EP173 SAIF in Focus: 5 AI Security Risks and SAIF Mitigations

Security running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Threat Detection in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners all on our community page. You can find the link to that in our show notes. Anton, this is a special episode for me because we're joined by a former Shape colleague of mine. We're talking about, is it more AI?

I think this one is about AI, and it's also kind of unabashedly about AI. But it's also very substantive. I mean, I have a— we probably should say the following. We definitely know people who hear about the AI security and they think, oh, come on, we are busy with ransomware. We are busy with traditional security. Don't bother us with this LLM-y stuff. But it's an understandable take from somebody who has to deal with immediate threats. But a lot of this really matters. And a lot of this would really matter a lot more in a very near future.

Yes.

So that's why we are trying to be For once, we are trying to be early, not late with security. And that's why this snide remarks for once. For once. Yes, you're right.

And that's why 40 years, listeners, we're finally going to do it this time.

Maybe.

Maybe.

No, we're going to think we're going to give it our all.

This episode has one of my favorite crazy analogies, listeners. And if you hang on towards, I don't know, partway through, we compare what's going on to the Millennium Tower in San Francisco, which, if you're not familiar with, is a major Major building that happens to be leaning several degrees out of vertical. And so maybe without further ado or further inside San Francisco baseball references, let's turn things over to today's guest.

Welcome to another livestream episode of the Cloud Security Podcast by Google. We are coming to you live from the show floor here at Google Cloud Next 2024. We are joined today by an old colleague of mine and a good friend, Sean Howe. Sean, thank you for joining us. Sean and I go way back, folks. We actually worked together at Shape.

That's right.

Way back in the day.

Sean, what are you up to next?

What are you doing here, buddy?

I'm here to meet old friends, learn about security. I'm giving a— I gave a talk earlier today on AI security and privacy with Anton.

Is that important? Do we care about that?

Some people care about that, it appears. And just a few government folks who want the world to be safer. So that was exciting.

Is it SAFe spelled with AI in the middle?

That's right.

SAFe spelled with AI in the middle. You know, you know everything already.

I know everything already.

S-A-I-F. That's right.

Yeah, yeah, yeah.

That's great.

It's also been exciting to see the startups and Google product teams with all the AI features. Everything's AI this year.

Including cloud. Cloud is AI now.

Cloud is AI now.

Security is AI now.

Spelled with an AI somewhere.

Cloud is now spelled with AI?

No.

You know, Corey Quinn would make fun of us on Twitter for that.

Corey Quinn probably should.

And he probably should. Yes, that's a good point.

Okay, so you gave a talk. What have you seen that's interesting? What are you impressed by?

Well, in the talk, not in the talk itself, but at Cloud Next.

Yeah.

I think it's actually really impressive to see the AI features from various parts of Google.

Yeah.

And from the startups. Like, I was sharing this with one of my colleagues yesterday. That even though the technical novelty is not quite there in the GenAI features we're seeing out there, but just in exploring the various use cases and features that are being launched, the utility is there.

Really?

So even with at this early stage of GenAI development and productization, I can see how tons of value is being created for a whole host of stakeholders, customer experiences, Sales, marketing, productivity.

What's something particular and specific here? Like, what's the coolest single thing you've seen for that? What's the most productivity you're like, wow, I can't believe they did that?

Oh, you know, nothing. Nothing comes to mind around anything that surprised me because, you know, again, Anton and I gave a talk on this.

You're done being surprised.

Yeah, we've been surprised over the last 10 years at Google. I'm not so surprised by the features that are coming out in the external world today, but there were elements of the Workspace Keynote talk yesterday that I was delighted by. Our video app with generative video looks very cool.

Yeah, yeah, yeah.

Some of the easy to kind of replicate enterprise workflows that Workspace is building out and the document kind of agents that we are building out with AI are very cool and actually very useful. Like, I use them on a day-to-day basis right now.

Oh, really?

So there are innovations coming out, but I think The innovations still are very much the purview of the major platform providers that have been investing in AI for a long, long time.

Yeah, yeah, yeah.

I think that's going to start changing, but still, like the, the stuff that's coming out of the startups, the other smaller product companies is very useful, but at an early stage.

Yeah.

One of the things that really impressed me in Vids is how you can just add a document. It's so easy. There's no integration. There's no, let me glue stuff together. There's no assigned permissions. It just works right out of the box.

Yeah. Some of the stuff, I mean, we know it's secure on the backend, respects privacy, and just works.

Yes.

Which is kind of epic. And I think that we are, I don't wanna like put a vendor hat on, but we are kind of in a unique role to actually do that. Something that's secure and usable. I don't know. Like that's very inspiring.

Yeah.

Okay.

I have a vendor hat. Fine.

Like a demo that was at the keynote yesterday was somebody receiving an email about follow these compliance policies, look at this video for details. And then them saying, oh, are we in compliance with the policies represented in this video? And then being able to transcribe that video with an automated agent and compare it to a compliance policy that they already have in the organization.

No way.

I said, both from a security perspective, that is so useful.

And reducing toil, which is really nobody's favorite task to think about whether you are quite matching.

Amazingly productive. And of course, From a Google perspective, I'm like, we're going to actually be doing that next week. I'm immediately going to use this feature to make Google safer. Our customers will then, of course, find it useful. That's awesome.

So I want to switch subject to, well, back to AI, I guess, and actually cloud and AI.

I want to switch subjects to our current subject.

From AI to like—

So many things in AI.

Yeah. I mean, yeah, I know, like, fine. We are replicating the meme about it being all about AI. But actually, how about AI in the cloud? A lot of security, including the stuff we covered in the talk, applied to artificial intelligence, GenAI in general. But we assume, probably correctly, that most people, most organizations would use AI that backends to the cloud, that runs in the cloud. So what are unique challenges from, say, from your experience securing AI in cloud environments?

Well, you know, firstly, just to kind of warm up on this topic, I think the benefits of using clouds are enormous and evident to me, but maybe not evident to everybody. And worth talking about, like our decades-long investment in building AI and the practices for security and privacy that emerge from that and our preexisting hardening of the foundational infrastructure on top of which we're now hardening our AI-specific infrastructure are things that require a lot of investment, frankly, hundreds of millions of dollars, billions of dollars of investment and expertise over a long time. And now, like, we know this because we want to keep Google secure. And now I can see the benefits of an external customer adopting those benefits as well.

So that's kind of mundane stuff in terms of like headlines. Secure infrastructure sounds kind of maybe not boring, but mundane. But in terms of practical contribution to a secure AI experience, it's actually huge.

It's huge.

It's huge.

I think with AI, what I tell my teams is all of our boring, grungy security and privacy practices are sexy and important again. You know, people didn't really want to—

You mentioned data governance in the talk, and it's a topic that puts people to sleep.

But it's actually important here.

Yeah.

And it actually works out of the box.

That's—

yeah.

Yes.

That's kind of magical.

Yeah.

I think to use an Anton phrase, that's almost magical, Sean.

Yeah, that's right.

That's right.

That's great. That's great. So what else do you get, like, for free with cloud? How else does cloud give you an advantage out of the box?

Well, you know, name a topic. So hardware supply chains is a topic that our governments worry about today. This is in New York Times headlines. Our national security policies are being written about that. While we at Google and frankly all of the major cloud providers have worried about this for a long, long time.

Yes.

And this is particularly important in the case of AI. Again, where I was just telling my team yesterday, Listening to the Google Cloud Next keynote talk, silicon is sexy again. When was the last time we put so much emphasis on silicon? And when we're designing our own silicon, when we're acquiring silicon, we have tons of teams focusing on the security of silicon. But then you go to like less kind of niche topics, software supply chain, still very mundane. We've been focused on that. Now we're applying that to cloud. Data governance, very boring old topic. Yes.

That's just my pet peeve, frankly. Yeah. Because it's like something that was like really, really sleep-inducing suddenly became like almost at the center of a secure AI experience.

That's right. And then like getting to the sexier topics, even things like prompt injection attacks.

Yeah. Yeah.

Things like model testing and tuning against adversarial attacks. We call it model hardening.

Or model theft.

That's actually kind of cool in a cost portable, easy to steal, easy to get value from if you steal it. Like that, actually, Tim was the one who opened my mind to this, like that it's so ideally suited for being stolen by the bad guys.

Yeah, I think model theft is another one where I think it's really important to focus on right now. I think the implications, both from a security perspective, an IP risk perspective, which, uh, financial perspective, and a compliance perspective are still being debated out there. And that is the trade-offs are being debated in various organizations. But one thing everybody agrees on is models and associated artifacts like weights and code and harnesses around models are really, really important to protect. And certainly we at Google are focused on that. By the way, the trade-offs around, you know, the rapidly evolving landscape of models. Lots of models are open-sourced. When they're just available to everybody, yeah, why bother stealing the Llama model?

It solves the model theft problem for that model. That is, we have— can, can check one-off things.

You steal what's free.

Yes, that part is easy. But what about like, uh, you see, yeah, yeah, yeah, that's right.

So if you have fine-tuning data in your model, if the model is personalized to your organization, perhaps in the future personalized to your individual self, Yeah. Then the model becomes very, very precious to you.

Extremely.

Like, then the model represents your organization or represents yourself. And all of the security and privacy risks that will come from some intelligence organization just digging through all of your documents and backlogs to understand everything about you are now centered in the model. The same risks appear in the model. And therefore you just—

And this is scaring me actually. Like, I'm starting to think like, this is actually like, we didn't scare enough people during our talk, but now suddenly we shifted some of the scaring to a podcast. Like personalized model that has the data that again, the data security challenges go again even higher, right?

That's right. The more personalized the model is, the more it knows about your organization or yourself, the more the security and privacy challenges are. Like frankly, we're not there yet in the industry. Right now, what we are deploying widely in the industry industry, including in Google Cloud, are general-purpose models. The same model's available to everybody, is shared by everybody, and any kind of fine-tuning— it's not really fine-tuning— any kind of customization of the model's behavior is actually happening mostly outside of the model and augmenting the model. And we are keeping those very contained and separate. But the general-purpose models represent general-purpose risks and not specific risks to organizations or individuals.

That's really interesting. So, we're talking about risk. Your talk talked about risks. Was this one of them and what were the other ones?

Oh, well, we talked about the sexy, exciting topic of prompt injection.

Okay.

And the risks it entails.

Can you tell the listeners what prompt injection is? Is that like SQL injection, but for models?

Oh God, no, don't go there. This trivializes a lot of really exciting stuff.

Really?

I've seen that on the internet many times. There are similarities. differences, but okay, fine, I'll outsource it to John.

John, tell us, why is it not SQL injection but for models?

It's not a bad place to start.

Surprisingly, I'm so wrong today.

It's not a bad place to start, but I think the parallel is that an attacker would try to inject something malicious in a prompt that otherwise seems fairly innocuous to try and change the model's behavior and get it to do things it was designed not to do. That's what prompt injection is about.

Like, cough up all the contents of the database?

Cough up all the content of database or get the model—

That's a little like SQL injection.

Exactly.

Yes, but he should have said, no, not like reveal the contents of the database.

Unless I'm right, in which case I'm leading him down that path. So what else can it do? Why else?

Or provide responses that the model shouldn't provide. Like the example Anton and I gave in our talk today was a very innocuous model designed by a remote work company on Twitter to provide very helpful encouraging responses to tweets about remote work. And somebody figured out how to do a prompt injection attack very simply to get the Twitter bot from this company to provide threatening messages against the president.

Right.

Which was sort of hilarious, but like also in terms of like sheer loss amount, probably not that bad. Like they probably unlaunched the bot. I'm sure they did, right?

Well, also that's like a stupid bot in the first place.

Yeah.

Whose idea was to put that bot out on the internet?

That's right.

That's right.

Altogether stupid.

There are many, many bots like that for entertainment purposes.

But imagine a more Threatening scenario.

Yeah, yeah, yeah. I could imagine that.

Okay.

Well, great.

Done. Job done. Podcast over.

Yeah. Okay, great. Okay. So we've got prompt injection. What else do we have? Well, uh, unless we rat hole on that the rest of the topic.

Let me just quickly say the reason it's different from SQL injection attacks is because with SQL, you're providing a very structured input to the system. With prompt injection, you're just talking. Like if you were an LLM, I could be prompt injecting you by just inserting certain phrases in my conversation with you. And that's what makes prompt injection quite scary.

So model theft, and then what else was there after model theft?

Data poisoning and AI coverage?

We talked about model integrity violations as well. This relates very much to supply chain challenges in the production of AI systems where models can be— the specifics of the models and datasets could be violated to change their behavior. This could happen either during the data poisoning risk stages when the models are being trained or when they're stored and the weights could be manipulated. We worry about that without anybody knowing because you can't analyze weights the way you analyze code. They're not human readable. Or models could be swapped out with nefarious models during the deployment stage. And this is something, in fact, that's been happening in the industry. So it's very important for us to think about the supply chain of AI and apply protections across the model development deployment cycles.

Interesting.

And it just sounds kind of more fancy than— okay, you go ahead.

Yeah. No, no, I was gonna pick on Chun for a minute. I was gonna go back to something you said. You were saying, you know, SQL is structured, but we're just talking to LLMs. But doesn't the fact that the LLM machinery can understand natural language suggest that there's an underlying order to natural language, which might not be super apparent to us, but is in fact present? I would just push back on the idea that natural language is not actually structured.

You do realize we're going to be here 6 hours later discussing this, right?

And then like Stephen Wolfram is going to fall out of the ceiling and smack all of us.

Yes.

Yeah.

Yeah.

And of course there's structure to natural language. Otherwise we wouldn't understand each other. We run rules of grammar and absorb this. We're LLMs ourselves and we kind of get trained from our births into understanding language. The difference between SQL and natural language is the number of variations that are allowed. So with SQL, you can easily represent desired and undesired inputs with regexes, for example, complex regexes sometimes. But with natural language, that's very, very hard to do.

Yeah, it would be very difficult to regex a good LLM prompt for a plugin.

And I think that somebody at this point of the conversation, somebody must mention that the whole data plane control plane contamination that we have with LLMs, which has been triggering a lot of people in a lot of interesting ways that you're not going to filter— essentially language is also an API and essentially code to have the model do something, right?

Right.

So, and filtering natural language in uniquely specific ways is really hard. I'm thinking of that.

And listeners, what Anton is thinking about here is, is LLMs are payphones. And that paper basically says LLMs, by mixing the data and control plane, look like payphones from the '63, you used to be able to whistle control tones and get free phone calls.

Yes. Except for this paper is probably never going to be published. So, if you mention that online, but okay. So, let's go to mitigation, something positive and beautiful.

The good side of the coin.

Yes, exactly. So, and I know I'm not going to— I'm slightly obsessed about data governance today. I'm not sure why.

He was out too late in Vegas, folks.

Yeah. Okay. So, some of the mitigations for that seems the same. Like, when you look at data poisoning, data exposure, exposure, prompt injection in our talk. Some of the mitigations are the same. And I'm primarily thinking about controlling data, just access control for model integrity. So what I'm trying to say is that there isn't some kind of a magic unique tech you have to buy from a startup. Some of this is more about broad controls applied in AI-specific ways to this. So can you comment on how the mitigations— how you are thinking about the mitigations?

Yeah. We've been thinking about this a lot from a Google perspective and our own risk reduction efforts. And I think a question one of our senior execs posed to me the other day was, hey, Shaun, you're kind of formulating a new plan for AI security and privacy. Does that mean we're completely exposed today? And my answer was no, we're actually already doing probably 90% of what we need to do because we've been very rigorous in our traditional security and privacy practices. And that's our advice through the SAFe framework to the rest of the industry. But to do AI security and privacy well, you just need to invest in security and privacy and then focus on the AI part.

This is the most mundane piece of advice, but also the most correct.

To be good at something, you have to do that thing.

Yeah, but be good at something traditional because the new thing relies on you being good here.

Yeah.

So, if you, if you, to use a more practical example, if you really, really suck at containersec, You're going to suck at the AI stack. Yes.

If another example, if you don't know where your code lives today, you're probably not going to know where your models live tomorrow. And therefore your models will be just as affected by the exfiltration problem as your code is today. If you don't know how you're sourcing your code that's going into your applications, you'll likely not be able to implement how you're sourcing data, managed data to go into your models. And you're going to have the same problem. So we just need to get tighter with our security and privacy practices within our organization. Don't forget anything that you've been doing in the past just because AI is everywhere now. In fact, reinvest in what you've been doing in the past because you want to protect AI better.

I think you alienated a whole bunch of startup audience who also all wanted to sell you an AI firewall. And they almost have it. They almost have it. Here it is, version 0.9. Deploy it and you have it. And suddenly, The Sean guy says, sorry, you have to be good at security, guys. No, not AI firewall for—

We're still leaving that 10 to 20% up top that may be unique to AI. And there is a lot of innovation that's going to happen in that space. Google Cloud is also going to sell some products in that space. But it's not all new. It's not all new. And just because it's not new doesn't mean it's not important. In fact, all of the old stuff is very, very important to succeed with the new stuff. If you just buy the top 20%, it's going solutions and don't invest the 80% that's at the bottom of the iceberg, you're likely going to fail.

This is sad news for vendors, but good advice for security teams.

Right. And also good advice to people who actually mean to build it securely like us.

Yes, yes, yes. So one of the fun things that we get to ask you to do is predict the future. What do you see coming in securing AI for cloud environments and how do orgs get ready for the future?

Well, let's talk about the risks first. Yeah, I think, I think the risks are just going to get bigger and accelerate over the next 2 years, particularly because—

Safe prediction.

Because you don't need to be like an AI data scientist or a security professional to know this. Just read the New York Times. Just read the Guardian. AI is a topic for nation states amongst each other. Presidents and the prime ministers are talking about this. They're talking about this because they really value AI. and the societal implications of AI.

Yes.

And because AI is so valuable to nation states, to our societies, to public and private entities, it's not just a business thing anymore. It's an opportunity for warfare and attacks. We're already, of course, starting to see this. Again, just read the public information in New York Times and Guardian, et cetera. And because of that, we will see many new attacks over the next 12 to 18 months. Research labs, are finding this, academia is finding this, the national security labs are finding this. And we're going to see a lot of innovation from Google, Microsoft, from Apple, from Google Cloud, from Azure, from AWS in this space. Many new startups are going to come as well. So, expect a lot of foundational thinking, a lot of innovation, a lot of tools. But again, I would ask your audience to kind of rest easy that they know 80% of what they need to do. Just do the basics.

That's a little— that's kind of an— to me, it goes into the insensitive remark bucket a little bit because some of the basics, like patch faster, they're well known, but they're not being done for lots of reasons. So, sorry, I'm lately— I've been uniquely triggered by saying do the basics because I've said it in the past myself, and then somebody slapped me and said, Anton, you know, we can't just patch faster or limit access to users or better classify data because some of this We have been trying since the, I don't know, '60s, maybe.

'60s.

'60s. And it's genuinely hard. It is genuinely hard. It's not the basics. It's the foundation.

Yes.

Yeah, we talk about them as secure-by-default foundations within Google, and it is genuinely hard. Like, we have invested within Google 20 years of expertise and dollars in building the secure foundations. And I think it's very, very important for any organization trying to build serious load-bearing businesses around AI to invest in security and privacy foundations.

I think foundations is a great word for this because you think about our security industry, it's— or our software industry, it's been around since the '60s. We've been building buildings for 5,000 years. And when you get the foundations wrong, you end up with the Millennium Tower. And that's with 5,000 years of practice, we still screwed up that badly. So, I think this is a much better word for it, foundations.

That's kind of inspiring. And it's actually, your line is simultaneously inspiring and depressing. So it's given me like weird vibes. And I think Tim achieved the inspiring yet depressing prize.

Yeah, yeah, that's a good prize. That's a good prize. So the advice then to get ready for the AI revolution that's coming and happening around us is do the foundations right.

That's the best advice anybody could walk away with. And I'll tell you, like, this is a piece of kind of a knowledge that resonates with company executives.

Sure.

I know this firsthand from talking to executives within Google. People get what foundations means, and people can reason about whether the foundations are secure or not because they've spent years thinking about this. And they're now saying, to do better AI security, we need to invest even more in our foundations, is a message that I found an accepting audience for versus here, You read these 100 research papers that just came out of Stanford and MIT over the last year, we need to do 85 brand new things and invest in 3 different vendors.

Or worse, don't forget foundations, forget the entire building. We have the unique new roof paint that you can buy in a SaaS form and spray all over your roof and suddenly your AI is secure. I'm sorry, but I'm hearing this from some of the novel startups. It's not even the— not the foundation, not the building, not the reinforcement learning. Reinforcement from outside, but it's freaking roof paint that you can just like apply patterns on the roof and then the whole building is gonna—

But I can't figure out how to dump VC money into foundations. People have not figured that out for 50 years.

Look at the turtle example.

I was thinking about the turtle example.

Yeah, yeah, yeah.

It's the—

Tell the listeners what you mean with the turtles.

So it's not like it wasn't the only case, it wasn't the only example when Tim's mind maybe attacked guest on the podcast, but I rather sharply questioned the guest by saying that— no, no, yeah, maybe not probed. More than probed. Yeah. Probed with a cattle prod.

Whether or not that company was the right company because they were so small to address foundational things.

Yes, exactly. Like very foundational things. Truly the very, very bottom layer of identity.

Yes.

And that to me, and funny enough, they mostly convinced me that—

They did?

Yes. Startups and smaller companies can in fact build some of the key foundational elements.

So maybe there's money in—

This is the line I've dropped.

Maybe there is money in novel foundational approaches.

So that's actually kind of a fun detour from this, but it's actually a really good one.

And Eli, who was on that episode with us, and listeners, this is episode like 160-something.

We'll find the right number in the show notes.

But former colleague for me and Sean. Yeah.

Yeah.

This resonates. I'll also say because the upside to doing AI well is so high for businesses, of course, for individuals, for societies and governments. There is greater willingness to focus on the hard problems of foundational security and privacy. In fact, if you see the emerging demands from the journalists, from the key opinion formers, for motivating larger companies to do security and privacy better, these are demands that they had kind of laid aside over the last few years because they thought it's just too hard of a problem to ask people to solve. because the upside for AI is so high, there's a proportionally hard demand to invest more in security and privacy. I think this can work for many people within their organizations.

So it would motivate them to improve security elsewhere, right? So let's— we have one more question before the final question. And I want to ask that. And it's a question about the domain of securing AI or AI security. So we had a couple of interesting debates, I think, on one of the VC episodes when The question is, do you think in 2, 3 years, maybe up to 5, AI security would be its own domain, part of AppSec, part of DataSec, part of some other more traditional security domain, or would it be a separate domain still in, I don't know, pick the timeframe yourself, 2 to 5 years. I don't know. It's a broad range.

You know, certainly I think in 5 years and even 3 years is quite into the future given the velocity of AI development. I think in a 3 to 5 year timeframe, if AI security is a completely different domain from other security and privacy practices, then I feel in some ways we have failed.

Oh, really?

I believe that over the next 2 to 3 years, there's going to be enough innovation in this space and enough foundational first principles thinking in this space that we need essentially tiger teams tasked forces, specialized engineering teams in every organization that can really reason about the risks and control completeness around AI. But to do this job right, we will think about AI security holistically, along with all the other foundational security elements for data, for applications, for models, for infrastructure. And just like we don't have Java security teams today, Just like we don't have C++ security teams today. To be sure, these teams do exist when that's a particular area of focus for the organization. But this is not how we do it.

Well, we do have cloud security teams.

Ah, yes.

But I'm going to argue in my talk this afternoon that you should stop treating cloud security as an island and that it should really be a peninsula.

That's right. Wait, wait, wait. Okay, this is a separate podcast, but island, peninsula, that's like, let's put a pin in it and whatever. Yeah. Yeah.

I think you're going to the same place of you need to focus a team on it, but it can't be separate from the main.

Is that right?

That's right. That's right. But I think, you know, the way we are structuring our own efforts around AI security within Google, we see the need to have focused, dedicated resources working on AI security for the next 2, maybe 3 years. But then we also are already starting to diffuse that knowledge from the focused resources into our kind of, let's just call it general purpose. And I mean, I don't mean that in a bad way at all. Folks who really holistically understand security in the various domains. Right. Yeah. And again, in the long term, if we've solved for the problems enough, and there may be new innovations that cause us to extend this time horizon beyond 3 to 5 years, but I think in 3 to 5 years, unless there are major new innovations that impact security privacy, I think we would have been able to diffuse the knowledge in a general-purpose state. This will be different for every organization, of course. Like, Google's just had a head start.

Yes, that actually makes sense.

It's very interesting.

Go with a closing question. I think we have—

Okay, that's my job. John, I hate to do it because we're 2 minutes over already. One, do you have recommended reading for our audience?

It can be anything.

Yeah, Art of War, Mary Oliver, not Anton's blog. And 2, do you have a practical tip to help people improve their AI security foundations?

Yeah, you know, there's very, very practical things that I'd recommend people read, things that I've found compelling of late. The US Cybersecurity Agency, CISA, the UK Cybersecurity Agency, NCSC, wrote some really well-reasoned guidelines for AI security and privacy that'll become foundational to many emerging regulations and guidelines from public sector in the future, in the near future, in 2025. I recommend people go find that, that AI cybersecurity framework.

We'll put it in the show notes, listeners.

Another fairly well-written document has been from NIST in their risk management framework, and they had an appendix to that as an AI risk and mitigation framework.

This one is heavy reading though.

This is like, you do not read it before bedtime. That one is just a no, hard no.

Purely for the security diehards.

NIST and CISA recommendations next to Each other in the show notes. Do they self-destruct each other?

No, no, no. Is that a bad meaning?

Deep hypnotic sleep.

Oh boy! Well, you didn't say that about CISA. Like this is a vote of confidence for CISA, not a vote of confidence for NIST. All right, all right.

Yeah.

And then practical tip.

By the way, just beyond general proceeding, I would recommend that everybody subscribe to the New York Times and Guardian headlines on AI security and privacy. There's enough happening in the wider world that if you're not aware of. societal impacts, if you're not aware of why your CEO, your CISO, your local congressman cares about AI security and privacy, you're missing out on a huge opportunity to leverage their view of upside to promote your work. Of course, watch all the Netflix series. Like, The Three-Body Problem has been particularly motivating for me recently with an AI security and privacy angle that I think people should—

But it switches the threat from robot rebellion to alien Invasion. That's cheating. That's cheating.

Yeah.

Okay.

One practical tip: focus on the foundations.

Focus on the foundations.

Yeah.

It's the most important thing you can do.

Well, Sean, I can't thank you enough for joining us today. This has been really fun. We've got topics coming out of it. We've got to talk about turtles, foundations. This is a joy. Thank you.

Thanks, guys.

And now we are time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @_timpeagle. Tweet at us, email us, argue with us, and if you like or hate what you hear, We can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.