Seeing the Shadows: Securing What You Don’t Control
Drawing on her experience safeguarding every aspect of the U.S. Senate’s operations and a career spanning military intelligence and cyber operations, Karen Gibson explores a fundamental challenge for cyber defenders: protecting what you cannot always see or control. From legacy systems and forgotten technology to workforce practices and third-party dependencies, she examines how hidden vulnerabilities accumulate — and what leaders can do to better understand risk, strengthen resilience, and protect the mission.
AI Summary
Disclaimer: This session information was generated with the help of AI.
The information has been reviewed and refined by the Swiss Cyber Storm team before publishing.
Karen Gibson, former United States Senate Sergeant at Arms, uses the Senate — 135 independent offices, constitutionally protected data and users who cannot be ordered — as an extreme case of securing what you do not control. She frames shadow IT not as a threat but as lost visibility, control and recoverability, opening side doors to espionage, exposure, manipulation and paralysis. Citing vendors and well-meaning staff, she argues that shadow IT signals unmet user needs, and that defenders must make the secure path the easy path, prioritize mission assurance and treat the workforce as their security team.
Video chapters
0:00Introduction and Swiss–US parliamentary kinship2:56A federation of 135 independent offices7:19Openness, turnover and constitutional constraints11:50Continuity of government14:19Espionage, exposure, manipulation and paralysis19:56Shadow IT as lost visibility and control23:02Third-party vendors and well-meaning staff27:30Four lines of effort against shadow IT31:08Trust and invisible successes33:10Q&A: U.S. Cloud Act, LLMs and insider threats
Key facts
- The Senate comprises 135 independent organizations — 100 senators’ offices plus 35 committees and other offices — each making many of its own technology decisions with its own IT team.
- Beyond Washington DC, the Senate IT footprint covers 450 small distributed locations across all 50 states, including Alaska and Hawaii.
- Under the Speech and Debate Clause, members own their legislative communications and cannot be compelled to share them, so a third-party audit or assessment requires permission from every Senate office.
- Because of the separation of powers, many executive-branch cyber security directives do not apply to Congress, and intelligence from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the Director of National Intelligence is not routinely available to the Senate.
- Gibson states that legislative-branch staff do not undergo background checks unless they hold a security clearance; vetting staff is the responsibility of each senator’s office.
Ideas
- Shadow IT creates no new threats but removes the visibility, control and recoverability every security program depends on, giving adversaries unwatched side doors.
- Third-party vendors extend the attack surface onto networks defenders cannot see; a breached home-security vendor could expose senators’ addresses, floor plans and alarm configurations.
- Shadow IT is usually driven by dedication rather than malice, making it valuable intelligence about where sanctioned services are too slow, too restrictive or out of step with how people work.
- Pure prohibition pushes shadow IT further underground; discovery, better sanctioned alternatives, clear guidance and a culture of asking permission work better together.
- Mission assurance replaces perfect prevention as the goal: identify the essential functions that must never stop, remove single points of failure through redundancy and geographic dispersion, and plan to operate in a degraded state.
Keywords
- Shadow IT
- third-party risk
- supply chain
- governance
- U.S. Senate
Quotes
- “You can't protect what you don't know exists.”
- “Shadow IT doesn't stop at the edge of your network.”
- “You can outsource the service, but you cannot outsource the risk.”
- “Most of the people in this room will never be thanked for the attack that doesn't happen.”
Recommendations
- Make the secure path the easy path by bringing the capabilities staff want, such as large language model (LLM) translation and drafting tools, into the sanctioned network rather than relying on prohibition.
- Understand who is looking for side doors by plugging into a variety of threat notification and sharing groups, as Gibson did with the Federal Bureau of Investigation (FBI) and counterparts in the United Kingdom, Canada, Australia and New Zealand.
- Assume some defenses will fail: decide which functions must continue in a crisis and which can be suspended, limit collateral damage and plan to recover quickly.
About the speaker
Karen H. Gibson
Lieutenant General, U.S. Army (Ret.)
Lieutenant General (Ret.) Karen Gibson served as the 42nd Sergeant at Arms of the U.S. Senate from 2021 to 2025. Appointed in the wake of the January 6 attack on the Capitol, she was the Senate’s chief law enforcement, protocol and security officer, and led the overhaul of its physical security, continuity of government and cybersecurity programs, including the protection of 450 Senate offices across the United States. Before that, she spent 33 years in the U.S. Army as a military intelligence officer, serving as Deputy Commanding General of U.S. Army Cyber Command, Director of Intelligence for U.S. Central Command and for the joint task force in the war against the Islamic State, and as Deputy Director of National Intelligence for National Security Partnerships. She also led intelligence fusion centers in Iraq, Afghanistan, Korea and East Africa.
Read more …
Read more …