Security Confidential S17 E3 Chuck Brooks

Manoj Tandon:
Hello everyone, this is your host, Manoj Tandon, and welcome to another episode of Dark Rhiino Security’s Security Confidential. We’re bringing you another world-class guest today! Before I announce him, please show us a little love — hit that Like and Subscribe button. It really does matter and helps us keep bringing you great content.

So, without further ado, I’d like to introduce Mr. Chuck Brooks. Chuck is incredibly well-versed in cybersecurity. I encourage everyone to look up his background, but I’ll give you a quick overview. He’s ranked among the Top 50 Global Influencers in Risk and Compliance by Thomson Reuters, has advised two U.S. Presidents, and has served across government, industry, and academia. He’s an Adjunct Professor at Georgetown University, and simply put — he knows a lot about cyber. He’s going to share some of that knowledge with us today.

Chuck, welcome to the show. Thank you for being here.

Chuck Brooks:
Thank you for having me. I’m looking forward to our discussion.

Manoj Tandon:
Everyone loves a good origin story. How did your journey in cybersecurity begin? Was this something you always wanted to do?

Chuck Brooks:
Actually, no. My background started in politics — I was working for Senator Arlen Specter on technology and security issues on Capitol Hill for nearly a decade. After 9/11, Governor Tom Ridge asked me to join the newly formed Department of Homeland Security (DHS). Back then, cybersecurity was only a small component — the focus was more on chemical, biological, radiological, and explosives threats. But I worked in the Science and Technology Directorate, and part of my portfolio was early cyber. That’s where I became deeply interested. It was around 2005, and we were just starting to realize how interconnected our digital world was becoming. Later, I moved into industry — first as Vice President at SRA International (which was later acquired by General Dynamics), and then as VP of Homeland Security for Xerox. I eventually worked for General Dynamics Mission Systems as a technology scout for cybersecurity. So, I’ve seen this industry evolve for more than 20 years. It’s been an incredible transformation.

Manoj Tandon:
Given that history, how have you seen software and hardware manufacturers change their approach to system design with cybersecurity in mind?

Chuck Brooks:
There’s definitely been progress — though not uniform across the board. In the early days, products were built just to function and communicate; security wasn’t part of the process. Now, we’re starting to see security-by-design initiatives, especially after pressure from agencies like CISA. However, much of it is still reactive. The technology ecosystem is growing so fast — anyone can now code with the help of AI — that keeping security ahead of innovation is a huge challenge.You can get the big players to comply, but there are countless smaller developers who don’t.

Manoj Tandon:
Even with “security-by-design,” so much software and hardware today uses open-source components. That’s great for innovation, but isn’t it also risky?

Chuck Brooks:
Absolutely. Open source has pros and cons. On the positive side, it’s transparent — so bugs are often discovered and fixed quickly. But it’s also accessible to everyone — including adversaries.That’s why we now have the Software Bill of Materials (SBOM) concept — essentially a list of ingredients that make up your software or hardware. Government agencies are already required to track SBOMs, and I think that’s a great start. It helps organizations understand what’s in their systems, who has access, and where vulnerabilities might lie. This ties directly into Zero Trust principles. We realized our networks were deeply infiltrated, so we needed to know — who’s in our system, what devices are connected, and why certain users still have access. It’s a step forward, but there’s still much more to do.

Manoj Tandon:
Let me ask you this — is there safety in running antiquated systems? For instance, some legacy systems in defense still use decades-old software like VAX/VMS. Are those safer or more dangerous?

Chuck Brooks:
That’s a great question. There’s some truth to the idea that older systems are “off the radar,” but overall, it’s risky.

For example, running Windows XP today is a terrible idea. It’s unsupported, unpatched, and full of known vulnerabilities.

Older systems may not be actively targeted, but they also lack performance, scalability, and modern security hardening.

You mentioned legacy military systems — yes, some older hardware may survive an EMP (electromagnetic pulse) because it uses tube-based electronics, but that’s not practical for modern infrastructure.

So, while “security through obscurity” might help a bit, it’s not a sustainable defense.

Manoj Tandon:
Good advice for anyone still running ancient tech — time to upgrade! Switching gears, after the SolarWinds incident, there was talk about holding software vendors criminally accountable for breaches. What do you think of that idea?

Chuck Brooks:
Honestly, I don’t think criminalizing CISOs or developers is the answer. Most CISOs are overwhelmed — managing limited budgets, constant turnover, and evolving threats. Mistakes or breaches don’t always mean negligence. The SolarWinds hack was a sophisticated, nation-state attack. That’s not something a single executive could have prevented. Now, regulatory measures like the SEC’s 48-hour disclosure rule are useful — they promote transparency and accountability. But criminal prosecution? That’s misplaced unless there’s clear evidence of intentional wrongdoing.

Manoj Tandon:
Agreed. Most of these attacks are incredibly well-engineered.

Chuck Brooks:
Exactly. Most are financially motivated, too — ransomware-as-a-service operations. Cybercrime has evolved into a digital business model. It’s easier, safer, and more profitable than traditional crime. No guns, no getaway cars — just a laptop and cryptocurrency. We’ve even seen deepfake scams used in board meetings. One in Singapore led to a $40 million loss. The attackers used a fake Zoom call to trick the CFO into transferring money. That’s the world we’re in now.

Manoj Tandon:
That’s terrifying. Authentication is everything now. When Homeland Security looks at cyber risk, how are they framing it?

Chuck Brooks:
DHS initially focused on protecting critical infrastructure — energy, transportation, finance, and healthcare — primarily against state-sponsored attacks. CISA’s job has been to encourage information sharing, public-private partnerships, and basic cyber hygiene. But remember, 80% of U.S. critical infrastructure is privately owned. That makes enforcement difficult. For smaller organizations, CISA emphasizes awareness and education — helping people understand threats and adopt practical safeguards.

Manoj Tandon:
Speaking of infrastructure — our power grid is a patchwork of old systems. How does CISA even begin to protect it?

Chuck Brooks:
You’re right — the grid is one of our biggest vulnerabilities. Much of it was built 30–40 years ago. Ownership is fragmented among federal, state, and private entities. Some follow strict security standards; others don’t. There are efforts to build microgrids and modernize operational technology, but it’s slow going. And it’s not just cyber — the grid is also at risk from solar flares, physical sabotage, and even EMP attacks. A major solar storm like the Carrington Event of 1859 could cripple modern life — communications, power, water, everything.

Manoj Tandon:
That’s frightening. Ted Koppel’s book Lights Out described that exact scenario — mass chaos and disease outbreaks from prolonged power loss.

Chuck Brooks:
Yes, former CIA Director James Woolsey studied that too. Millions could die from secondary effects — famine, disease, civil unrest. An EMP Commission was even formed years ago, but its recommendations largely stalled. Maybe it’s time to revisit that.

Manoj Tandon:
You’ve advised presidents. Do they understand the scale of these threats?

Chuck Brooks:
They do — but priorities vary. The current focus is shifting toward state and local government cybersecurity, which has been neglected for too long. AI governance is also top of mind. CISA itself is still relatively young — only about five years old — so it’s evolving fast. The bigger challenge is cultural: many corporations still see cybersecurity as a cost center, not a business enabler. That needs to change.

Manoj Tandon:
That’s a huge point. Many think compliance equals security. What’s your take?

Chuck Brooks:
Compliance is not security. Checking boxes doesn’t make you safe — it just keeps regulators happy. True cybersecurity is continuous.A system that’s compliant today might be compromised tomorrow. Compliance should be a by-product of a strong security program — not the goal itself. Businesses need ongoing risk management, monitoring, and incident response. Because if you get breached and don’t have those, you’re likely out of business.

Manoj Tandon:
So, how do companies start improving their risk posture in practical steps?

Chuck Brooks:
Start with the basics — cyber hygiene.

• Use multi-factor authentication (preferably adaptive or biometric).
• Secure endpoints and routers.
• Enforce strong password policies.
• Segment data to reduce ransomware impact.
• Maintain backups — and test them.

No one is too small to be targeted. Automation and AI have made attacks scalable — everyone is fair game. Once the basics are in place, assess your vulnerabilities, encrypt sensitive data, and consider continuous monitoring if your budget allows.

Manoj Tandon:
Right — remember, it was an HVAC contractor that breached Target.

Chuck Brooks:
Exactly. Supply chain vulnerabilities are everywhere, especially with the Internet of Things. Even your smart TV or refrigerator can be an entry point — and most people never read those user agreements that essentially give away tons of personal data.

Manoj Tandon:
That’s terrifying — and no one reads the fine print! Are business leaders finally waking up to this?

Chuck Brooks:
They’re getting better, but still not where they should be.

For years, cybersecurity budgets lost out to marketing or operations. Now, as major breaches hit healthcare and finance, executives are starting to realize the true cost of ignoring security.

Look at Change Healthcare — paid over $20 million in ransom twice, plus lawsuits and reputational damage.

If they’d spent even a fraction of that proactively, the outcome could’ve been very different.

Manoj Tandon:
Exactly. Prevention is always cheaper than ransom.

Chuck Brooks:
And hospitals are especially vulnerable — they’re complex, interconnected environments. You’ve got medical devices, patient data, and operational systems all talking to each other. It’s a hacker’s dream. Healthcare and finance remain the top two targets globally.

Manoj Tandon:
Do you think Congress should step in — maybe regulate how companies handle data or limit liability waivers in end-user agreements?

Chuck Brooks:
In theory, yes. In practice, it’s complicated.

Congress moves slowly, and many lawmakers don’t understand technology well enough to legislate effectively. We actually used to have an Office of Technology Assessment, but it was disbanded decades ago. We need something like that again — especially as we enter the AI, quantum, and space era.

Manoj Tandon:
We’re already seeing it with electric and autonomous vehicles — life-threatening risks if hacked.

Chuck Brooks:
Exactly. And aviation isn’t immune either. Modern aircraft send real-time telemetry to service centers, which means they’re connected — and anything connected can be breached. Researchers have already demonstrated satellite and aircraft hacks at conferences like Black Hat. We have to rethink secure-by-design at every level — from sensors to space systems.

Manoj Tandon:
And the attackers aren’t amateurs — they’re intelligent, organized, and well-funded.

Chuck Brooks:
Correct. Many cybercriminal groups operate like professional organizations — recruiting top talent and paying them well. Some have state sponsorship. They’re not muggers with laptops; they’re strategists.

Manoj Tandon:
Let’s talk about AI. How do we defend against it — or use it to our advantage?

Chuck Brooks:
Both, really. AI has completely transformed cybersecurity — for good and bad. On the dark side, it enables hackers to craft hyper-targeted phishing, automated attacks, and polymorphic malware that evolves faster than defenses can adapt. But on the defense side, AI helps automate threat detection, anomaly identification, and incident response — even reducing analysis time from days to minutes. So yes, it’s becoming robot vs. robot.

Manoj Tandon:
That’s straight out of The Jetsons! We’re heading toward that future.

Chuck Brooks:
(Laughs) We are! Look at the military — drones, robotics, autonomous defense systems. It’s already happening. Humanoid robots are emerging, too. The only things missing are flying cars — and they’re probably not far off.

Manoj Tandon:
Your new book Inside Cyber covers all this, right?

Chuck Brooks:
Yes — Inside Cyber: How AI, Quantum, 5G, and IoT Are Impacting Privacy and Security. I explore how these technologies converge and reshape both opportunities and risks. Quantum is especially crucial. People think it’s decades away, but components like quantum sensors and photonics are here now. When quantum computing fully matures, it could break today’s encryption in minutes. That’s why we need quantum-safe cryptography and long-term planning — not reaction.

Manoj Tandon:
You’re describing a future where many jobs — even white-collar ones — might disappear.

Chuck Brooks:
Yes, AI and automation are already replacing knowledge work. We need to retrain humans for where they fit in this new ecosystem.

Factories won’t bring back millions of assembly-line jobs — they’ll bring robots. China already uses more automation than we do.

We’ll need to rethink education, economies, and governance models.

Manoj Tandon:
That’s profound — “retraining humans on where we fit.” I’m stealing that line!

Chuck Brooks:
(Laughs) Go ahead! It’s true. We’re entering an age where humans and machines will coexist — and we’ll need to redefine our purpose and roles.

Manoj Tandon:
Chuck, this has been a fascinating discussion. Before we wrap up, tell our audience where they can find your book and your work.

Chuck Brooks:
You can find Inside Cyber on Amazon and Barnes & Noble.

I also write regularly for Forbes and post daily on LinkedIn, where I have about 124,000 followers. I share insights on cybersecurity, AI, and technology trends.

LinkedIn is my favorite platform — it’s still a professional, positive space for sharing knowledge.

Manoj Tandon:
We’ll definitely share your posts with our audience. Chuck, thank you again for a fantastic hour. You’ve given us a lot to think about, and I look forward to having you back soon.

Chuck Brooks:
Thank you, Manoj. It’s been a pleasure. I’d be happy to come back anytime.