Welcome to Supply chain now.
HostThe voice of global supply chain.
HostSupply chain now focuses on the best in the business for our worldwide audience.
HostThe people, the technologies, the best practices, and today's critical issues, the challenges and opportunities.
HostStay tuned to hear from those making global business happen right here on supply chain now.
Scott LewtonHey, good morning, good afternoon, good evening, wherever you may be.
Scott LewtonScott Lewton and Kevin L.
Scott LewtonJackson with you here on supply chain now.
Scott LewtonWelcome to today's show.
Scott LewtonKevin, how you doing today?
Kevin L. JacksonHey, man, I am doing great.
Kevin L. JacksonYou know, this manufacturing stuff is really getting me hype.
Kevin L. JacksonAnd today's.
Kevin L. JacksonAnd today's guest, I mean, wow, just go to the top, right?
Scott LewtonThat's right.
Scott LewtonWe booked him through his agent, pulled him from his rock and roll tour.
Scott LewtonBut you mentioned manufacturing.
Scott LewtonSo, folks, we got a big show here today where we focus on a really interesting intersection of cybersecurity manufacturing, like Kevin said, but also all in the aviation industry.
Scott LewtonRight.
Scott LewtonSo we're going to be diving into a variety of intriguing topics with a cyber pro on the move, including how the tidal wave of innovative digital transformation has changed the game when it comes to cybersecurity, especially in the manufacturer industry.
Scott LewtonSo, folks, stay tuned for a great conversation here today.
Scott LewtonKevin, we're going to promise and deliver here today, right?
Kevin L. JacksonAbsolutely.
Kevin L. JacksonI can't wait.
Scott LewtonWell, so we should add that today's episode is presented in partnership with our friends at Microsoft, who's doing some pretty cool things in industry, helping to move us all forward successfully.
Scott LewtonMore on that a bit later, but with what we said, let's introduce our featured guest here today.
Scott LewtonHe is the pride of Saxy, Texas.
Scott LewtonAnd we'll tell you how to spell that later.
Scott LewtonOur guest today is an experienced information security professional with a proven track record of supporting organizations ranging from tech startups to Fortune 500 companies to the US Department of Defense.
Scott LewtonGet this.
Scott LewtonHe's been featured in top cyber news Magazines 2022 list of 40 under 40.
Scott LewtonHe's also a proud veteran of the United States army, where he served on active duty as a military intelligence analyst.
Scott LewtonPlease join us in welcoming in Thomas Marr, senior cybersystem security engineer at Lockheed Martin.
Scott LewtonThomas, how you doing?
Thomas MarrHey, how's it going, Scott?
Thomas MarrI'm doing great.
Thomas MarrProud to be here.
Thomas MarrHope you're doing well, too.
Scott LewtonWe're doing wonderful and great to have you, Kevin.
Scott LewtonKevin and I.
Scott LewtonKevin.
Scott LewtonWe've been looking forward to this conversation, huh?
Kevin L. JacksonYeah, absolutely.
Kevin L. JacksonI mean, uh, you know, Lockheed Martin leads the world.
Kevin L. JacksonIt's the world's largest defense manufacturer, I believe.
Scott LewtonWell, you know, I'm going to see if y'all know your stuff here in a second, because I've pulled some platforms, some iconic platforms that they're responsible for.
Scott LewtonBut before we get there, I got two warm up questions I want to pose to you, Thomas.
Scott LewtonThe first one, some folks, when they hear saxy, Texas, which is, I think, your hometown, they may be assuming how it's spelled, but it's not spelled like it sounds.
Scott LewtonHow's it spelled?
Thomas MarrIt's spelled s a c h s e.
Thomas MarrA lot of people get the name wrong, though, so.
Thomas MarrAnd I don't blame him.
Scott LewtonWell, I don't blame either.
Scott LewtonI had, when I, when first met Thomas and found out where he's from, I googled it and I'm like, man, that just does not, it doesn't connect.
Scott LewtonBut it's not a really big town either.
Scott LewtonHow about how many folks live there, you think, Thomas?
Thomas MarrI haven't seen the numbers recently, but I know that it's grown a lot since I grew up there.
Thomas MarrIt's grown rapidly, too rapidly, in my opinion.
Thomas MarrBut, you know, is what it is.
Scott LewtonAnd it's part of that growth, huh?
Thomas MarrNo, I like, I like having a small town feel.
Thomas MarrI've been told I'm an old soul in that way.
Thomas MarrBut, you know, it is what it is.
Scott LewtonIt is what it is.
Scott LewtonBut it is also part of Saksi, Texas, part of the Dallas Fort Worth metroplex, which is some really cool things going on across that metro area.
Scott LewtonOne more quick question for you, Thomas and Kevin.
Scott LewtonYou're going to kick out this, too.
Scott LewtonSo Thomas is a fellow veteran, as I mentioned in his intro, having served in the army, I got to ask you, Thomas, because, you know, I'm an air force veteran.
Scott LewtonKevin is a Navy veteran and former naval aviator.
Scott LewtonSo he's, he's the cooler one out of the two of us.
Scott LewtonBut, Thomas, what was one of your favorite experiences in the army as you served in uniformity?
Thomas MarrSure.
Thomas MarrServing uniform, particularly as it relates to our discussion topics today, I had the opportunity to serve an honorable mission as a signals intelligence analyst.
Thomas MarrI never deployed, luckily, but I was able to serve my country from home and take care of my family as well.
Thomas MarrSo I'm proud of my time there.
Thomas MarrI also had to learn anything that emits a signal.
Thomas MarrI was expected to continuously grow my knowledge of.
Thomas MarrAnd for me, that's what started that mindset of continuous growth, which is something that's imperative in this industry, in my opinion.
Thomas MarrSo the continuous learning.
Thomas MarrYeah, absolutely.
Thomas MarrThe continuous growth mindset, I'd say the army was responsible for that.
Thomas MarrSo I have them to thank for that.
Thomas MarrIn terms of the knowledge that I gained from the army, there was a lot of overlapping knowledge that allowed me to transition specifically into a cyber security focused role, whereas I had security related responsibilities beforehand.
Thomas MarrI was able to get into a more focused role when I transitioned from the military.
Thomas MarrNon tech related, I'd say, being night shift during my time at AIT, because most people are like, night shift, that's terrible.
Scott LewtonWhich.
Thomas MarrReasonably so, but that's when all the drill instructors were asleep.
Thomas MarrSo he never got picked on.
Kevin L. JacksonYou shared a lot of.
Scott LewtonWe're going to circle back to that, because we're going to ask you in a minute how a lot of that background contributed to you landing your current position in just a second.
Scott LewtonBut Kevin, he shares some cool things there on a serious note.
Scott LewtonHe talked about the power of the continuous learning mindset, which, especially in technology.
Scott LewtonWell, for that matter, if you're in supply chain technology or leadership, it doesn't matter what field you're in.
Scott LewtonThat's really important.
Scott LewtonAnd then he talked about kind of tongue in cheek, how cool it is to be on night shift, where you might got away with a thing or two.
Scott LewtonKevin, what'd you hear there from our friend Thomas?
Kevin L. JacksonWell, first of all, I'll forgive him for being in the army.
Kevin L. JacksonYou know, it's okay.
Kevin L. JacksonThe only reason I'm doing that, because he's a fellow siginter, right.
Kevin L. JacksonI did a lot of sigging when I was in the navy.
Kevin L. JacksonSo those are low Earth orbit type of collectors, so I can relate there.
Scott LewtonWell, so let me ask y'all, let's.
Scott LewtonLet's play a little platform trivia here, right?
Kevin L. JacksonAll right.
Scott LewtonUm.
Scott LewtonI've got three famous, iconic aircraft that Lockheed Martin is responsible for bringing to the world, right?
Scott LewtonC 130 Hercules, which I think is still the longest, the longest military vehicle of any kind in production, like 50 or 60 years, I believe.
Thomas MarrF 16.
Scott LewtonYeah.
Scott LewtonContinuously product produce.
Scott LewtonThat's right.
Scott LewtonThomas, you know your stuff.
Scott LewtonNow I can tell.
Scott LewtonThe f 16 fighting falcon.
Scott LewtonRight.
Scott LewtonIncredible.
Scott LewtonOne of the world's most dominant fighters, air force platform.
Scott LewtonAnd then, of course, more newer, the f 35 lightning two, which has been deployed across a couple different services.
Scott LewtonKevin, out of those, Europe being you being the pilot of those three, what's your favorite out of those three or others from Lockheed Martin?
Kevin L. JacksonWell, you may be surprised, but I'm going to say c 130, because the c 130 I flew up in the living room of the c 130 up in the cockpit, really, from the Philippines to Australia, and I was celebrating, and we went to Perth, where I celebrated the 4 July in the middle of the winter on the beach.
Kevin L. JacksonSo the trick on the c 130 was just, it was just a great time in my life.
Kevin L. JacksonSo I.
Kevin L. JacksonI'm gonna have to say to c 130 and you.
Kevin L. JacksonI was at.
Kevin L. JacksonI was in VRC 50.
Kevin L. JacksonIt was an 80 c 130.
Scott LewtonOkay, well, so, so our listeners and viewers out there, if you're unfamiliar with the c 130, it is called a Hercules.
Scott LewtonIt is a cargo aircraft with four props, and it is incredibly durable, versatile, and it's got an iconic look to it.
Scott LewtonYou've probably seen it in the past.
Scott LewtonThomas, are those platforms or others?
Scott LewtonBecause you got helicopters and then other platforms that the company is responsible for.
Scott LewtonWhat's one of your favorite?
Thomas MarrThat's.
Thomas MarrThat's a really tough one.
Thomas MarrI don't think it'd be right to give a preference personally, but I think they're all great.
Thomas MarrI think they have their own, all their own advantages, and I don't think you could go wrong with any of them.
Scott LewtonI'm with you.
Thomas MarrIf you use them for their intended purpose, of course.
Scott LewtonA little disclaimer.
Scott LewtonImportant disclaimer.
Scott LewtonOkay, so let's shift gears a bit here.
Scott LewtonI want to go back to kind of your professional journey before we dive deeper into manufacturing cybersecurity in the aviation industry.
Scott LewtonSo you were touched on a minute ago about how your background helped contribute to you landing your current position at Lockheed Martin.
Scott LewtonCan you elaborate a little bit more on that?
Thomas MarrYeah.
Thomas MarrSo one of the things that I learned during my time in service was computer networking.
Thomas MarrI'd say that's one of the fundamental aspects in cybersecurity in general.
Thomas MarrThat and computer architecture.
Thomas MarrSo, yeah, computer architecture, computer networking, and operating systems, I'd say, are the three most fundamental things they need to learn to get a job in tech.
Thomas MarrI was also fortunate to learn some Osint.
Thomas MarrI took an OsinT course whenever I was in the army, and I learned some exploitation techniques.
Thomas MarrI think the very first one I learned was SQL injection.
Thomas MarrSo I had a, I had a really good time in the army and learning what was relevant to my current role.
Scott LewtonOkay, Kevin, I need your help interpreting everything that Thomas just shared there.
Scott LewtonYou know this.
Scott LewtonI'm the operational.
Scott LewtonI'm the supply chain guy here.
Scott LewtonKevin, what'd you hear there from Thomas?
Kevin L. JacksonWell, first of all, from a IT security point of view, looks like he really enjoys getting down in the weeds, right?
Kevin L. JacksonI hear that he really likes that.
Kevin L. JacksonMaybe I'm wrong, but he likes that defensive physician trying to protect the network and the applications from ATT and CK.
Kevin L. JacksonIs that what you really enjoy?
Thomas MarrYeah, I definitely would consider myself more of a blue teamer.
Thomas MarrI'd say your assessment's correct.
Scott LewtonWell, so let's keep going.
Scott LewtonLet's go right down that topic a little more.
Scott LewtonSo tell us about your job.
Scott LewtonWhatever you can share.
Scott LewtonAs a senior cybersystem security engineer at Lockheed Martin's skunk works, Thomas, what do you do?
Thomas MarrSo, like you said, there's limits as to what I can talk about.
Thomas MarrWhen it comes to skunkworks, it's one of the most secretive engineering teams in the world.
Thomas MarrIt means I get to do a lot of cool things, and it also means having a security clearance that I'm a lot more accountable than the average citizen.
Thomas MarrBut, yeah.
Thomas MarrWhat you describe, cybersecurity engineering, getting into the weeds.
Thomas MarrI feel like it safely described that without getting in trouble.
Scott LewtonThat's good.
Scott LewtonCause I don't want to get in trouble with any big corporation, with an army of attorneys or the us government.
Scott LewtonThomas?
Kevin L. JacksonYeah, but me neither.
Scott LewtonYou neither.
Thomas MarrThat's right.
Scott LewtonKevin, you were about to say something.
Kevin L. JacksonYeah.
Kevin L. JacksonSo.
Kevin L. JacksonThomas.
Kevin L. JacksonI mean, like, in mine, there's aviation, and aviation has really changed a lot.
Kevin L. JacksonAnd as a cyber security professional, what's your role?
Thomas MarrSo my role currently at Lockheed Martin is a platform security engineer.
Thomas MarrI'd say my responsibilities are relatively broad, but I feel like if I was to describe my role, that'd probably be the best descriptor.
Scott LewtonYeah, that sounds good.
Scott LewtonAnd we don't want you to describe any more details, Thomas, because, as I mentioned, we got national security factors at play here.
Scott LewtonBut I appreciate what you do.
Scott LewtonThere's an army of folks, and I'm sure you all have a full plate protecting all that infrastructure from the bad actors out there.
Scott LewtonAnd, gosh, there's no shortage of them.
Scott LewtonI want to pose this question to you, Thomas.
Scott LewtonKevin and I were talking about this pre show.
Scott LewtonHow does information technology cybersecurity differ from operational technology cybersecurity?
Scott LewtonYour thoughts here.
Scott LewtonThomas?
Thomas MarrSure.
Thomas MarrSo operational technology.
Thomas MarrI'll start with that.
Thomas MarrSo operational technology utilizes proprietary software to perform their function autonomously.
Thomas MarrI'd say the most common example we see is industrial control systems, or ICS.
Thomas MarrThose ICS deploy SCADA systems using programmable logic controllers to pick up information from sensors and make adjustments accordingly, like temperature or machine productivity, whereas it uses, well, operating systems that are more commonly known, like Windows and iOS.
Thomas MarrAnd it's more focused on network maintenance and applications and systems testing.
Thomas MarrSo that's where the two differ.
Scott LewtonOkay, Kevin, that makes a lot of sense.
Scott LewtonI think a lot of folks, I think a lot more folks could better understand the difference between it and OT, especially from a cyber standpoint, huh?
Kevin L. JacksonYeah, absolutely.
Kevin L. JacksonAs a.
Kevin L. JacksonAs a back home engineer, did you do one more than the other, or is he said, your work is blood, or do you sort of straddle the line?
Thomas MarrSo I would say straddle line.
Thomas MarrIf by straddling the line, you mean a little bit of both, I'd say I can safely say that, yeah.
Scott LewtonOutstanding.
Scott LewtonOutstanding.
Scott LewtonAll right, so I got to pose this question to you, Thomas.
Scott LewtonA year or so ago, a study by dragos.
Scott LewtonI think I'm saying that, right, a manufacturing industry OT cybersecurity company.
Scott LewtonWell, they said that 89%, based on their research of manufacturers, had limited visibility into their operational technology systems right back to the OT, making them easier targets for threat actors and hampering their productivity and efficiency.
Scott LewtonThomas, what's your take here?
Scott LewtonDo you tend to agree with that, with those findings?
Scott LewtonYour thoughts?
Thomas MarrAbsolutely.
Thomas MarrAnd I was actually able to read that study, too, and personally, it doesn't surprise me.
Thomas MarrTo me.
Thomas MarrThat's why sending system and network logs to a centralized monitoring software, like a SiM, to contextualize information when it comes to security, is recommended.
Thomas MarrAnd to do that, you need to make sure you keep an inventory to maximize that visibility and know where those logs are coming from.
Scott LewtonInteresting.
Scott LewtonAnd, Kevin, visibility has been the name of the game in so many different ways in recent years.
Scott LewtonCertainly supply chain visibility, manufacturing visibility, as it applies to cybersecurity and more.
Scott LewtonYour thoughts here, Kevin?
Kevin L. JacksonWell, first, you know, that maybe comes through Robert.
Kevin L. JacksonA little acronym SAM was shot for security information and event management.
Kevin L. JacksonThis is really tools that help you detect, analyze, and respond to security threats.
Kevin L. JacksonThis is a very important, critical tool when it comes to cybersecurity, especially in manufacturing.
Kevin L. JacksonSIEM is really mostly used for it, and there's very few tools that are designed to support OT.
Kevin L. JacksonAnd I think that's one reason why you see that great issue in that.
Scott LewtonReport in terms of limited visibility, which is a big challenge.
Kevin L. JacksonVisibility.
Kevin L. JacksonExactly.
Scott LewtonExcellent.
Scott LewtonExcellent point there.
Scott LewtonAll right, let's talk about another big trend Thomas gets you weigh in on.
Scott LewtonSo, over the past decade or so, the manufacturing industry has undergone rapid digital transformation.
Scott LewtonThat's Kevin's favorite word.
Scott LewtonIt's starting to be my favorite word.
Scott LewtonEmbracing innovations such as digital twins, robotics, automation, machine learning, artificial intelligence, cloud computing, another one of Kevin's favorites.
Scott LewtonHe wrote the book on that, at least one of them.
Scott LewtonAnd the industrial Internet of Things.
Scott LewtonRight.
Scott LewtonIt's an exciting time to be in industry, certainly in manufacturing and certainly in the aviation industry.
Scott LewtonBut all of those advancements changes the cybersecurity game.
Scott LewtonWeigh in on what you see and how the threat continues to evolve.
Thomas MarrSo it may be excited for that industry, but for cybersecurity, it's extremely stressful.
Thomas MarrI'll leave with that.
Thomas MarrSo it can both positively and negatively affect cybersecurity.
Thomas MarrI'll start with the positive.
Thomas MarrIt allows for innovation in the security space.
Thomas MarrAll those buzzwords that you mentioned.
Thomas MarrHowever, the stressor part is where business leaders are a bit too eager to push out a new technology without fully understanding the security implications, which results in a lifetime of utilizing bolt on security instead of addressing an underlying systemic problem beforehand.
Thomas MarrThat's my take.
Scott LewtonYep.
Scott LewtonSo, Kevin, not only does it keep cyber professionals up at night like Tom's kind of having a little fun with the beginning of his response, but, you know, all of those new technologies, it puts a lot of pressure on the workforce, right?
Scott LewtonBecause going back to that continuous learning mindset, they've got to get up to speed on how to apply it, not just for the sake of applying it.
Scott LewtonRight, but to get the results and to be able to deliver and produce efficiently and successfully and being able to know how these technologies operate within each other, let alone their companies.
Scott LewtonAnd let me just add another challenge, since we're talking about friction points out there, trying to do so in a secure environment, and not just cyber, but we're going to talk about in a minute about supply chain security in a broader sense as well.
Scott LewtonSo, Kevin, it's not easy on hardly any of us these days, despite the gains we're making as an industry, huh?
Kevin L. JacksonWell, no, not at all.
Kevin L. JacksonYou think about platforms like DF 35 lightning and advances like artificial intelligence.
Kevin L. JacksonI mean, all of the sensors on that platform are leveraging artificial intelligence in order to make sense of the creates, give situational awareness to the pilot and to the battle force.
Kevin L. JacksonAnd AI itself is threatening, has cyber threats that have to be protected.
Kevin L. JacksonAnd this is even more of a danger when you're operating in denied airspace.
Kevin L. JacksonSo talk about headaches.
Kevin L. JacksonAbsolutely.
Scott LewtonPlenty of them to go around.
Scott LewtonAnd it goes without saying, too, Thomas and Kevin.
Scott LewtonAnd this is obvious, but I think it's worth calling out that in any technology transformation, of course, the good actors and the folks trying to contribute positively to the world are able to leverage all those things.
Scott LewtonBut unfortunately, that bad actors can apply that same innovative technology to doing bad things.
Scott LewtonRight.
Scott LewtonIt's so intriguing, the cyber world, Thomas kind of the back and forth as each side starts to get an advantage.
Scott LewtonJust the evolution of that challenge is just.
Scott LewtonIt's fascinating to me.
Kevin L. JacksonYeah.
Kevin L. JacksonOne thing you'd mention.
Kevin L. JacksonThe Internet of things.
Kevin L. JacksonWell, you know, the industrial Internet of things is really underpins every activity of the DoD.
Kevin L. JacksonWhen you have autonomous vehicles running around, you have drones running around, you have radios that are connected to the Internet, or even small sensors out in the field.
Kevin L. JacksonYou have to manage all of that, and you have to protect it against all of the associated cyber threats.
Kevin L. JacksonSo they're.
Kevin L. JacksonThe challenge just multiplies.
Scott LewtonYeah.
Scott LewtonEvery hour, I bet.
Scott LewtonSometimes.
Scott LewtonI bet it feels like every minute, Thomas.
Thomas MarrAnd you know, a second.
Scott LewtonThat's right.
Scott LewtonI gotta add this, too.
Scott LewtonAs you were sharing that, Kevin, I'll tell you, we sure do love our acronyms.
Scott LewtonIota.
Scott LewtonD o d o t I t.
Scott LewtonMan, it's like a bowl Alphabet soup.
Scott LewtonAll right, so let's.
Scott LewtonI wanna ask you about this, Thomas, and I know this is sensitive, but inquiring minds gotta know a lot of our listeners and viewers and audience members.
Scott LewtonI bet they've heard of skunk works before.
Scott LewtonI know I have.
Scott LewtonTo Kevin's point, earlier, at the front end, a legendary, innovative factory.
Scott LewtonRight.
Scott LewtonI saw some articles.
Scott LewtonSomewhere to 85.
Scott Lewton85% of the work at Skunk works there at Lockheed Martin is classified and performed in secrecy to protect our national security.
Scott LewtonSo, inquiring minds, again want to know, how does that affect your everyday activities?
Thomas MarrAbsolutely.
Thomas MarrWell, to put it succinctly, it means I get to do a lot of cool stuff that I can't talk about.
Thomas MarrWell, the most important part, having the security clearance.
Thomas MarrAnd I being cognizant of your clearance levels that you're working with.
Thomas MarrAnd not just at work either.
Thomas MarrYou're required to maintain a lifestyle that's considered our nation's interests.
Thomas MarrThat's more responsibility than the average citizen.
Thomas MarrSo it does affect me day to day, not just at the workplace.
Kevin L. JacksonYeah.
Kevin L. JacksonOne thing also, I would say that concourse has a big target on it.
Kevin L. JacksonSo from a security point of view, you have multiple threat actors and nation states trying to break into your.
Kevin L. JacksonInto your environment.
Kevin L. JacksonSo I'm sure that keeps you busy.
Kevin L. JacksonMaybe that keeps you awake at night.
Thomas MarrYeah, well, we have multiple teams that handle their responsibilities well.
Thomas MarrBut absolutely, it's definitely something to be cognizant of knowing that there's target on your back because of the gravity of what you're working with.
Scott LewtonThat's right.
Scott LewtonYou know, back in my air force days, I did not have a top secret clearance.
Scott LewtonI think I had a secret clearance, right.
Scott LewtonBut I still remember the Opsec, the compusec, where you placed in files, and then, of course, when computers came along, it moved from paper files to floppy disks and stuff.
Scott LewtonAnd being mindful of all that, as you said, Thomas, that is an incredible responsibility.
Scott LewtonAnd I'm sure in an environment like skunk works, it takes it to a whole new level.
Scott LewtonKevin, your last word.
Scott LewtonBecause as a naval aviator, I bet you, I'm not sure if you ever visited skunk works after you were telling us about your C 130 ride to Perth, Australia.
Scott LewtonI tell you, I knew that the C 130 Hercules had transported plenty of things I didn't know it had transported.
Scott LewtonKevin L.
Scott LewtonJackson, in addition to everything else, you ever visited skunk works.
Kevin L. JacksonKevin, you know, I haven't had the opportunity or to proceed to visit scun works, one of those things you would love to go, but it's hard to.
Scott LewtonGet there, hard to get in.
Scott LewtonIt's very, very, it's like the Augusta national or an incredible social club that not many people get in.
Scott LewtonThomas, you get to wear the green jacket, I guess.
Scott LewtonAll right, let's switch gears here.
Scott LewtonSo, aerospace parts, most know, got to meet strict quality standards and tolerances because you got lives are at risk, right?
Scott LewtonAll that requires companies to attain certifications, registrations, and a whole bunch more.
Scott LewtonIt also places a high demand on supply chain security.
Scott LewtonOf course, any supply chain is only as strong as its weakest link across its ecosystem.
Scott LewtonSo, Thomas, can you share a few thoughts as to how supply chain security is addressed at Lockheed Martin?
Thomas MarrSo, as a government contractor, Lockheed Martin is required to follow Nisanner Dash 53, which does have contain security information regarding supply chain.
Thomas MarrBut as a company, Lockheed Martin himself also has a supply chain risk management team.
Thomas MarrAnd the supply chain risk management team enforces a supplier code of conduct regarding all purchase orders made by Lockheed Martin.
Thomas MarrOther ways that Lockheed Martin addresses supply chain security include recommendations they give on implementing physical security safeguards and an insider threat program.
Scott LewtonAnd it sounds like to me, Kevin, it's a mixture of protocol, policy, probably technology.
Scott LewtonOf course, the teams deployed to ensure that there's supply chain security across the massive ecosystem that makes up the Lockheed Martin global supply chain community.
Scott LewtonYour thoughts here?
Scott LewtonKevin?
Kevin L. JacksonYeah, I think one of the biggest challenges is managing the IT or network connections between Blackheed Martin and its suppliers.
Kevin L. JacksonI know that the Vod leverages system or policies called CMMC, which is a cybersecurity maturity model certification that's required of all DoD contractors and their suppliers.
Kevin L. JacksonI think that goes a long way towards protecting the cybersecurity of the supply chain water supply mesh, as I like to call it.
Scott LewtonYes, that's one of your favorite words.
Scott LewtonSo a great call out, too.
Scott LewtonAllison Kreachy Giddens, who leads a aviation manufacturing company and machine shop in the metro Atlanta area.
Scott LewtonKevin, fellow supply chain, now co host here, has become quite the leader in the whole CMMC movement, especially to your point, how that helps to navigate and govern the defense supply base between the public sector, the private sector, and help protect that whole ecosystem as well.
Scott LewtonSome interesting discussions that she has been leading there.
Scott LewtonAll right, one other thing to call out, because while Thomas being a cyber pro, he is a cyber rock and roll star that he is, really focuses, I think, a lot of his efforts around supply chain cybersecurity.
Scott LewtonRight.
Scott LewtonBut supply chain security, goodness gracious, is not from the faint of heart in a more, in a fuller sense.
Scott LewtonRight.
Scott LewtonCargo theft is up.
Scott LewtonCyber attacks have increased and gotten more complex.
Scott LewtonGeopolitical threats abound.
Scott LewtonGoodness gracious.
Scott LewtonWe've got to continue to evolve as an industry and change how supply chain management is done and protected.
Scott LewtonAnd thankfully, we've got some smart folks like Thomas and Kevin, the technologists out there that's helping us to do that in many ways.
Scott LewtonKevin, last word before we leave supply chain security, and maybe the technology side of that last word.
Scott LewtonAnd I'm going to talk about the cloud, especially from a manufacturer perspective.
Kevin L. JacksonNo, I think it's really important to understand that the supply chain chain also includes your information supply chain, and one of the most vulnerable areas in any supply chain is software.
Kevin L. JacksonSo I'm sure those who really focuses, that's something Thomas and his team focuses on, no doubt.
Scott LewtonThomas, that's a pretty safe hunch, huh?
Thomas MarrThat's pretty safe hunch, indeed.
Scott LewtonAll right.
Scott LewtonThis is called interviewing someone with a top secret national clearance, folks, there's only certain things we can talk about, understandably.
Scott LewtonSo, again, we're having a little fun with it.
Scott LewtonBut, hey, that's the importance of national security.
Scott LewtonSo let's talk about modern manufacturing data.
Scott LewtonIt's often stored in the cloud.
Scott LewtonRight.
Scott LewtonBut some say aerospace companies are generally discouraged from using cloud storage due to the immense security challenges.
Scott LewtonNow, I imagine the incredible benefits of cloud technology.
Scott LewtonI bet Kevin, I bet that gets his vote, too, are too good to pass up.
Scott LewtonSo how do you overcome those security concerns so you can leverage more of the cloud and all the manufacturer goes on at Lockheed Martin.
Thomas MarrAbsolutely.
Thomas MarrSo when Lockheed Martin utilizes cloud resources, which they do, I can say that they use a cyber resiliency level framework that measures their cyber cybersecurity resiliency when utilizing those cloud resources.
Thomas MarrMore specifically, there's four levels.
Thomas MarrLevel one being the least secure.
Thomas MarrFor being the most secure.
Thomas MarrConsider things like visibility we were talking about earlier regarding OT and it and SIM, cyber hygiene, cyber requirements, testing and evaluation, architecture, and information sharing.
Scott LewtonLots of layers of security.
Scott LewtonRight.
Scott LewtonSo kind of what I'm hearing as the ops guy here, so that they can lean in and leverage all the goodness and innovation that the cloud brings in efficiencies and productivity sharing information that cloud enables.
Scott LewtonKevin, what did you hear there?
Scott LewtonAnd what's important for our listeners and viewers to know?
Kevin L. JacksonWhat I think what's important to know is that even in toxic and security environments, cloud computing can be safely and securely used.
Kevin L. JacksonAnd those different layers that Thomas mentioned, I think the hardest one is really that cyber hygiene.
Kevin L. JacksonDo you wonder why I picked that out?
Kevin L. JacksonBecause that's where most of the humans fail in their day to day cyber hygiene.
Scott LewtonThat's right.
Scott LewtonThat's right.
Scott LewtonBecause we're human.
Scott LewtonRight.
Scott LewtonAnd while that's a beautiful thing, hey, we mess up a lot.
Scott LewtonThat's just kind of how it goes, you know?
Scott LewtonSpeaking of clouds, reading earlier, Thomas and Kevin about engineering simulations within the aviation industry.
Scott LewtonCloud provider had taken this simulation practice that usually had taken days and days for human teams to run, but their cloud based technologies allowed those engineering simulations to take place in a matter of minutes.
Scott LewtonMan, that makes life a little bit easier for those smart engineers coming up with the next generation of aircraft and designs, all that stuff.
Scott LewtonAll right, so, Thomas, I know that you get invited for interviews, and you speak a lot.
Scott LewtonOf course, you can't share a whole bunch about what you do day in and day out, but I think you do invite folks to connect with you and have conversations, maybe over a nice cup of coffee or you name it.
Scott LewtonHow can folks connect with you there, Thomas?
Thomas MarrAbsolutely.
Thomas MarrI'm always happy to have a conversation.
Thomas MarrI can be found on LinkedIn, and I can also be found on Xibertuff, spelled cyber tu f f.
Thomas MarrAnd you got to.
Scott LewtonRight.
Scott LewtonIf you're a tech pro, you got to come up with a creative spelling of words, right?
Thomas MarrYeah.
Thomas MarrThat's like an unspoken role.
Thomas MarrYeah, like that.
Thomas MarrLike that.
Scott LewtonSee Texas, right.
Scott LewtonS a C H s E.
Scott LewtonSo, folks, connect with Thomas Barr on LinkedIn, connect with thomas own x at cyber tuff stuff, and we'll include that in the show notes, so it's easier to make that connection.
Scott LewtonKevin, I'll tell you what, as a veteran that's always been fascinated and been a big old aircraft nerd.
Scott LewtonI really enjoyed the conversation we've had here with Thomas, especially.
Scott LewtonYou know, a lot of what I've spent in my time in industry has been in the manufacturing industry.
Scott LewtonRight.
Scott LewtonIt's one of the best parts of global business.
Scott LewtonBut out of everything that Thomas has shared, his personal journey, some of what he does, some of his perspective on cyber issues, especially with the manufacturing and the aviation industry.
Scott LewtonWhat's been one of your favorite takeaways from this conversation here today?
Kevin L. JacksonWell, I mean, one thing that's kind of important to understand is that the challenges that a top secret environment like skunk works has is actually no different than the challenges of our regular everyday manufacturers, because they are all on the Internet, they're all leveraging cloud, they are all leveraging information technology and operational technology in order to deliver better products and services to their chosen industry.
Kevin L. JacksonSo the activities that Lockheed Martin and skunk work does every manufacturer has to focus on.
Kevin L. JacksonIt's broader than you think.
Scott LewtonYeah, well said.
Scott LewtonI completely agree.
Scott LewtonAnd you know, speaking of organizations out there helping to make all those challenges easier, our friends at Microsoft doing some pretty cool things in the manufacturing industry, huh?
Kevin L. JacksonOh yeah, absolutely.
Kevin L. JacksonYou know, Microsoft is helping us manufacture a sustainable future by unlocking and innovations and introducing new products.
Kevin L. JacksonThey really are helping manufacturers embrace new designs and new manufacturing paradigms to prepare for the future of the industrial metaverse.
Kevin L. JacksonThey're creating resilient supply chains to ensure continuity and reduce risk by providing secure, agile and connected supply chain so you can have always on visibility in your IT environment.
Kevin L. JacksonAnd this enables the intelligent factories so that you can automate manufacturing, ensure safe and reliable production and empower the workforce with the power of industrial IoT data and artificial intelligence.
Kevin L. JacksonThey're doing a huge amount.
Scott LewtonI love, you know, one of our favorite topics talk about is empowering the workforce, empowering the human element, right?
Scott LewtonAnd I love that.
Kevin L. JacksonPowering those humans.
Scott LewtonThat's right.
Scott LewtonYou spike the football on that and you also use the word paradigm.
Scott LewtonAnd one of these days I'm gonna figure out what that means.
Thomas MarrIt is three syllables.
Thomas MarrThat's fair.
Scott LewtonSorry, Thomas.
Scott LewtonWell, a big thanks to our friends at Microsoft for the dude in industry and of course for how they're empowering conversations like this that we had here with Thomas Barr.
Scott LewtonIt's been a pleasure to talk with you, Thomas.
Scott LewtonReally appreciate what you do, appreciate your service to the country, your continued service to the country, and of course what you're doing to protect industry every single day there at Lockheed Martin.
Scott LewtonSo, Thomas Mar, thank you for joining us here today.
Thomas MarrIt's my pleasure.
Thomas MarrRangers lead the way.
Scott LewtonThat's right.
Scott LewtonEvery day.
Scott LewtonEvery day.
Scott LewtonHey, Kevin, I'd be remiss if I didn't ask you how folks can connect with you.
Scott LewtonAlso, how they can connect with the Digital Transformers podcast, which is on the move.
Scott LewtonHow can they track you down?
Kevin L. JacksonYeah, absolutely.
Kevin L. JacksonYou know, you can always catch me a supply chain now that digital transformers.
Kevin L. JacksonAnd I'm on LinkedIn and on the Big X.
Kevin L. JacksonKevin underscore Jackson, reach out anytime.
Scott LewtonI love it, Kevin.
Scott LewtonAppreciate what you're doing.
Scott LewtonDigital transformers, always a pleasure to knock out shows like this with you, Kevin.
Scott LewtonAlready looking forward to the next one.
Kevin L. JacksonMe too.
Kevin L. JacksonThanks.
Scott LewtonSpeaking of thanks, big thanks to all of our listeners and viewers across the globe.
Scott LewtonThanks for all your feedback, your show ideas.
Scott LewtonKeep it coming.
Scott LewtonWe really appreciate that.
Scott LewtonBig thanks to Thomas Marr with Lockheed Martin.
Scott LewtonThomas, thanks for what you do.
Scott LewtonThanks for serving the country, serving industry, and continuing to lead the charge to protect our global supply chains out there.
Scott LewtonAppreciate you being here, Thomas.
Thomas MarrThank you.
Thomas MarrIt's an honor.
Scott LewtonYou bet.
Scott LewtonBig thanks one last time to our cloud partners over at Microsoft as well, helping us bring these wonderful conversations and people and leaders and ideas to our global audience.
Scott LewtonSo, folks, hopefully you enjoyed this episode as much as I have.
Scott LewtonWhatever you do, your homework's one thing.
Scott LewtonYou gotta take one idea, one best practice that Thomas or Kevin shared here today.
Scott LewtonPut it into practice.
Scott LewtonYour teams are ready to do business differently.
Scott LewtonAnd, gosh, we gotta stand and deliver and help them make that happen.
Scott LewtonSo with all that said on behalf of Splotcha and our team, Scott Leon Challenge, you do good.
Scott LewtonGive forward.
Scott LewtonBe the change that's needed.
Scott LewtonWe'll see you next time.
Scott LewtonRight back here at Supplache now.
Scott LewtonThanks for.
Scott LewtonBye.
HostThanks for being a part of our supply chain now community.
HostCheck out all of our programming@supplychainnow.com and make sure you subscribe to supply chain now anywhere you listen to podcasts.
HostAnd follow us on Facebook, LinkedIn, Twitter, and Instagram.
HostSee you next time on supply chain now.