'll kind of get to the meat of it and really get to hear from some of the folks who are here on the call. And so, we are in the first part right now, being the welcome. This is going to be a conversation today, so I encourage people who are here, please go in the chat, tell us your name, where you're from, what organization that you're with, and also feel free to put questions along the way during the conversation that we will address kind of in the latter part of the session.

[1:09](https://youtu.be/-P_N1hplTik?t=69) So that's kind of number one. I think number two, if this is your first time with us, you'll learn a little bit more about Innovate US and know that this is really a small taste of what Innovate US does on a regular basis for public servants around the country. So, hopefully, this allows you to and inspires you to learn more about us and the work that we do. And hopefully, we can help you or some other public servant that you work with to do more and better for the folks that they serve. So, once you pass the welcome, we're going to learn a little bit more about our Google Certifications Program. This is a really exciting and new partnership that we launched as part of our partnership with Google really late last year, and it's a unique opportunity that we believe can help many public servants. We want to let folks know more about that one specifically so that folks can reach out, sign up if they want to. Next, we'll have our conversation with Veronica Pujin, who's here with us today. We are lucky that it's not the first time that Innovate US has had her, but we've not had her publicly available to more of our constituents. So, I'm really excited for that conversation.

[2:19](https://youtu.be/-P_N1hplTik?t=139) And then we'll really have questions and then recap and wrap up, and we'll have you on your way, hopefully, before the beginning of happy hour, wherever it is you are, particularly if you're on the East Coast of the United States. But thank you all for being with us. And again, we welcome more folks along the way. So, with that, one thing we try to do when we have these webinars is not assume that folks are familiar with Innovate US. So, let me just give a quick introduction of who Innovate US is. And candidly, our mission at Innovate US is fairly simple. It is to improve lives by enabling public professionals to deliver more effective and equitable policies and services. In the end, we like to say we help the helpers. Someone who's been a public servant more than once, many times, it can feel like you're doing it on your own. And our belief, and our hope, and our charge is to make sure that those folks have the support they need, the training they need, the inspiration they need to do their job bigger, better for the people that they serve. To give you a sense of what that looks like, we partner with US in a number of ways. One, we help states, localities actually launch their own training. We can help them create custom websites, URLs, where they can, or work with our platforms to basically do that. We can also share data about who is going through that. We also can help you package your own content, as well as we have custom presentations that we ourselves deliver or you deliver on our behalf. And that's just to get a big sense. But we deliver, we have delivered training too, and you'll see this on our website. We have worked with thousands of public servants around the country and actually internationally, who have been able to engage with our content on everything from AI to human-centered design to a number of policy areas. But our goal is to work with anyone anywhere who's trying to do better by their constituents, by their citizens. And what's

[4:19](https://youtu.be/-P_N1hplTik?t=259) great is two key principles that we have for all that we do is, one, everything that we do is free. We are not paid by a state or by a public service for any of this work. That is very critical to us because we know how hard the job of public service is and we don't want to throw up another barrier. Secondly, this is open, meaning that if we share content with you, use content, and then you want to take that content and use it for a purpose within your organization, that is 100% allowable and in fact encouraged. Because our goal is that you are the amplifiers and we can create economies of scale and impact by having those two principles. So, we are free and we are open. So, if you ever want to partner with us and the first question your boss is going to ask you is, hey, what does this cost me? The answer is you get to say is nothing. And then also you're able to say, well, what type of MOU do we have to do? Do we have to have to sign to use their content? The answer is none. You are able to use it in any way that you see fit. That is really important to us because many of my colleagues who work at InnovateUS have been on the public sector side and we've lived that. And we want to remove those barriers so that again InnovateUS can be the helper and the accelerator to impact that I think is needed right now in so many places. So, you'll see, if you ever want to know more about us, go to the email hello at innovate-us.org and you will hear back from us very shortly. But we are always interested in partnering with anyone anywhere who's looking to achieve this mission. So, that's our mission at a broad high level.

[5:50](https://youtu.be/-P_N1hplTik?t=350) A new partnership that we've developed in really the last a little more than the last year is this free career certification program with our partners at Google. And so, the way I describe these certification programs is these are what I call zero to 60 credentials. These are basically meant to take someone who has no knowledge in a discipline and get them to a place where they actually could operate competently in that discipline within their organization. So, the disciplines that are covered apropos to our conversation today, cyber security. Others are project management, data analytics, digital marketing, and e-commerce, IT and UX support. And you can see at the URL at the bottom of the page, you actually can explore fully, see the syllabi. These are meant to be done by a working public servant over about three to six months with about 150 hours of devoted time. And again, the goal is that the end of that through quizzes and assessments along the way, at the end of this, they actually could do a task.

[6:54](https://youtu.be/-P_N1hplTik?t=414) We have been lucky to partner with the state of New Jersey to actually pilot this where we had over 100 public servants go through this program, many of whom were entering into cyber security roles for the first time and using this to basically shore up their skills. And these are folks who are working in school districts, in law enforcement, in corrections, in the health system, in higher education, many of whom were put in the role, as you'll hear later today, being a cyber security leader because we know how important that is, but frankly, probably needed some support in their skill base so that they could be as effective as possible. So again, one avenue. And generally what we say here is that if you have a problem for whom people with a new set of skills is the solution, really reach out to us because we really want to help you. The other thing is that one thing you learn by the best practice and the pedagogy is that you don't just want to throw someone out there by themselves with a certification program. By the way, this is all asynchronous, all online, meant to be done from anywhere on a schedule of this person's choosing. But we've known that that's also helpful to create community during that experience. So particularly if you're working in a state, we will basically create a cohort experience for folks doing this program. So folks aren't doing it by themselves with monthly gatherings, hearing from experts like Veronica, who actually spoke to our nutrition cohort earlier this year, which we're very grateful for. And so that people feel like they are not doing this by themselves because we know by the data, it helps us complete.

[8:22](https://youtu.be/-P_N1hplTik?t=502) And also, frankly, I think each of us would want the same if we were going through a program like this. And so that's a best practice. So I would say if you're looking to learn more about this, if you're a state leader, for example, and you have a group of people that you would like to go through a program like this, please reach out to us. We would love to have it. And if you call us and say, hey, we have I have 100 people who would be great for this. They want to do it. Call us and we can help you through that process. If you are an individual who is a public servant and say, hey, I'd like to go through one of these, please reach out to us because we would love to learn more. And again, you can email us at hello at Innovate-US.org. And you can also go to the URL at the bottom of the page, Innovate-US.org slash Google-certificates. But again, whoever you are and if you think these skills would be helpful to you or to your organization, please reach out to us. We want to help. And you will likely hear more news from us with more states who will come on to do exactly that later this year and early next year. But we think this is an amazing opportunity. And again, it follows our principles. This is open and this is free. There is not the only thing that really we ask for anyone. It's kind of the sweat equity to kind of go through the program and bring these skills back to their organization.

[9:38](https://youtu.be/-P_N1hplTik?t=578) So again, feel free to reach out to us again at hello at Innovate-US.org to learn more and feel free to visit the URL, which I believe will be in the chat to learn more about the program in specific. So with that, let's pivot. And again, if you do one of these certificates in cybersecurity, your goal is to be like Veronica. And Veronica is someone who I got to meet when we were colleagues in the Biden administration. And I'm lucky to call her a friend now. I normally would just introduce her really quickly, but I'm not going to do that. I'm actually going to read, which I normally don't do because her career is so varied and pieces of her career are going to be part of our conversation today. So Veronica Pujin has had a varied career across tech, business, startups, academia, and government, and most recently the White House. Her career is focused on impactful technology and economic solutions. She currently works on strategic programs at the company Okta, focused on federal identities, security products, and delivery. Recently, earlier this year, Veronica finished her role as senior policy advisor at the White House, where she focused on cyber workforce needs in and outside government and AI's impact on cyber workforce needs. Previously, she worked in the Biden-Harris administration at the U.S.

[10:59](https://youtu.be/-P_N1hplTik?t=659) Small Business Administration. That's actually where I met her and where she came into, where she led the distribution of $200 billion in economic relief and supported over 15 million small businesses during the height of COVID. In her business career, Veronica worked on macro economic planning at LinkedIn, consulted clients in tech, biotech, government, and consumer products industries at Deloitte in the U.S. and Mexico. And in the startup world, she was part of launching a fintech solution to promote financial inclusion in emerging markets, taking her across Latin America and also parts of Southeast Asia. She has worked on and advised a civic tech startup that's been working in the state of California. And her academic background includes an MBA from the Stanford Graduate School of Business and a BA in economics and international relations from Claremont McKenna College. And as we very much love at Northeastern, she's an adjunct professor of political economy at the University of San Francisco. Most important thing about her, well, one, I will tell you she is not 70 years old with all that she has done. What is inspiring and intimidating about Veronica is that she likely has many decades ahead of her to impact business and the country. So again, which is why we're so lucky to have her. But also, I'll say this personally, she was an amazing colleague as a person during the Biden administration.

[12:22](https://youtu.be/-P_N1hplTik?t=742) And particularly, we were lucky to have her in our service as a country with the national cyber director in the White House during, frankly, I think a time when cybersecurity has moved to the fore, not just the business and government, but frankly, in all of our lives. I think all of us have gotten an email saying that our data was part of a breach somewhere, somehow. And as we think about all these new emerging technologies, AI, quantum, XR, how that intersects with the security of the digital frontier, it is very much a frontier. It is very much a long, invisible frontier that is vulnerable to, frankly, bad actors. And what Veronica's job was, was to think through, one, how do we protect that? But then secondly, who is going to protect that? Who are the people who are actually going to do that work? And for any of us who are local, we see this. I'm from Maryland, where this is a huge industry. And any company, any government doesn't have enough of these people. So really excited to jump into this conversation with Veronica. And you want to hear more from her than from me. One last thing I'll say is, please, again, introduce yourself in the chat. Say your name, your organization, where you're from. Also putting questions along the way.

[13:29](https://youtu.be/-P_N1hplTik?t=809) And we're going to get to it. So I'm going to stop sharing my screen. And I'm going to ask one favor. If it will be possible to pin myself and Veronica, that would be helpful so folks can see us. Really see her. No one wants to see me. But Veronica, thank you for being here today. And we'll get us pinned in a quick second. But the question I want to start with is, when I met you, it's like three or four years ago now, you had a wonderful career in the private sector. And I was always happy to find someone who wanted to go into government. But I can imagine from the outside, someone would say, why would you leave a great career in the private sector to join the Biden administration? Very frankly, in the early days, I feel like you probably joined us first half of 2021, a very rough time. I was a day one appointee and you came not too long after. It was a rough time. Talk about why you wanted to leave a great career in the private sector and initially you were coming into the small business administration. But why?

**Veronica Pugin**

[14:42](https://youtu.be/-P_N1hplTik?t=882) Yes, definitely. Well, thank you, Chika, for having me. And thank you for everyone who's involved with what Innovate US is doing. I can say during my time in service, I really wish I had access to tools like this. So when I was learning about what you're all doing, I thought this is incredible. If I can pick Jen or contribute somehow more than happy to. And actually, she gets almost getting to almost five years or four and a half years when we first met. So can't emphasize enough to those in this group that she is a great colleague and friend who wants to support people in public service. And I had that experience coming into it. So to answer your question, like she said, had a experience in tech and business. Ultimately, it was about service. I wanted to serve the country. My family, immigrant family, who has always taught us that this country is not perfect, but has given us amazing opportunities. And I wanted to expand that for others and be part of making the country as good as it possibly can be.

[15:47](https://youtu.be/-P_N1hplTik?t=947) So I always had a desire to serve, just didn't know where or how or when. I did not come from a family or anyone who had government experience, public service experience. And so when the opportunity to serve the Biden administration came up, particularly at the SBA at the height of COVID, I thought this is what I've always been interested in and serving, number one. Number two, they were seeking at the time, someone who had kind of a tech and operational background, which is what I could bring to the table because we were expanding access to COVID relief economic resources overnight. And I thought, well, that's something I can bring to the table. I'm coming from the corporate sector where we are expanding and growing and scaling all day, every day. That's kind of the name of the game. So I thought I could contribute meaningfully, number one. And number two, I want to serve. Did it for three years and cannot emphasize enough.

[16:48](https://youtu.be/-P_N1hplTik?t=1008) I'm always trying to support people who are pursuing roles in public service because I know, like Chiquette mentioned before, I know a lot of individuals in my experience in public service, sometimes you feel alone, there are highs and lows, but there is no doubt that it is tremendously valuable work. A lot of people want to have an impact on their community, on their world, on people in their lives. And public service is undoubtedly an incredible path to do that. So that's what got me in.

**Chike Aguh**

[17:23](https://youtu.be/-P_N1hplTik?t=1043) One unmute was going to happen during the session. I remember when I came in, really to the federal level, I got to talk to some folks who had served in more than one administration. And someone made an analogy of me, which was really powerful, which was it was a sports analogy, which is helpful for me, which is if you want to liken serving in government, particularly at the federal level to a sport, it's most like baseball. And the reason it's most like baseball is like, if someone is successful 30% of the time in baseball, you're like one of the greatest ever. And similarly at the federal level, because in many ways, your tools are very blunt because you're so far away generally. As one thing you learn in the federal government really quickly is that the federal government doesn't do a lot of implementing. That's actually not a lot of it. It gives out money. It makes laws. It makes regulations. Different than state government, where I served, I'm living in local government. And then also the voices and the stakeholders are far more complex and far louder. So you're trying to basically do something very, at times, very specific, very tactical, very surgical with very blunt tools, with actors who have different ideas of what should be done than you do, who are very loud.

[18:36](https://youtu.be/-P_N1hplTik?t=1116) And you also have folks who have a good degree of power over you, who you also need to, whether that be Congress, whether that be the judiciary. So baseball, there's a lot of reasons why you might strike out on any given day. I think during that period, and then, and Veronica, you'll remember this. When I came in on January 20th, January, yeah, 20th, I was sworn in at two o'clock, 2.20, if I remember correctly. I was in this seat, this exact chair. And I think I was sworn in in that corner over there because this was COVID. And for at least the first 12 months, really the first 18, this was an entirely virtual enterprise. So no one had ever done that before. No one had ever started an administration virtually with a lot of new people. Veronica, remember, we actually started more people in the early part than most administrations do. We started probably almost 25% of people. Most ministries start with 10 to 15%. And then also, where I worked, I worked at the Department of Labor. Down the block for many of us, an insurrection had taken place about two or three weeks beforehand, which obviously created a deep amount of time, a deep amount of attention within the country, and particularly in that city.

[19:46](https://youtu.be/-P_N1hplTik?t=1186) So again, when she reached out and said, I wanna serve, I was like, are you sure? You have a great life. Why would you do this? And the answer is, I think, as selfless as you could have heard her say. So anyone who's willing to do that at that time, my privilege to be helpful in some way. So I wanna walk through your career a little bit, but I do wanna start at a high level. So we're here talking about this digital frontier. And I wanna pick up something that you've talked about before, which is, and I'll separate it. It's kind of two questions. One, talk about the cybersecurity landscape that you see. This is a going concern in every organization, in government, in the private sector. You're working on this now across a number of different stakeholders. Give us the state of play. And let me ask the question this way. Are we better or are we worse off than we were four or five years ago? Are we safer and more secure than we were four or five years ago?

[20:48](https://youtu.be/-P_N1hplTik?t=1248) And when I say we, I mean all organizations, private sector, public sector, nonprofits. Because it can feel like at times things are getting, that attacks increase, that we're getting more unsafe. But that's me as an unsophisticated bystander. From where you sit, what's the state of play? Where are we relative? Are things getting better? Are things getting worse? What do those threats look like?

**Veronica Pugin**

[21:15](https://youtu.be/-P_N1hplTik?t=1275) Yeah, okay, easy question, Chike. As much time as you want. So a few thoughts. I'll start with your first point of the, what's the landscape looking like in terms of cybersecurity? I think what you started with at the top of highlighting that cybersecurity has moved to the front of our lives. That's, I would say, a very good way to describe this topic for several reasons. So one, cybersecurity is not new. It's not a new reality. But the opportunities to cause harm via the digital frontier, right, as this is called, are increased as our digital lives increase, right? So the more our lives become digital, the more we access the promise of technology, right? A lot of us are excited, let's get things digitized. Let's get medical health records digitized so that we could have a better experience in the healthcare.

[22:16](https://youtu.be/-P_N1hplTik?t=1336) That sounds great, right? On the other hand, that's an opportunity for someone to hack sensitive medical information. Let's digitize our banking system, financial technology, incredible in terms of access, incredible in terms of convenience, user experience, another opportunity to hack someone's whole financial livelihood. And so there's a direct correlation between the more we access the promise of digital tools, which is not a bad thing, and they are incredible at expanding access. But if they're not secure, then it increases the threat of cybersecurity. So I would say that's why it's gone up. One of the reasons it's gone up, another reason the threat of cybersecurity has gone up is the nature of warfare has been changing over the past few years. So with the war in Ukraine, it has had some of the most rapid evolution in cyber warfare in all of history. And so there are tools and methods that are being developed in that context. They're then able to be used by bad actors in other contexts.

[23:21](https://youtu.be/-P_N1hplTik?t=1401) Number two, so those two ingredients, increasing digital lives and the nature of cyber warfare is increasing the presence of cybersecurity threats in our day-to-day. One other piece I will add is part of increasing our digital lives is artificial intelligence. And so a lot of the conversation around artificial intelligence and ethics and human rights interests and or security has been around what data is in the large language models to train the models. And that is a very important conversation. In addition to that conversation, that assumes that the right actors are using those models. So that assumes after we finish the conversation around what data is being used to train those models, is it ethical data? Is it representative data? That assumes the right actors are using them, but that's a cybersecurity question. And that's specifically an identity question of what human is accessing that data.

[24:26](https://youtu.be/-P_N1hplTik?t=1466) That conversation has been exploding over the past, I would say two years. More recently, another dimension is added with AI agents and that's happening as we speak over the past seven months. That's really skyrocketed.

**Chike Aguh**

[24:41](https://youtu.be/-P_N1hplTik?t=1481) And define an AI agent for our folks who may be listening who may not be familiar.

**Veronica Pugin**

[24:47](https://youtu.be/-P_N1hplTik?t=1487) Right, so if you take a chat GBT, for example, a chat GBT is a lot of people have likened it to a kind of search on steroids. I would not say that's an accurate way to depict it because yes, it's search on steroids and that you can ask chat GBT like, how do I make a really good recipe for Thanksgiving? And they'll give you different ideas and prompts. That's not, yes, that's very convenient, but also what chat GBT and the models behind it is have reasoning to problem solve. And so when you have an agent that can problem solve, so you take an agent to book travel for you, you share with the agent some of your preferences, guidelines, and that agent can then act on your behalf to problem solve. So it's not just an input output of I submit query to said agent and then they give me an output. It's I give the agent some tools and some guidelines and they go problem solve on my behalf.

[25:49](https://youtu.be/-P_N1hplTik?t=1549) So that's a key distinction. And so that agent is now going to make travel, book travel on my behalf. If they're going to do that, they're going to use my financial, my credit card information. They're going to make financial transactions on my behalf. And that's just one example. But when it comes to cybersecurity, you could, a bad actor could not only hack the data, but could hack the interests of the agent and the guidelines that they're given to problem solve. So this is just a kind of a laundry list of ways that the threats have become more complex and increased. The World Economic Forum released over the past year that cybersecurity is one of the top 10 global threats. So that's kind of to your question on the landscape. Those are some themes I see in terms of threats. Are we safer now? Are we less safe? I think those answers that you get where someone says it depends, it's always very annoying. So I'll share what it depends on.

[26:51](https://youtu.be/-P_N1hplTik?t=1611) The cybersecurity, the top targets for cybersecurity attacks are first, government. Second, service providers, service providers. I would say service provider entities. And the reason I grouped that is sometimes as nonprofits, a lot of that is government, but it's basically like a Red Cross type of entity. A service provider that has vulnerable data information that, because you think, okay, a bad actor is targeting, where is there the highest probability that my quote, unquote, victim is high stakes. So they're not just gonna lose a couple hundred bucks if I target them. It's people's lives that are at stake. And therefore the possibility to get ransom, to get something is higher. So those, so government, service providers, and then SMON, I saw this a lot at the SBA. SMON medium-sized businesses.

[27:52](https://youtu.be/-P_N1hplTik?t=1672) So a small business, a medium business doesn't have a full IT team that can set up all their controls and protocols, be monitoring, pay for the software to be doing an assessment. And for a small business, you have targets that just do a quick hack and they can take cash and run. So I think the threats to those, I would say, especially the latter two, I don't have a quantitative assessment, but those are not prepared for the increasing threat. Whereas the leading banks in the country, they know what's happening. They're investing in this and the threat's going up, but so are their protections in response, as is the government, federal government knows, versus these kind of smaller players, or sometimes they're not even smaller in size, but just smaller in IT budget to be able to invest in protecting themselves.

**Chike Aguh**

[28:51](https://youtu.be/-P_N1hplTik?t=1731) So you took a really hard question. And by the way, this was a pro response, by the way, for those of you who are watching, this was a pro response. But the way I hear what you're saying is, two things have made this harder and more complicated. One, and I'll use almost a military analogy, which is the amount of territory to be defended has grown because people's lives are becoming more and more digital. That's one. Secondly, the amount and types of attackers has also grown. And I think the big thing that I see, I think if we talk about cybersecurity 20 years ago, we were talking about private criminal actors who maybe organized crime, maybe just individuals who were trying to cause damage, but now cybersecurity is a tool of geopolitical warfare. And in fact, if you were to think about it from sadly an ROI perspective, if you are a nefarious actor, the amount of damage that you can cause by investing in frankly, a group of cyber actors to work on your behalf against an enemy versus conventional.

[30:00](https://youtu.be/-P_N1hplTik?t=1800) Warfare, meaning people, kinetic weapons, things like that, I've never done that calculation, but I can imagine being exponential, just literally per dollar invested. And again, Ukraine is an example. We are seeing this in some of the other kind of hot and cold conflicts around the Middle East, where you have actors, and I will not have Veronica talk about anything classified that she is aware of. But that's how I see this. More to be defended, and more and more types of actors you have to defend yourself against. And you said it really well, I always think about the 50-person construction firm in Maryland, who has money, has assets, but doesn't have a CISO, a chief information security officer. They don't have money for that. They might not be aware that they, oh shoot, my accounting system, my banking information should have. I mean, all of us who are here right now, how many of us are in organizations where we know there are people who are not doing multi-factor authentication on their basic email?

[31:06](https://youtu.be/-P_N1hplTik?t=1866) How many people do you know, when they do the phishing test, they send out an email that is clearly an actor, they somehow always click on the link, and again, that requires someone to stay on top of that. So that's what I hear. So let's go back, go back, go back. You know, you started your career in the private sector, particularly in the technology space, not in cybersecurity, but more broadly in kind of consumer and enterprise technology. I want to hear from you why you went into that space, one. And then two, what did you learn there that was helpful when you got to government?

**Veronica Pugin**

[31:43](https://youtu.be/-P_N1hplTik?t=1903) And so I kind of, the reason I was talking about earlier that, like you said, the territory has increased, partially because we've been adopting these technologies to expand access to solve our problems, and the promise of that was and still is so exciting, and I was and am one of those people who interpreted technology that way. That these tools, these digital tools could expand and do expand access in incredible ways to services, to products, to experiences that beforehand people could not access. So at the SBA, working on loans, I was in the Office of Capital Access, expanding access to credit. Technology has facilitated that in ways that for decades we couldn't crack. So I was excited about that kind of rewinding. I joined a financial technology, financial inclusion startup where we used mobile phone to expand access to banking services to historically underserved, underrepresented communities in the banking sector.

[32:50](https://youtu.be/-P_N1hplTik?t=1970) I was at LinkedIn, seeing the role that LinkedIn could play in terms of job access, employment access, certification access. And so that is what really excited me, and my kind of foundation of my career was, and still is, but I've been seeing more and more the kind of complexity of technology is economic access, people to just have access to tools, to products, to services, to better their lives, and the role that technology can play in that. So that was my guiding post when I joined, to your question of how was that helpful when I joined government. My first couple years in government or SBA at the Small Business Administration were adopting technology to expand access. So we used technology, automated controls to get through over a million applications for COVID economic relief that had been in a backlog. It had never been done before. We rolled out the first mobile phone, the mobile app for disaster relief.

[33:55](https://youtu.be/-P_N1hplTik?t=2035) So for those experiencing and devastating recent hurricanes, and before, if you had a hurricane come through your town, destroy your house, destroy your business, you could not use mobile phone to access small business economic relief. So we rolled out the first mobile phone for that, mobile phone app for that service. And so it helped me join in government and having that lens of how technology can expand access, number one. Number two, and I know Innovate US talks about this in other spaces, the role of the user experience, I think, is very important. So technology has a kind of, especially B2C, but not only that, but B2C has an end user appreciation. So you think, okay, who's my end user that's going to access this service, this product? How can I design all the systems, all the operations to deliver that product or service effectively? And so when I first joined government, I worked with a lot of exceptional policy colleagues who are very sharp in developing policy, but policy doesn't always have an eye for end user experience.

[35:07](https://youtu.be/-P_N1hplTik?t=2107) And so that was kind of some of, I could contribute there, having worked on user experience, specifically in financial technology. I think you were kind of getting at then, how did that go to cybersecurity for all those programs we rolled out?

**Chike Aguh**

[35:22](https://youtu.be/-P_N1hplTik?t=2122) You're already at it. I was going to ask how you made the, again, I remember working with you because I was working at the Department of Labor, we were working on unemployment insurance, a very similar experience. How do we get benefits to citizens who have been economically dislocated? You were working on, I know, I'm sure for SBA, shuttered venues, restaurant funds for folks, again, who are trying to kind of salvage their businesses. But I'm curious, because I think I remember when you called me and we're talking about going over to the cyber office. And so I'm curious, what instigated that for you to want to go into that space? Because also, it's probably important to say, you and I started our federal careers at an agency, a department, Small Business Administration, Department of Labor. Going to the White House is different, in the sense of the White House is, historically, what we called the Department of the President. It is a small, lean organization compared to maybe 400, 500 people who work in the executive office of the president versus at Labor, which is not even a large agency, 15,000 FTEs spread across the entire country.

[36:35](https://youtu.be/-P_N1hplTik?t=2195) And the function is different. The function is more of a convening, coordination, directive function to basically communicate as clearly as we can the will of the president of the United States across a massive federal bureaucracy. And then hopefully, get folks to work together who normally don't work together. So it's a different set of muscles. And I will say, as someone who's worked with the White House, knowing many others who've gone, who've done what you've done, the transition is not seamless, because you're used to being able, when you're in an agency, to do a thing. You're used to being able to, and then you go to the White House, and it's actually not as clear as that. All you, frankly, have is the president's word, because that's who we all work for. So for you, curious about why you wanted to do that? Why you wanted to make that jump to the White House and also to cybersecurity?

**Veronica Pugin**

[37:21](https://youtu.be/-P_N1hplTik?t=2241) Yeah, so that's where... So the White House opportunity for the White House Office of National Cyber Director, what they were looking at and really growing their focus was cyber workforce. And so it's the people who do the cybersecurity work. And so my background, having been more economics, at LinkedIn, I did macroeconomic planning, labor, macroeconomic planning. So jobs, job growth, job destruction. So I had some, I had experience relevant to that topic around workforce, number one. And number two, they were exploring how to have, to develop kind of a strategy and operations approach to working with private sector that develops the technology, the innovations, and how does government leverage that? So that's where that opportunity emerged. And again, I thought, I feel like I have something to contribute here.

[38:21](https://youtu.be/-P_N1hplTik?t=2301) A lot of what drives each career step I take is, is this a problem that I am excited to contribute to solving? And what do I feel I have to contribute? So that led to that interest. To your point around cybersecurity, while I was at the SBA, and we were rolling out all these digital solutions, I was seeing more and more identity theft. The presence of guarding against fraud, which we had one of the most historically low fraud rates relative to other massive financial distribution programs and unseen at that speed. But the presence of that and the focus of that made me appreciate that more. And seeing identity theft and these kind of digital crimes committed, what you were saying earlier, this is not just the stereotype of some younger individuals in a hoodie, in a garage.

[39:24](https://youtu.be/-P_N1hplTik?t=2364) These are foreign-based, or you learn more and more, foreign adversaries funding these activities. Very evolved and complex groups funded throughout the world in the U.S., outside of the U.S. And so I saw more and more that this is not just some random hack here or there. This is a full orchestration of crime that is growing and growing. And for all the conversations and all the efforts around helping people build their economic security, their economic stability, and it could be taken away just like that. And that's what got me really thinking more about that. So I joined the White House, and my portfolio ended up working on cyber workforce nationally and cyber workforce for over 60 agencies and departments. And so we were looking at what policies and programs and processes would help increase the presence of cyber workforce personnel within the federal government for these over 60 departments and agencies.

[40:32](https://youtu.be/-P_N1hplTik?t=2432) And then what could increase the cyber workforce nationwide? A caveat that I'll add, I'm not familiar with everyone's kind of domain here in terms of public service, but for any interest in kind of the economic lens, cyber jobs are some of the best jobs in terms of economic mobility. They are some of the jobs that don't require a bachelor's degree and have opportunity for wage growth, remote opportunities for caretakers. Because the nature of cybersecurity is evolving so quickly that anything I learned in undergrad, whatever x years ago, a lot of it's outdated. And so it is a profession that rewards upskilling those who get certification programs because of the nature of the field. So that's what we focused on, growing the national workforce, also an angle of economic mobility, and then looking at what processes and policies could increase cyber workforce within the government.

**Chike Aguh**

[41:32](https://youtu.be/-P_N1hplTik?t=2492) This is super helpful, and I'll say 2.1, any of us who were in government who worked on a number of these stimulus programs to really support Americans during that time, the integrity concern was very real. We dealt with it in historic levels in the unemployment program, which was basically, again, we would see international foreign actors impersonating Americans to steal at a relatively low rate. But when you put 3% on $850 billion, it comes down to a large number. And the challenge that we were really working with is, how do you balance for us access and security, or as we would say, integrity? Meaning, there is a way to have 100% integrity, it's you just don't give anyone any benefits, easy.

[42:32](https://youtu.be/-P_N1hplTik?t=2552) There'll be no staff if no one gets anything. There's just no program. Exactly. But we have another mandate, which is we had, and I'll use UI as an example, or excuse me, unemployment insurance. We deployed from May 2020 to roughly May 2021, $850 billion in benefits to a third of the American workforce, which kept people in their homes, had groceries, helped people pay rent, so on and so forth. So balancing that is really, really hard. You don't want no controls, but you don't want to put up so many where effectively the people who most need it are actually literally locked out. And then when you put an equity lens on this, when you look at who is locked out when integrity, I don't say integrity goes too far, but when you don't get that balance right, it's the most horrible. And so that's a challenge that we were continually trying to walk, and I know we were not the only ones. And I really, and again, being a Marylander, cyber workforce is, you know, Fort Meade, NSA is up the road from me.

[43:36](https://youtu.be/-P_N1hplTik?t=2616) This cyber workforce challenge across the private sector, the public sector, I have not met an organization who has said, I have exactly the amount and types of bodies that I need to protect my digital frontier. I've not met the organization. And so I'm curious, what are the best practices that you're seeing for organizations, particularly governments, to get the people that they need? And I'll layer on an additional complexity for government, which is, if you can do cybersecurity in the government, you can absolutely do cybersecurity in the private sector, and the pay differential is not trivial. So for governments, particularly, how are you seeing them attack this, particularly with that dynamic, because it's such a hot set of skills?

**Veronica Pugin**

[44:20](https://youtu.be/-P_N1hplTik?t=2660) Absolutely. And so it is a real challenge nationwide, getting enough people with the cyber skills. I will say, in addition to that, the nature of cybersecurity is constantly evolving, because cybersecurity evolves with emerging technologies. So as you have new technologies, the nature of cybersecurity changes. So it's not static. It's not like we just train a bunch of people tomorrow, and we're set. So that's also a challenge. You don't just fill the role in your set. It's constant re-skilling. On one hand, that's part of what makes it an opportunity for economic mobility because no one has all the cybersecurity skills from 5, 10, 20 years ago and is set. So on one hand, that creates opportunities, but on the other hand, it's very difficult at a national level. So some of the best practices, a few, and I took note on your dual point question of how do you get people in, but then also how does government compete? So one is the skills-based, and maybe some have heard of this, but skills-based hiring. So that's one that was really emphasized in a lot of these White House discussions and has been published.

[45:40](https://youtu.be/-P_N1hplTik?t=2740) Skills-based hiring means rather than requiring certain degrees, you focus on, does the person have the skills I need for the job? And they can demonstrate that through a degree. This is not an all degrees are bad message. Some degrees could be a way that someone got the skills you need for them to complete the job, and they could have obtained the skills in another way. And so focusing on that, what are the skills? It does, in practice, like getting more tactical. This requires partnering very closely with HR and IT to be able to document and really articulate what are the skills for these cyber and cyber-adjacent roles. And I emphasize that because I saw a lot of people say skills-based hiring, skills-based hiring, but practically, how do I do that for my job description? Really partnering with HR and IT. So that's number one. Number two, to keep your workforce fresh. So there was a saying that I noticed with a lot of technologists and professionals that I worked with that people enter government, certain parts of government, and they become, quote, unquote, stale. So their tech skills get stale. So they need to go back to the private sector, sometimes for compensation reasons, like Chika highlighted, the private sector competes, attracts them back. Sometimes that's a factor. Sometimes, and I've met different colleagues, myself, who say, I'm getting stale.

[47:11](https://youtu.be/-P_N1hplTik?t=2831) I need to go back to XYZ to upskill. If not, I'm not going to be competitive in the job market at one level. And then at an aspirational level, if you're trying to serve and make a positive contribution, if your skills get stale, you're not going to be able to serve as effectively. And so that's where I would say continuous learning, having a robust training program. I keep saying, actually, Chika, I don't know if I've shared this with you, but since my time in government, I keep saying that if I could really promote some positive changes and or support changes that I know many others are furthering in public service, it is HR. Just really support. There's a lot of great work being done around skills-based hiring and continuous learning. That work needs to be lifted up and elevated. That, I think, will really change the game for public service and specifically for public servants to be able to leverage technologies in an accessible but also secure way. So continuous learning, the technology is constantly changing.

[48:15](https://youtu.be/-P_N1hplTik?t=2895) Whatever gets trained on today won't be exactly the same in two years, three years, four years, et cetera. So those are two, skills-based hiring, continuous learning. Then to your point on the pay difference and how does government compete, there is, interestingly, there is a whole cadre of individuals that I encountered while at White House we were launching. There was the launch of the AI task force, trying to get AI talent into the federal government. So something I encounter is that there's a whole cadre of individuals who want to make an impact, who basically are motivated. They'll say those exact words. I want to make an impact. But they don't know how to get into government. They're not aware of government as a vehicle. That was my story. They don't have other people in their lives. There's the cycles of careers and professions. Do you know someone in your life who's done that? No. Did your family members do that? No. So part of it is recruiting, just to be on people's radars and just being transparent that this is the salary. I did encounter a lot of individuals who said that once they learned about the salary, it was, quote, not as low as they had imagined. So they literally kept saying that. So some of it is just dispelling certain myths of what this is, number one. Number two, this profile sometimes is up to be in government for the next 10, 20, 30 years. A lot of times it's not. They are interested in a particular role. If they're coming from the tech sector, the probability that they've been and plan on being at the same company for 10, 20 years is close to none. And so I have encountered a lot of individuals where they'll go to government recruiting fairs, and the sales pitch that will be given to them is job security. You can be here for the next 10, 20 years to a millennial, Gen Z. That is not

[50:22](https://youtu.be/-P_N1hplTik?t=3022) appealing. And so carving out roles and there are fellowship programs that are effective at this, but just promoting those that create these discrete opportunities to contribute. I acknowledge that for managers, it's not easy. Someone who comes in for just a few months, that's not helpful. But there are fellowship programs of two, three years that someone could take on specific projects, modernize your systems, upgrade your systems, launch mobile apps, secure these very specific cyber programs and projects. And that's very appealing to that individual. And then they feel they can serve, make this impact, and then see where life takes them after that. I think that's a big difference from how government recruiting has been done for historically, kind of these short-term roles. And sometimes the individual then stays. I have a friend who she had a prolific IT career, then joined the White House, and now is in a leadership role in an agency. She loved the service and is now there and going on year four and not planning

**Chike Aguh**

[51:33](https://youtu.be/-P_N1hplTik?t=3093) on leaving anytime soon. I think you've said a lot of really important stuff. One, you know, working backwards, how do you, we go from kind of a time that you can think about a career, particularly in the government, like a marriage. I more, you know, till death do us part, for better, for worse, so on and so forth. I would more have people think about it almost like my military colleagues do. I'm doing a tour of duty that will be impactful, that will be for a period of time, but not necessarily forever. And if I look at my colleagues at the U.S. Digital Service, the Technology Transformation Service, and a number of other of these really special offices that started the Obama administration to bring in this talent, that is appealing because you do find, particularly, I was amazed the people I got to work with, particularly in that beginning time when the country was in such a tough shape, who said exactly those words that you said, I want to make an impact, I want to help, and creating a kind of a clear way to do that. I think that's one. I think, secondly, your point on the constant upscaling, the skills-based hiring, and, you know, in some ways you're singing our gospel here. We at Innovate U.S. are supporting a number of states in conjunction with the National Government Association on doing exactly that.

[52:42](https://youtu.be/-P_N1hplTik?t=3162) Maryland, we were the first to have that, to make that mandate across government. And now, but you're right, the devil is in the details. If you've removed the college degree as a requirement, not again, not that it's bad, but they removed it as the single barrier. All right, now, but now, how do I evaluate? And in some ways, in the technology space, which is led here, you have, you know, the Smequa process and a number of other ways to have someone demonstrate that they can do the task, particularly in the cybersecurity space. But it's a change in behavior, particularly, it's really important partnership between HR and IT. We have about three minutes left, and as usual, when you and I start talking, we will go on for a while. Two quick questions I wanted to ask you, you actually answered one of them, which is, or began to, so two questions. One, let's say someone is watching this, and in some ways they were like you. Obviously, they've had a career, but they have not been in cybersecurity before. What is the number one thing you can recommend to them to begin a career in cybersecurity, because of all the needs that you've set? So that's one. And then secondly, with a specific question in the chat on financial services, which is basically, what are some steps that financial services is taking to protect small businesses, protect nonprofits, who are in this category of high stakes, but low protection?

**Veronica Pugin**

[54:02](https://youtu.be/-P_N1hplTik?t=3242) Interesting. Yeah, so for the first one, for entering cybersecurity, my experience, I would say, has been the same of my recommendation in terms of hiring, a skills based approach. So I'm personally not developing the controls. I'm not technical by, you know, by training. I am not a security engineer. My skill set has been strategy and operations. And so ultimately, that role is what I played in government. And at my current company, cybersecurity company, I'm doing strategy and operations for our government delivery. So the skills, because ultimately, when jobs, when someone's hiring for someone, or you're pursuing a job, it's skills, there's a job that needs to get done, ultimately. So my suggestion would be to look at is the current types of roles you play? Is it partnerships? Okay, well, every cybersecurity company, every office that delivers cybersecurity needs partnerships, right? Is that your skill set? Or is it strategy and operations?

[55:08](https://youtu.be/-P_N1hplTik?t=3308) Or are you technical to explore the roles and the different organizations, teams that need that. And if you're not interested in continuing that, it would be the same thing for any industry, then that's a new retraining. If you want to become a security operations analyst, then pursuing certificates and training programs in that direction. But again, taking the skills based approach would be my suggestion. And thinking what type of roles do you want to play in a given organization or department or agency or team? Number one, and then for financial services, what it's interesting, I'll get this kind of like a more technical answer. But what we're seeing there is the emergence or not emergence, it's definitely there, but growth of cyber insurance, and the insurance program. So basically, a bank's role financial services, protecting the deposits and protecting the financial assets. So if someone gets hacked, and they get stolen, then the bank has certain safeguards to refund or support the individual. So it's in the bank's interest for this not to be happening. And so there are certain insurance programs, I would say, though, for that small business, they're still need at risk, because they can have certain assets in a banking system, and that bank can have their controls. But they might have customer data via a CRM system, they might keep certain delicate information via a different system. So say a small business, just kind of two cents there, if a small business is thinking how to protect themselves from a cyber standpoint, their finances is one, but it's not the only

**Chike Aguh**

[56:49](https://youtu.be/-P_N1hplTik?t=3409) area to be thinking about. That's super, super helpful. With that, first of all, I want to thank you so much, Juan, just for being an amazing colleague and friend, and really thank you for sharing your knowledge. Like many of our content, this is going to be rewatched over and over and over again across our platforms. So we're really excited for that. What I'm going to do is just quickly reshare information per what you heard on our partnership with Google, and particularly our cyber certificate in cybersecurity, which people are using right now to actually begin that career. If you are interested, please email us at hello at innovate-us.org to learn more, whether you're an individual or you are a leader of an organization. And feel free to visit innovate-us.org slash google-certificates to learn more. Veronica, thank you so much to all of you who are watching and will watch. Thank you so much. Have a wonderful, wonderful rest of the afternoon. Thank you. Thank you.

* * *

Original page: https://innovate-us.org/protecting-the-digital-frontier-lessons-in-cybersecurity-from-the-public-sector · Licence: CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/), as stated on innovate-us.org