Phoenix Cast: Leading Cyber Marines with Maj. Gen. Mathew G. Glavy

FORT GEORGE G. MEADE, MD, UNITED STATES

01.26.2021

Story by Staff Sgt. Jacob Osborne 

U.S. Marine Corps Forces Cyberspace Command

Maj. Gen. Mathew G. Glavy, commander of Marine Corps Forces Cyberspace Command, joined John, Kyle, and Rich on the Phoenix Cast to discuss leading Cyber Marines, adapting to change, and communicating cyber to the public.
Glavy discusses what he thinks it takes to be a successful leader of an always changing cyber force. He said being humble, having the willingness to learn, and empowering people are key.
Don't miss a single episode. Subscribe to Phoenix Cast podcast in Listen Cast, Anchor, iTunes, Breaker, Spotify, Google Play, Radio Public, and more. Please leave us a review and tell us what you want to talk about next.

Maj. Gen. Glavy’s cyber reading list:

The Phoenix Project - A Novel about IT, DevOps, and Helping Your Business Win By Gene Kim, Kevin Behr, George Spafford

The Defence of Duffer's Drift by Ernest Dunlop Swinton

The Kill Chain: Defending America in the Future of High-Tech Warfare by Christian Brose

Scrum: The Art of Doing Twice the Work in Half the Time by Jeff Sutherland

Measure What Matters: How Google, Bono, and the Gates Foundation Rock the World with OKRs by John Doerr

The Hard Thing About Hard Things: Building a Business When There Are No Easy Answers by Ben Horowitz

Cyber War: The Next Threat to National Security and What to Do About It by Richard A. Clarke

LikeWar: The Weaponization of Social Media by P.W. Singer

Ghost Fleet: A Novel of the Next World War by P.W. Singer and August Cole

Thank You for Being Late: An Optimist's Guide to Thriving in the Age of Accelerations by Thomas L. Friedman


TRANSCRIPT


John: Welcome to the Phoenix cast. A podcast about cybersecurity, technology, and innovation issues in the military. We are your hosts, John…

Rich: … Rich …

Kyle: … and Kyle.

John: Rich and I are both U.S. Marines and the opinions expressed on this cast are those of the host, not official military policy.

Kyle: And the opinions expressed by me are my own and not those of my employer or any other businesses that I am associated with.

John: For today's episode we have a very special guest, Major. General Glavy. Sir, thanks for coming on the cast. Could you give us a quick intro?

Maj. Gen. Glavy: Thanks you guys and it is great to be on the cast. Long time listener. First time caller and, pretty cool to be on this with you guys. So, my name is Major General Matthew Glavy. I'm an aviator. Of course all aviators have a call sign and it’s skirt, and I have the incredible honor of leading the men and women of the U.S. Marine Corps Forces Cyberspace Command.

John: And sir again, thank you so much for coming on the cast. So, the first question I have for you and you hit it for me right there in the bio. So you're an aviator and I would argue you've taken over one of the most, if not the most technical commands in the Marine Corps. Is this something where the aviation world has just completely translated over? Or is there a bit of a learning curve? And what's that feel like?

Maj. Gen. Glavy: Well, there's no doubt, first and foremost that there is a bit of a learning curve goes without saying, You know, my background also included. I was a systems engineer at the Naval Academy. I was a heck of a Fortran programmer and a little Dartmouth basic here and there and even some machine language. So systems engineering was, you know, graduated in 1986, was about, you know, computers and microprocessors being part of systems, mechanical systems, electrical systems, hydraulic systems. But this idea of feedback in order to make a system much more efficient and effective. So from there obviously going to aviation was a far cry from anything I did at the Naval Academy. But I came back to this world of cyber and computers. I worked on the Joint Staff in the J-39 which dealt a lot with information operations. And, you know, back in the day was kind of the infancy of cyber, at least from a normal domain in the Department of Defense. And then, from there, I got the opportunity to come back to cyber when I went to Cyber Command, as a general officer to be the deputy J3 in cyber command. And then, of course, the incredible good fortune of winning the lottery and coming to the U. S. Marine Corps Forces Cyberspace Command. So how does that correlate to aviation? Certainly the operational side of it is paramount. What you do in aviation, this idea of planning, briefing, rehearsing, executing debriefing, is kind of the world of aviation. And it's about repetition, and learning and getting better and better at your tradecraft and there was an incredible opportunity to kind of do your job every time you did your job and what I mean by that, whether it's training or combat operations or find the president or fighting off a U.S. Man of War in some godforsaken places, you know, you're doing your job, and there's this incredible sense of satisfaction by being operational. So, coming into cyber, I realized that a lot of that is similar to this operational construct at least working with you all that's been for sure, the case, right. We have been executing missions, you know, operationalizing and improving our network really revolves around this idea of doing your job every day and at the end of the day have something to show for it. And sometimes that something is big, and sometimes it's really small. But the fact of the matter is, I think one of the ideal things that come into this has been the idea of being able to do your job every day and at the end of the day, having outcomes and results that kind of reflect your hard work. Again. Some days are better than others, and you guys know that. But I think this idea of being operational has afforded me a great opportunity to go from aviation into this cyber into this world of networks both defending them and fighting them, and, yeah, it's been a thrill. And, I love every minute of it.

John: So, sir, it sounds like you were a nerd coming into this, and now you sort of went away from nerd to aviation and come back to nerd at Cyber. Do you think that? Do you think it's a prerequisite to be sort of a nerd coming into this to be successful in your role?

Maj. Gen. Glavy: So I think those are, when you say nerd, I have this fondness in my heart for that

John: Absolutely sir we love it.

Maj. Gen. Glavy: I don't know if I could put, I don't know if I could put myself in your category you guys have earned all that.

John: Oh, sir, you program in FORTRAN and you are well within our category.

Maj. Gen. Glavy: Yeah, yeah. So, no, that's fair. But I'll be honest with you. I think you know, this is really about a love, right, and why I think, and parochially, why we've been successful and these guys on the show and you know it, right isn't about me. It's about people who really love what they do. And this idea of a nerd you call, whatever you wanna call it is about really loving what you have. In this an insatiable passion, right, to understand something and to be good at something that that I think few people understand. And there's certainly equivalency in aviation, you know, in wanting to be, you know, wanting to be good, wanting to be the best on what it takes to do that. Being in the simulator, being what I like to call a gym rat, right? And always wanting to improve yourself. And, you know, you know, Malcolm Gladwell talks about, you know, doing something 10,000 times, and at that point, you know, you could be really great at it. I think, you know what John and Rich have told me, if you're passionate about something and you put your heart and soul to it and that's something you know becomes a part of you, boy, you're gonna be pretty good at it. And I would not put myself in that category yet. And you know, maybe too late for me to be what you all are and how passionate you are about it and how good you are at it. I probably share the passion, but I don't know if I share the skill that you all have.
Kyle: Well, I think we appreciate your modesty in that sir.

Maj. Gen. Glavy: Oh, good.

Kyle: All right. So I'm gonna double down on a couple of the things that I wanted to ask you about today. And it really revolves around how you made that transition back into something as complex as cyber, and whether that's working in the J39 or working, you know, as the CG of cyber right now. Are there any things that you would recommend to others who maybe didn't have the necessarily in-depth nerd background that we talked about and that you have? What do you think is critical for people who are rotating into cyber, especially in senior leadership positions? What do you think is critical for them to know? How do you think they should train or educate themselves, or what resources were useful to yourself? Just trying to see what your recommendations are for others who are coming into this, Uh, maybe a little cold.

Maj. Gen. Glavy: That's a great question. Thanks, Kyle. So I would say first and foremost that, you know, especially coming into it later. Like I have, I mean, really, where it's you know, my full responsibility is, you've got to show up with a lot of humility, right? You gotta be humble. You know, I find myself, you know, as the commanding general of II Marine Aircraft Wing. I always found myself in a pretty good spot, right? I could talk my way through and think my way, and plan my way through and even some aspects, right? Fly my way through, right, the world of aviation as a commander on top of a marine aircraft wing. You know, in this world, you can't right, and you don't even want to pretend that you can. And so there's a couple of variables and one certainly is humility. You got to show up with plenty of it. And then the second part is you gotta be in this incredible learning mode. You know, and I find myself often in that category, especially around, John and Rich and others, right, that I'm always learning from them. And that sounds a bit odd, and probably, you know, from a leadership standpoint, you know, this idea of being, you know, the teacher student, and you know, the father son. You know sometimes, you know, in Gen Lejeune's leadership message, right. Here I'm supposed to be the teacher, per se, but I find myself being the student and you gotta be able to do that. There's really no other way. And even if you're a nerd and even if you know you, you have skill and tradecraft in this environment, it's always changing. There's always someone who knows more than you. And you gotta be able to check your ego at the door, goes without saying and then and then the second part. And this is, you know, really important. You gotta have this humility and you gotta be able to learn, so the third part to correct myself is you gotta be able to empower Uh, boy, if you don't have the ability to let go, you know, to empower those around you, especially those that know so much. Uh, you'll never you'll never be successful. And so sometimes I'll be honest with you. I find myself in this humble state out of necessity in this learning state, out of necessity and in this empowering state, out of necessity. If we're gonna be successful, guys like Rich and John, and so many others, right? They gotta be empowered to do what's got to get done and those certainly I'm accountable, responsible and it's never lost on me. However, anything turns out whatever we do believe me, it's me, you know, going back to the commandant or me going to the commander of the U.S. Cyber Command saying, you know, hey sir, you know, we screwed up or whatever the case may be, luckily, Kyle, I haven't had to do that because I got some pretty great people that obviously have made us look good. But those are just three things that I would tell you that humility, learning and empowerment that are critical if you're gonna walk into this as a leadership role and want to be successful.

John: Sir thanks so much for that feedback. I I thought that was excellent. Kind of coming at this from a different direction. So if they listen to you and they did all these things and they develop themselves, they stayed hungry. Um, and now they're kind of coming into a world where they might have these new cyber, either officers or enlisted Marines, are gonna have a pretty high level of skill in a certain area. But, you know, in general, cyber is not just going to be the only facet of the war. So we're gonna have to interact with, you know, Department of State, Higher Level Headquarters, etcetera. What recommendations do you have for cyber folks communicating with non cyber folks? Because I think this is probably if I had to pick an area and wave my wand to just make us magically good. It would be communicating outside of the operational field. So do you have any recommendations for those who are kind of trying to learn to speak non cyber about cyber things?

Maj. Gen. Glavy: Yeah. This is a huge problem. It’s really. It's a big problem. I know that sounds weird. And the problem is that, you know, even you know, we got artillery officers. Our chief of staff is a MEU commander infantry officer. So they walk into this environment and in a very short period of time. Oh, my goodness. Their lexicon, their language, their speak it's It's all wrong. It’s hard than to articulate and communicate, you know, with the rest of the Marine Corps. And, you know, when I talk about things like infrastructure, I'm sure as I say this 10 times during the course of a brief or update that I'm giving, people are saying, “why is he so concerned about the roads? What are the roads? What does he deal? Why is he dealing with roads?” I mean, we do this, we do this all the time, things like tools. And I mean, you guys know the routine fairly well. And so I'm very sensitive that how I explain myself and I don't know necessarily think that I've figured it all out yet. Uh, that I gotta really I mean, you you have to be careful on how you speak because then you'll almost be counterproductive And what you're trying to describe, uh, to senior leadership and and if senior leadership, or, you know, even peer leadership or even you know, the other commanders in the Marine Corps, if they don't understand, you're in this uphill climb, and I'll be honest with you, I think this is one of our are challenging areas and I, you know, I, you know, probably personally professionally haven't been effective as I wanna be. Is how do you get the plain language discussion going on the technical aspect of something like like cyber, that really ends up in its own lexicon with a lot of peculiar words that mean different things to different people and and even those that walk in late to it immerse themselves into it and they don't even know it that now they're talking like like natives and, uh, and sometimes can be counterproductive. When really our goal needs to be, is really to educate and empower the rest of the Marine Corps. If every commander is concerned about their network and more importantly, the data that it makes them successful, whatever that may be from maintenance, to operations or to the people that they lead, right, if they gain a concern about it and really, you know, that's half the battle, and you know we can take our 30 days leave every year. But when we can't even communicate as effectively as we need to because of the lexicon and and what we've done uh, it, uh it is, it is problematic. Even words like the cloud is I was I went to all the three star MEF commanders and briefed them on what we're doing with Office 365. I had to rehearse. How am I going to explain this? I know that sounds silly. Uh, but you guys really get it. But, you know I’d start talking about how important this infrastructure is and our ability to move data, and you know what the cloud means and how we get cybersecurity and how we can command control. I mean, I gotta make sure that as I explained this and some of it is trying to correlate it to the physical domain with respect to aviation or maneuver or whatever the case may be, but it all doesn't equate one to one. So, you know, part of that is that, you know, we gotta make sure that we understand it, and I'll be honest with you. You know, we had a great visit by the comment recently, and he talked about this. You gotta explain this to the rest of the Marine Corps. And so that's a great question it’s a task that we're gonna have to figure out. It's gotta start early. It's gotta start and so the other side of it is now. The rest of the Marine Corps has got to start learning the ways of cyber. There's no doubt about it. There's no going back if we're gonna have weapon systems and capabilities that rely on networks, rely on IT, rely on microprocessors, guess what? You got to know how that stuff works. You got to. So we got to start that side of it too. So it's kind of a mutual undertaking of our ability to communicate effectively, in an understanding manner. And then everybody else raising their game to really understand how important this stuff called data is, and you know, understanding some of the lexicon that's natural to the domain. So two way street, Great. I don't think I have solved that I try to, and we've had great visits, as you guys know, we've had a lot of Marine Corps senior leadership on deck to try to begin this journey. But it is very technical and back to the nerd thing. I mean, you know, that's an incredible honor, right? Because you know something that so few people know and you put your heart and soul into knowing it. And, you know, not many people do, so we're gonna have to get after that. And it's probably a good task, Uh, that you remind me of that I got to do better at.

Rich: Hey, General, it's Rich. So I just want to jump in here because I think your statement about it's a two way street and then us getting better in general. Uh, I think just there's a couple key points I want to draw out, you know, from those statements. And the first one is, that whole two way street thing that you mentioned. I feel like there's a really good analogy to make here with any type of language learning, whether it's the language of cyber or programming or networking. You just gotta immerse yourself right, like if I want to learn a foreign language the best way to do it. You know, pre COVID days. I'll put that out there, was to get on a plane, fly to that location and immerse yourself and you probably would have been smarter to at least do a couple of preparatory things, whether it's take a class before you go. But ultimately you have to put yourself in the environment and kind of immerse yourself. So I feel like that comment that you made about it being a two way street. I also want to, like, tell our audience that the best way to break down barriers is to just jump in with both feet at the deep end of the pool and see if you can swim. Because, immersion is the best way that you're really gonna come up to speed. And I think then the second part is, you know, I've heard a couple of folks on I believe it was one of the gentlemen, um, that I came across when I was transitioning back in 2012 to the private sector when I was going through some educational talks with folks that were my mentors at Starbucks. When I was potentially thinking about getting a job there, they talked about the best way to become an expert was just to read three books, right? They were like you know what you could become an expert or talk, be dangerously close to having the right vocabulary to talk with experts by just reading three books on that topic. So just the ability to to dive deep and immerse yourself as we've been talking about. You know, when Kyle mentioned, you know, becoming a nerd, right? And you mentioned it's just having the passion. I mean, I can't, but I mean, both of you are 100% correct there. And I think just reading books and emerging yourself like that's the way to go If you wanna become fluent in the space, um, if you know, not to sound too preachy. But breaking barriers into different market segments in the private sector works the same way. I mean, you don't, you don't learn to become a systems engineer overnight. You have to go immerse yourself. Um, so and then the other thing I wanted to mention, too, is I really think because this podcast is about technology and innovation in the DoD. Is this whole concept of systems integration I think is also what bridges the gap to Johns point about how do we get folks talking with each other. Well, we have sensors, and we have shooters, and somewhere between there are paths to your point way. We've got to get the data from one side of the path to the other end of the path. So I think just by the nature of doing that systems integration, um, we have to get better. We just don't have an option, right? If you want to defend the nation, then we're going to get better. That's a massive over simplification. But I think, you know, immersing yourself, making sure that, you know, you're diving deep to become an expert, reading three books and then integrating our systems from sensor to shooter. I think those are three key points that like that on the draw out. Um, and so having said that, I think I'll transition kind of into a question I have for you, sir. Which was, 2020 to say the least has been challenging. So what advice would you give young leaders to overcome wicked challenges in 2021. Moving forward.

Maj. Gen. Glavy: Wow. Thanks. Rich. Uh, that’s again a good, tough question. You know, whether it's 2020 or 2021 or 2019 or whatever the year it's going to be. There's this certain foundational, you know, requirements that we need to be good leaders, and you guys know it. You live it and you're very good at it. But, you know, it's all about these incredible people that we lead and you know, the challenge is going to be and it really goes back to your first point. You know, how do we make the people that we lead successful? I hate to say it, and I know that almost sounds backwards. I thought the mission was most important and yeah, and it is. There's no doubt about it that we gotta execute our mission. That's why we're here. That's why we raise our right hand and take that oath. But at the end of the day, I'll tell you, if you can make your people successful, uh, there's a lot of things that are gonna take care of themselves, COVID or no COVID virtual or in presence, Um, and how we do that. That's where I think some of what you've talked about in the early part of your statement there and, uh, you gotta somehow some way gain the passionate enthusiasm for people to want to immerse themselves in their work. It's gotta be. It's gotta somehow some way, you know, drive them to some level that they gain satisfaction out of it. There's no other way around it. I mean, we gotta we gotta figure that out And, uh, that’s critical this idea of flow I'm fascinated by it. I don't know you guys probably live in this idea this, you know, this equilibrium were the task and the mind and your skills kind of match up to take you right, real close to the edge of peak performance and you're able to move and accomplish things that you may or may not thought you could, But but I'm enamored, but by that by that concept and really I get it from, you know, being around people like you, there's no doubt what you all have done on our network has tasked you to the limit. There's no doubt, right? I'm around you every day and I see it and I hear it, and I understand it for the most part. But to the degree that you're on the edge of your abilities, to be successful, right and successful is it works right, the damn thing works. But then my role in this case in this, what resources, what requirements, what empowerment? What's my role right now to make sure that you continue to operate at the edge of your capacity to gain an outcome that we need in order for our mission to be successful and you to have satisfaction doing it? I mean, it's, you know, every leader needs to wake up every morning thinking about those things because, you know, if every day was a holiday and every meal was a feast, right, we would get nowhere. So this, you know, I've always had to define fun. I've always had to define fun, right? You know, fun certainly is getting to hang out with you guys in lighter moments. But to me, fun is that construct where you are operating at your max, almost at your max capacity, against a hard problem set, and you have what you need to be successful, and there's this flow to over use the word. But to me, that's fun and trying to attain that, I think is every leaders, you know, really should be our responsibility. What I said, Is hard to do and you guys know it. Some days were good and some days we're on and some days it's really challenging. And maybe one of those things is out of whack, right? Maybe I, the task is too hard. Maybe the resources aren't there, uh, or or, you know, we haven't gotten skills in the trade craft required, which goes back to the idea of immersion and reading and all that stuff that makes ourselves better. So I guess to answer your question Rich. I think it’s, especially in this environment and probably in any environment, is I gotta look back, every leader, right? How do we make our people successful? What are those things? And there's a lot of them and certainly you know, how we treat them and so many other things that go into leadership that I won't necessarily go into. But in this environment, right, how do we make them successful, and to me that's going to take care of a lot of challenges, uh, of leadership and leading great organizations.

Rich: Well, thanks, sir. I mean, one of things I kind of picked up on in your statement there is, you know, making people successful in knowing what those qualities are as an executive leader are absolutely things that, you know, we look to folks like yourself and other leaders around the Marine Corps to provide us. But I'll tell you from a feedback perspective. One of the things that I've learned from other executive leaders on the private side is not doing what I call overclocking folks, right? Like, having people work at about 85% to 90% of their capacity is kind of a sweet spot, right to your point, it's not a feast. And we don't have this over abundance of like, resources. So if you're working at about 85% to 95% capacity, everybody on your team and they're really putting forth all the effort there, at least not, you know, constantly working at 125% because when you hit that point, that's you know when you get to the point where you're burning people out, So I think to your point sir. I think what's kind of been great in working in this environment is in order to establish flow, you kind of have to hit that sweet spot where you don't burn out and and more importantly, all of us on this call as leaders, right, making sure that our folks don't burn out underneath us, giving them what they need to do that. So I just wanted to kind of tease that out sir, because I think it's just some feedback for you. We've been given the opportunity to actually run it 85% to 90% without getting overclocked. Now, granted there are times when that happens and we are defending the nation. So that will occur and we surge, but surging and maintaining a search for a long period of time. You got at some point to rest and refit. Um, so to that point sir, I did have one question. I know I’m kind of throwing things at you fast and furious here, but you know? While our cast is undoubtedly about security technologies, right as they relate to military initiatives or innovation and innovating are paramount, you know, as an executive leader. What's your method to foster that innovation in organizations. So I know we talked about making people successful, but I know where you're a huge fan of Boyd. But you know, adapting and orienting yourself to your environment. Can you talk a little bit about innovation and how you try to foster that as an executive?

Maj. Gen. Glavy: That's, uh, that's great. Thanks, Rich. And I am a big fan of Colonel John Boyd, U.S. Air Force fighter pilot. Very famous for the Boyd OODA Loop Observe Orient Decide Act. But most importantly, from Boyd's perspective, is understanding the environment and specifically, change in the environment. What's changed? And then what does that change mean for me or my mission or my unit or whatever the case may be? And then how do I use the change to my advantage? So, I would tell you the current day Boyd OODA Loop probably would go something like this. And I'm using this from an author that I cannot remember who. So, uh, make sure that gets footnoted, but it goes something like this. It goes, insight, imagination, innovation. Right? You know, if you were to take the loop and you place it on something that maybe, you know, today's generation would understand better, it would be this idea of insight, you know, trying to understand, you know what is going on around us? Detecting change, seeking to understand change, imagination. Uh, you know what is possible? What is, you know what is possible? What if we unconstrained ourselves what now becomes possible and then ultimately, innovation and wow, then the results start happening. And, uh, I think you know those, that type of concept again, used by you, I've heard from somebody else and, uh, actually read it somewhere else, is I think, something that would apply to a Boyd of today and this technology in this in this generation of of leaders, uh, that I think would be appropriate.

Kyle: And, sir, in the vein of constant reevaluation of circumstance, you're coming, sadly to the end of your command tour here. And I wanted to know. Has your mindset mainly stayed the same throughout, uh, command? Or has there been a cyber event or circumstance that kind of took you back and made you say, hey, I want to kind of rethink the way that I'm approaching this thing and is there may be anything that you could share with with executives that are coming into a similar circumstance and and maybe something help you evolve your mindset.

Maj. Gen. Glavy: Yeah. And you guys have heard me say this before, but every 90 days, about, the numbers probably not important. I need to reevaluate all my assumptions. Whatever I thought and, you know, thought I knew or I thought, oh this is the way, right? I've had to stop, right, reevaluate. Is this still accurate? Is, you know, the way we're going and where we're moving to and perhaps to the frustration of many, I think it's so important, you know, it's, we live in this constant state of change. The technology. Holy cow. You guys know it better than anybody. It's always changing. I mean, literally, it's changing in the course of my time and in command. Uh, you know, we've probably been through a couple of iterations of what we think right looks like. So I think the idea of change and the idea of reevaluating your assumptions are so, so important, you know. And sometimes that runs against the grain of leadership, right? You’re, you know, people talk about consistency and, you know, having this vision and being deliberate. And sometimes in this environment, yeah, I have this vision. But guess what? It's not quite right. And then it goes back to some of our opening comments having the humility to say, I know, I know. We said, I said, We're going to do this but I don't think that's a good idea anymore. And, you know, technology has a vote. Hey, let's face it, You guys know this, the adversary has a vote, has a big vote and certainly drives us in certain directions, and you guys know it well. And then, you know, you know, even decision makers in the political environment, you know, it's a civilian run military and understanding all that. Those things change. They change and they, you know, and we're about ready to go through more change and, you know, good, bad. But it's change. And that's what I'm getting at is understanding the change and then being able to re-evaluate your assumptions and go back and say, You know what, man? I wasn't quite right. And then being able to do that in front of your command and do it in front of you all. I mean, it takes a little bit of humility. I mean, it's one thing to get their hands on my hips and say, okay, right, this is what we're doing. Hell or high water, But that ain't gonna work. You guys know what? I know it in this environment, it doesn't work at all in this environment. And I've heard you guys, uh, speak so eloquently about some of the challenges of our DoD acquisition system. Right? Has a hard time with that, really does. And I don't have answers for it all, but I do know this environment and the assumptions that we make going into decisions that we do, whether it's for missions or for acquisition or whether. they tend to change fairly rapidly. It's an incredible dilemma. But step one, you gotta be able to walk up and say, “hey, you know, I don't think I had this one quite right.” And then go from there and figure out what that strategy is going to be. How do you make a column half left or column half right or whatever it may be? Because, yeah, we're going in the general direction of North, but we're gonna have to go a little bit this way. And we really didn't foresee that when we started.

John: And, sir, is that? Just to follow up on that? Is that something you feel is important to call out and communicate? So if ,you know, if you do you're crazy Ivan, and turn around. And it turns out, uh oh, this was, you know, somebody's behind me or this wasn't what I was supposed to be doing. And you got to kind of check yourself and say hey, yea. was the right call the time, not the right call now. Do you think it's important to kind of make that big, make that public and make it clear? Or is this one of those things, of like, you know, kind of like, let the tide go towards the water as it may?

Maj. Gen. Glavy: No, it's something that you got to communicate often with. And, you know, I treasure, uh, you know as you guys know we tend to meet a lot. I enjoy the scrums. Enjoy what I learn during them and their constant feeding me on, you know. Am I right? Am I wrong? You know? Are we right? Are we wrong? And I think that constant engagement and, uh, you know, based on a passion for what we do, I think everybody kind of comes to these conclusions together in many respects. And so for me, right? Yeah, I got it. I'm accountable. Responsible, no doubt, Right. Decisions that we're gonna make you know will be on me. But I think it's important, and you know that. And you all know this, but you know, it gets back to some of this empowering stuff, but you know, you and and the incredible Marines and civilians, right, they also have an onus and a responsibility to make sure I don't get it wrong. Right? And you guys were very good at that, by the way. Right. You know, you gotta be able to correct your boss. You got to, You got to. And the boss gotta have enough humility to understand that. And you know why it goes back to hey, you know, whatever guidance I gave, it's half right, and it's half wrong and we're gonna have to move out in another direction and primarily probably learn that from from someone who's who's got incredible insight and, and is able to articulate that at the right place in time so leadership can can use that and learn from that to make modifications and course corrections is required. But it requires a culture. It requires a two way street. It requires a lot of things to be able to do that and really, some really smart people that I've been blessed with, but all that you know, you gotta have. You gotta have the humility to do it. You gotta have a learning environment in order to learn. And then you gotta have people empowered to make those comments and corrections that are gonna make us better.

Kyle: So, sir, I wanna double click on something that you mentioned there you talked about. You know, the culture of change and being able to have a culture where you can question things and, you know, update doctrine, if you will, or all the other ways to remain agile and nimble in this rapidly changing environment we all live in. And earlier you mentioned how we needed to really educate the entire Corps on what cyber means to them and how it influences the battlefield. And I think that, you know, the Corps has had this very long tradition of the commandant's reading list and things that sort of a line, all of our warfighters in leadership positions around, you know, a common body of knowledge. And I was very pleased earlier this week when I was talking to John about this very cast and when he told me that there had already been books added to the commonest reading list that covered the cyber domain. Um and that, like, made my heart super happy. But I wanted to throw this question over to you and say, Do you feel that there should be more, number one, books that cover cyber on the commandant's reading list? And do you have any recommendations yourself for books that you'd like to see added there?

John: Kyle just gave you the opportunity, sir. To, you just mentioned correcting your boss. So, an excellent chance to correct the commandant.

Maj. Gen. Glavy: Yeah, Yeah, sure. Watch me. Just Watch me.

Kyle: no one corrects the commandant, We just give gental suggestions that he can use, you know, it's good.

Maj. Gen. Glavy: So you know what I'll start off with? I'm just gonna tell you that there are good books, there are good books, but we need more. The problem in cyber and you guys know this, especially our cyber, you know, in what we do. The classifications we have, holy cow. Holy cow. We've classified, over classified, reclassified and classified some more and so we've made some of the knowledge attainment very challenging, especially as warfighters. And why cyber is important to us from a war fighting standpoint. I mean, a lot of this, you know, we've kinda and probably rightfully so I'm not here to provide all the forensics on it, but part of the problem is, people can't write books because they can't write books because all stuffs classified. So you'll find, and even when books were written on, we all know this happens, right? Oh, my gosh, there's a you know, terrible. Someone leaked something and you know in classification, then becomes unclassified. And who knows? You know what? What, what has happened, and is there a danger or not? So, first and foremost, I will tell you part of our problem with our reading list is just at large is the fact that that, you know, we've classified the heck out of this stuff, especially from a war fighting standpoint. Uh, and then the books become very confrontational, and they probably don't get em’ quite right, because a lot of it's hearsay. It may be second hand. So you end up with less than ideal information. Uh, but with that said, there's certainly, you know, I've always enjoyed, you know, back to Rich’s point, uh, you know, immersion, immersing yourself into it and then learning from from what you read and I do have a couple of favorites, I'll be honest with you. One of my all time favorites, of course, is the namesake off this podcast. But I love the Phoenix Project. I found that to be, I couldn't put the damn thing down, especially the first half of the book. It's absolutely phenomenal. I mean, it's almost like Defense of Duffer's Drift, right? I mean, it's like the poor guy. I mean, nothing's gonna go right here. And it's a wildly fascinating book, and I've recommended it to many senior leaders in the Marine Corps. If you want to know what my life is like, you know, try reading this thing, and, uh, and I think the Phoenix Project is a great lesson, and it really puts into shape. What does it mean to run a network? What does it mean to gain order in this world of software development And how, uh, how complicated it can be. So I will tell you that's an important one that I've enjoyed. And so you know just what I've read recently. I'll probably start there. There's others here, but The Kill Chain. I know you guys talked about that one in a past podcast. I think that's a good one. I think we, you know, we got to understand that, we've got to understand, uh, you know what? What's out there, and and, uh And then how, especially from a DoD standpoint, how are we gonna defend the nation, Uh, along those same lines, the 100 Year Marathon, I think, is really appropriate. And then I'll tell you, there's a couple of ones that have really helped me, you know, from a leadership standpoint. How do I, you know? Certainly I'm very proud of all my time and aviation. But, it is different, right? Aviation and what we do and how we do it. Trying to make an airplane fly and a gearbox work correctly and all that is, is a lot different than what it takes to make a network go. I'll be honest with you, you know, in the cyber business, people mean everything right, people can, they can change everything. I mean, it's amazing what I have seen and what I've been fortunate to be around with, especially with this great team. And, you know, smart people make empowered models. But given a mission. Holy cow. Yeah, it's really hard, and it is really hard back to that out of Reggie there, you know their competency, we push them, but it's amazing what they can do. But, so a couple of these books are scrum, and I don't know if Richard or one of these guys. John told me this one “Twice Work Half the Time” is a really good book. I really like that a lot. And I never really, I'll be honest with you, I think some of it is a small unit leadership that the Marine Corps already has. Uh, but this idea of incremental success over time leading to greatness, I think, is a concept we all could use. And, of course, “OKRs Measure What Matters Most.” The John Doerr book, I think is another great one. And though it's not necessarily directly cyber or IT related. I think it's, I still find it incredibly rewarding on what we gotta do and how we got to do it. There was another book that I read, uh, and I read it a couple of years ago when I first got here, and it's titled “The Hard Thing About Hard Things.” I don't know if anybody has read that one. It's a great book. Yeah, and so I mean, there's another one. You talk about challenging people and challenging those around you, and, you know, it's about the bottom line and, you know, a survival of business and all that, but nonetheless puts into play in a perspective of what is possible. I mean, the one thing about the cyber domain is many things are possible. And Google has proven that over and over again. And so many other technology companies, right, with talent, no doubt, right, with empowerment, with some imagination and all the other things we talked about, that a lot can get done based on incredible people. I mean, I think even more so than any other, uh, capability and technology out there. What you could do in this domain, I think, is significant. So those are, you know, I've always, you know, there. Richard Clarke book. What's it called? “Cyber War,” I think, is always a good start. I think that's a really good starting point for what we do. And I've always liked the Singer books “Like War” and “Ghost Fleet.” And there was another book, uh, it's a Thomas Friedman book and it goes something like “Thank You For Being Late.” It's a weird title. I know Friedman, you know Friedman is a great storyteller, and he can articulate things in plain language about it, you know, from Beirut to Jerusalem. A great lesson on the Middle East. But this book, “Thank You For Being Late,” Uh, talke, you know, it's a great story, but specifically it talks about the year 2007, when so many things happened That really changed the course of cyber and IT. And the way he put that together, it's, uh it's, I don't know if the whole books worth it, the whole thing. But there are parts of that book really good to explain what happened from a technology standpoint. So, anyway, that's, uh, kind of went around the horn there. But those are some of the things some of the books that, uh, that that I've I think have helped me.

Rich: No, that's great, sir. Thank you so much.

John: So, sir, in a first time for this cast and first time only, probably only time. Do you have any questions you would like to ask us? Uh, on the cast here.

Maj. Gen. Glavy: Wow, That is quite an opportunity. And one I certainly can't pass up. Uh, probably a lot of them. Yeah, there's probably a lot of them. But you know what? I'll tell you what you guys, uh, here's and I think you guys are the card carrying nerds that you are and lived the life of expertise that you have. I'll tell you, you know, this idea of data and our networks being ubiquitous, uh, that they're always going to be around, that we can always, you know, rely on them. I'll be honest with you. I, uh you know, maybe being a bit of an outsider coming in and knowing that everything we do is very, very challenging and knowing that, you know, we owe it to the American people, we owe it to this nation to be most ready when the nation's least ready. I do have concerns about the ubiquitous nature of data and networks. So first, my first question is. Do you think that we will be in a state that data and networks are ubiquitous? In other words, we'll always have it. It's like the air we breathe, and we'll always have the ability to go to and from to get the data and to use the networks that we need to use.

Kyle: All right, so that is an excellent question, sir. I have a very opinionated answer to that that we we've loosely talked about on the show. And we've talked about a great deal offline. The hosts and I, I feel that in any easy war, sure, that stuff's all going to be ubiquitous. When we're fighting a non-worthy opponent, so to speak. Uh, that stuff will always be there. I think that we've built enough for done and see into our systems to where you know we can handle the micro failures. But in any particular conflict that actually matters against a worthy opponent, I think that we should, you know, end up protecting all of the data. All the networks, just as much as we protect our planes and our tanks in our supply lines, and we're inevitably going to fail at times because we will be fighting a worthy adversary the same way that you know, and when we're going to keep it unclassified, the same way that we target those things, too. And I feel very scared for what will happen when those things aren't around. When we don't have email to fall back on. When you know tactical radios become primary forms of communication for entire units for fleets, etcetera. And I don't I don't think we should prepare that they should always be available again. They’re extremely great things to have, and they are extremely beneficial towards our warfighting capability. But we have to be able to adapt, to not have them around, if not for very small periods of time or if not for long periods of time, for very small periods of time. I think that it's critical that we as an entire war fighting organization, are able to go without and still put warheads on foreheads.

John: Yeah, and I'll take the torch from there and say, You know, I don't disagree with anything, Kyle said. But I'll also say I don't think it's a binary transaction of, like, always on, always off, you know, 100% perfect or 0% terrible rated. Like there's probably gonna be an in between. Maybe it is not at the capacity you're expecting. Or maybe it's at a you know, you're sending bits down range for somebody to take a look at, and you're just asking yourself the question of if it's worth the risk of sending it. Well, you know, or something along those lines. But, you know, our Marine Corps training has ... from TBS all the way through has taught us how to do this stuff without technology. I think that the thing I agree with Kyle about the thing I'm disappointed about is we almost never reinforce it. And I'm not talking about, uh, sending us to the to the tree line with compasses more frequently, I'm talking about maybe everyone not having a hissy fit. The exact minute that your email goes down. Uh, you know, there are ways to lead other than that on, you know, from the top down it would, It would be definitely good to have some reinforcement that on a regular basis and not, you know, obviously current, uh, population excluded. But, you know, next time your unit goes out to the field commanding officer who might be listening to this. Maybe don't completely lose it. If your email goes down for a couple of minutes, think about how to lead when that's not ready for you because it will be degraded.

Kyle: Correct, or walk into your communications tent and say, go ahead and unplug everything for me for about a day and just see what happens to your unit. Make that a TLO.

Maj. Gen. Glavy: I love it. It's great stuff, you guys. Great answer, Rich. What do you say?

Rich: So, sir, I'm not gonna repeat what? What everybody has already said. I just think, this year, um, you know, I think it's been 19 going on 20 years that the Marine Corps, published a Marine Corps doctrinal publication, mostly because it's been fighting the heck out of opponents in a trans regional way. But, you know, Commandant Burger jumps on the scene and he drops two Marine Corps Warfighting Publications, right? Um, one in learning and then the other one in competing, which just recently happened right around the holidays. Um, and so from my perspective, both of those publications lend themselves to the answer that, you know, my fellow co-host have already given, which is we have to be able to operate and compete, right, in an environment where we know we don't have superiority in whatever the domain is right, and I know in the military superiority is a buzzword. Whether it's air superiority, which never generally happens, or superiority in cyber these things seem to be ethereal, right, like almost philosophical goals to try to obtain. But I really feel like if we're not going back to the basics of Hey, in this environment to Kyle's point we might not have and to John’s point we might not have the throughput we need over the radio waves, right? Or we might not be able to communicate beyond line of sight. But, we should be able to take advantage of local advantages. Um, and put the bits down range to connect the sensors in the shooters. And that might be over very narrow band. Very, very low bandwidth. Well, data links, right, that we just we have to be good at making sure are survivable in nature. Or if we can't have them on all the time, you know, through things like emissions control, maybe we only have them on for certain parts of the fight. So, um, while that might seem, again, very philosophical in nature, sir, I just think that these pubs that came out this year kind of get to the essence of the original pub MCDP One, which is warfighting, right? How do we do this? And I think learning and adapting to what you kind of really talk through a lot of this podcast and then using it in a way to compete where we're always competing, which is that second pub that the CMC put out there. I just think those things are just super relevant right now. Um, and timing is everything in warfighting. Um, so that's kind of my answer sir. Rather than ranting more, I feel like we have two really good examples, um, in 2019 to take a look at, from a doctrine perspective and then branching outside of doctrine. Just knowing what we know as Marines we’re not really gonna always have the best tools to engage the enemy. But we gotta make do with what we have.

Maj. Gen. Glavy: That's great. Hey, Thanks. You guys always wanted to ask a question here on the Phoenix cast. Now I got my, uh, my wish came true.

Kyle: Well, sir, we still got more time. You got any others that are tooling around?

Maj. Gen. Glavy: Wow. There are quite quite a bit. I'll throw one more out of you, you guys. Does the defense ever gain an advantage in this environment, we seem like we're always on the wrong side of the equation there, you know, I guess the first part of it is why is that? And second, when are we gonna compile good software that prevents adversaries and others from breaking and causing damage.

Kyle: So John and Rich, I want to take this first really quickly. Only because I listened to a podcast about a week ago when I was driving my car in one of my rare outings to the grocery store. And it was talking about this exact topic, sir, And I was like, almost yelling at the dashboard of my car my opinion as this group of panelists were talking.

Maj. Gen. Glavy: You're not gonna yell at me are you?

Kyle: No. No, absolutely not. I'm gonna elevate my voice, and I'm going knife hand into the general public. But I feel super strongly, sir, that the defense is never going to have the upper hand in this engagement. Because to your second question, when are we going to be able to, like, trust our software? When are we gonna be able to have the software suite that you know, provides that sort of defense in depth as a service and gives us all the things that the answer is never. You just can't be ahead of it enough. And no software company I'm gonna generalize, perhaps unfairly. But no software company has enough security people that are diverse enough and smart enough ever on staff to be able to test their equipment and their software fully. Just it's never gonna happen. You're always gonna be able to find someone who is just thinking in a way that you never thought to think of or using a tool kit that didn't exist when you wrote the software or created the hardware that's going to find weird ways to break in. Um, you know, you can put the biggest gates around your house and the strongest windows, but like with a big enough dump truck, you can drive right through most of that stuff, and it's just tough. It's really, really hard to be effective in the defense and you have to. That's not to say you can't invest in it. You have to have strong defenses, you have to invest heavily because you have to lower your surfaces for attack. But you have to be able to hit back. And you have to be able to hit back with force and with shock and awe, if you will, or whatever you wanna call it. And therefore the offense will forever be king, I feel, in cyber.

Maj. Gen. Glavy: Wow. So I guess we got a lot of work to do you guys.

John: I'll take this in another direction. I'm not actually I don't actually disagree with what
Kyle is saying. However, there is an opportunity here, and there are some things that the defense has so yes to all of Kyle's things. And I think, ultimately, yes, the offense, by far pretty much is gonna maintain an advantage and probably a pretty strongly leveraged position of advantage. However, uh, man, the defense has got an awful lot of tools at their disposal. And I would say in the current setting, we have the ability to have more data available to us. Um, it's unprecedented how much data we can, store and filter and manage, and there's some really sweet software that is written to help us kind of parse through all of that information. Uh, we've got a bunch of information at our fingertips, and that is an advantage in and of itself. Maybe not a relative advantage to, you know, the offense where they pretty much just gotta find one way. And it's bad news for you. Uh, but we've got a lot of data at our hands here, and pretty soon we're gonna get really, really good at using that data and figuring out kind of more adaptive and more predictive type of algorithms and opportunities to employ them. And once we start getting single minded, focused and fluent at doing that, yeah, I don't think it's gonna be as bad. And Kyle can maybe make the argument of how realistic what I just said getting put into practice would be.

Kyle: I think you make an excellent point. I just think that having the information is one thing. Being able to actually do anything with that information and respond quickly enough to mitigate an offensive operation is really you know, that's the Nirvana, right? Like if I have to imagine John, you waving your magic wand for U.S. Cyber as a whole, it's to say, Yep, we have, like all the ones and zeros, all the logs for the last two years, we've got all the intelligence operating on, and we've got automated alerting coming in and we'll be able to say, Oh, look, there's bad guy X sitting in server Y, let's just watch them and figure out what they're doing. Uh, you know, that's the dream that we all live in. And I think that there is immense value in striving towards that goal. Ah, an immense protection for our nation and striving towards that goal. But I also think that, no matter what, I think you're always just behind the curve. I think there's just too much to not know where you are just simply, you know, any zero day is always going to catch you always.

Rich: Yeah, well, there's one thing I'll add in here guys to just add a different perspective here too, um, which is a little nuance. But to answer the question directly, General, I think the one place the defense has the advantage is we know unequivocally better than the enemy. What our critical data is. We know what our intellectual property is, right, so where we might not be able to constantly protect it everywhere it's located at all times, especially when you get into cloud type environments where you have multi master databases where you can replicate data all over the globe and different data centers. Finding where that data is or tracking it on your own internally becomes hard. But I do think the defense has the advantage in the sense that it knows where it's critical data or knows what it's critical data is, I would say sometimes knows where it's at. But, and the reason why I bring this up is to talk about the value of penetration testing in red teaming. You know, I've heard a lot of people in the private sector say, If I had to shrink my budget, um, down to, this is the one thing my customer wants and so I'm gonna build that service or product for them. The rest of the money I have I'm going to invest it in penetration testers so that I can internally look at where my data is as a defender and know unequivocally that's my critical data and then put offensive resources against it that I own in order to shrink the risk associated with that data and reduce the surface area. And so, to Kyle's point and to John's point, John's like, Hey, defenders sometimes have the advantage and I will say, Yep, we know where our data is at. And then to Kyle's point, you can't protect it everywhere. So you have to try to reduce the surface area as much as you can. And the way you do that. In my opinion, just Riche’s opinion here is you invest in penetration testers and so we internally in the DoD look at that as red teaming, right? We do it phenomenally in planning, in planning phenomenally. Now we've got to actually do it where it matters in real time and have people roll their sleeves up and internally look where we're vulnerable as it relates to where data sets are. So I thought I'd just add that in there as a side note, because I think the defense does have the advantage of knowing what it's critical data is. Sometimes knowing where and tracking that is what becomes hard and then putting that kill chain together. Off how I go from, You know, the outside in to make a very general statement there. Becomes a nontrivial task like that. That is not easy. So I don't want to oversimplify the problem. But the defenders sometimes have the advantage of knowing where their data, what their data is. I keep messing that up.

Maj. Gen. Glavy: That's good.

Kyle: All right, so the last thing we have for today is, uh, and this is the first time we're doing this on the cast as well, because it's the first time we've ended a year. We wanted to kind of take a retrospective moment and do a, end of the year, blameless postmortem. So kind of what happened this year. And you know what we hope that we can do better in 2021. So sir? Either you could take the helm here or we could go through ours, and then you can follow us.

Maj. Gen. Glavy: So I'll turn it on its head and say that even in the midst of COVID, I think it afforded us the opportunity to provide, to take, a more introspective look at what we're doing and how we're doing it. I'll be honest with you, I don't think without COVID we're doing scrum like we were doing. Without COVID we're doing OKR’s like we were doing them. Uh, you think about everything that we did on the Office 365 front, uh, and what it took to do it right? I mean, you talk about focus, but it really forced us to have the focus required and to be able to do it in ways in the midst of the restrictions. Uh, pretty amazing. So I'm gonna go back, you know, to things that you guys know are so important to me. But this, uh, straight down there, Kyle, if you were to walk in to Lasswell Hall, this would be the first thing that you would see when you walk in to Lasswell Hall and it's straight on the wall there as you come in. It says people, ideas, and things ... in that order. Uh, that's my retrospective for the year, and it just re-galvanizes. And that is another Boydism, it's the Boyd Trinity. And, uh But I will tell you, you know, I I knew it. It's the right idea and the right method, but it's proven itself, especially in this challenging year. So that's my input, John.

John: All right. Thank you, sir. That's excellent. I'm actually gonna kind of build off of what you just said at the biggest thing. I took away from what you said there was focus on. And I think that's where I would, you know, personally try to do a little bit better. So I think it applies to a lot of the stuff that's been happening recently. I want to focus on results I want to focus on instead of doing a bunch of really good things that we know need to be done, focus on the things that have to be done and specifically gathering information only that will lead to a decision or a change in action on and being a little bit more forceful with, you know, either leadership or other organizations that are asking for information that doesn't drive decisions. Focus. Because what we saw this year, you know, you could have awesome security products and if you get a weak password, then it's gonna have national level implications. So so focus and making sure we're solving the right problems and disciplined about doing those things and and focusing on making sure the basics, like simple passwords are taken care of before we go into something crazy. Like trying to implement AI and ML while we still have bad passwords.

Maj. Gen. Glavy: Love it.

Kyle: Rich. You want to go?

Rich: Yeah. I'll pick up from there. So, I think, one of things, uh, to build off General Glavy’s comment about people, uh, is the first thing in priority order is, so, from two perspectives from on the cast and not on the cast. So from on the cast, I wanna be less preachy in 2021 right?
I wanna We started this cast as a way to kind of educate

Maj. Gen. Glavy: No. Say it ain’t so. We want Preacher Rich. What would it be without him? John, talk him out of that. That is that's insanity.

John: Yes, sir. If he stopped doing that, then I probably wouldn't be able To chide him as much and I would really lose a lot of satisfaction there.

Maj. Gen. Glavy: Okay, I want Rich to remain preachy and not just himself preachy, but the preaching of others. Like, you know, we need rich at least once per episode to say I'm not going to quote somebody and then quote somebody that's like, that's happened.

Rich: Kyle, that's where. I'm gonna grab that one, and I'm gonna run with that. So the reason I even brought that up, man. I was on laughing really hard. Um, on those comments. But no, I really appreciate it. Gentlemen, like it means a lot for me to be on this show and to spend time with you all. But I think, um, you know, being less, uh, I guess I'll use a phrase like mansplaining or preaching in nature. The reason why I bring that up is one people don't like it right. They'd like you to come across as somebody who can be on their level. And then, I guess, to say humility can be a force multiplier of times. Right when you're winning, look around you. Who's there? More than likely they're contributing at rates you might not have noticed. Why? Because you're running at 95% utilization, so recognizing them and meaningful ways, you know, fosters talent retention in an epic way. And so I think in 2021 if we keep talking about the challenges that you know the military and our nation face and in our society face, I think that's winning and giving credit where credit's due. I think that's also winning.

Kyle: All right, So I'm gonna follow you on that and say that I'm gonna do in cast and out of cast what I want to get better at. So in cast, I got two things that I want us to get better at. One, we really started this cast and gently got into inviting guests. And I think that we have since learned that there is immense value and power in bringing on amazing people. You know, the more generals that we could get to come on the show. I think generally the better. And other people who have diverse opinions and different viewpoin

• Date Taken: 01.26.2021
• Date Posted: 01.26.2021 16:25
• Story ID: 387624
• Location: FORT GEORGE G. MEADE, MD, US