EP 182: AI Efficiencies in Cyber - A Double Edged Sword

This is the Everyday AI show, the everyday podcast where we simplify AI and.

Bring its power to your fingertips.

Listen daily for practical advice to boost your career, business and everyday life. There's a constant battle going on that I think not a lot of people see or understand. And it's being fought in cyber security and with generative AI. So we're going to be talking about how AI efficiencies in cyber can actually be a double edged sword. And we're going to be talking about those things and more today on Everyday AI. Welcome y'.

All.

My name is Jordan Wilson and I am the host. Everyday AI is for you. It's. It's your daily live stream, podcast and free daily newsletter helping everyday people like you and me know not just understand what's going on in the world of generative AI, but how we can all actually use it to grow our companies and to grow our careers. So I'm excited to have a guest on today, an expert in cyber security to actually tell us about this kind of ongoing battle that's always being fought that many of us aren't even aware of. But before we get into that, let's first go over the AI news and if you are joining us from the podcast, thank you.

Thank you.

Make sure to check your show notes to find our website. You can email us all those great things, but make sure you do go to your everydayai.com to sign up for that free daily newsletter. We'll be recapping today's episode and a lot more. You can always go listen. I think we have now 180 different episodes. You can go back and listen to all of those on our website, read through also every single email newsletter. So it is literally a free Gen AI university at your fingertips. All right, so let's go over what's happening in the world of AI news. So OpenAI has announced a large scale partnership with the state of Pennsylvania. So OpenAI's Enterprise Chat GPT service will be deployed by the state in a pilot program by the state of Pennsylvania to help state employees with administrative work. So this pilot program will initially involve a limited number of state employees with the potential for expansion in the future. ChatGPT Enterprise will be used for tasks such as creating copy, drafting job descriptions and addressing conflicting guidance in employee policy. So a pretty big announcement. This is one of the first big government partnerships that OpenAI has announced in a huge way the entire state. All right, Alexa is getting some generative AI skills. Amazon has released three new Alexa skills that heavily incorporate artificial intelligence. These Skills allow users to chat with historical figures and other chatbots, create custom songs and play an AI driven version of 20 Questions. All right, so these three new skills are character AI, which is the one that allows you to chat with historical figures, splash and volley games, and they're all accessible through the Alexa app and the Alexa Skills website. All right, last but not least, a new AI powered hardware device made a big splash. So it is called the Rabbit R1 and it was just announced at CES, the Consumer Electronics Show. So the AI startup named Rabbit announced their new hardware gadgets, the R1, which is a standalone AI device. So it's not an app that runs on your phone and it's a piece of hardware similar to the other ones, such as the. What is it? The Humane's hardware device that was announced a couple of months ago. So this device from Rabbit has a 2.8-inch touchscreen, a rotating camera and a scrol, a scroll wheel, and it uses Rabbit os. So it has its own operating system, a universal controller for apps, and has a dedicated training mode. It's already available for pre order, I believe, $199 and is set to ship in March. So the Rabbit. Rabbit trained this model on how to use existing apps, making it a potential solution for controlling various apps through a single interface. So, yes, it will be able to interact with the other apps that you use on other devices. So interesting. You know, one way we've been seeing generative AI really come to life over the last couple of months is through hardware devices. So, you know, maybe if you have a smartphone like an iPhone, you know, maybe you don't have a lot of new generative AI capabilities, but they are coming to hardware devices very quickly. All right, so a lot more on the website, so go to your everydayai.com if you're joining us live. Thank you. I'm excited to bring on our guest on the show now. So if you are joining us live like Megan or like Brian. Good morning. Thank you for joining us as always. But I'm excited to learn some things today. Right. That's what we do here at Everyday AI. We bring on extremely knowledgeable guests who can teach us how generative AI is impacting different industries. So with that, I'm very excited to bring on to today's show. Let's go ahead and welcome. There we have him, Glenn Penley, who is the chief Technology officer at at Tenable. Glenn, thank you so much for joining the Everyday AI Show.

Thank you for having me.

Absolutely. Hey, could you tell us just a little bit about what is tenable and what does tenable do?

Yep. So Tenable is obviously a cyber security company. That's why I'm talking to you today. And when you think of cyber security tools, there's a ton of them out there. But to simply kind of put it, there are two broad sort of groupings of security tools. Tools that sit there and look at what bad guys are doing in the environment, tries to stop them. And then there are security tools that try to assess the good guys environment and then give them instructions on how to fix the environment before the bad guys have a chance to attack. And Tenable sits on the preventative or proactive side of security, where we assess your cloud, your laptops, your users, we look at how everything is configured, who's using them, software vulnerabilities, and then we give people a plan to try to reduce their risk before the bad guys attack.

Maybe give us an example of like a type of business that you work with. Are you working with just, you know, huge businesses, are you working with small businesses? And then what are some of those, you know, day to day vulnerabilities that you help those businesses detect?

I mean, we have about 50,000 customers. We're one of the largest cybersecurity companies in the world. So it's a huge breadth of different types of customers. Everything from governments and militaries down to local mom and pop flower shops and everything in between. So it's a pretty broad range of customers and different types of verticals and stuff like that. And some of the things that we help folks with is obviously here's the software you have installed in your environment, the vulnerabilities you have, things like that, or let's say from an operational technology, even like from basic laptop sort of stuff to here's the devices that you have running your manufacturing environment that's making the, you know, the plant run, here's how it's configured, the firmware like it. So it, it's a huge range of really kind of being the, you know, the system of record for like state across everything that your environment.

Yeah. And so, you know, I'm, I'm curious because I think a lot of people, when they think of cybersecurity, you know, even sometimes myself, I, I really just think of, oh, you know, this is something, you know, really that the government is, is taking care of. You know, where does that kind of like public versus private sector, you know, where does it start, where does it end? You know, are, are we getting certain, you know, protections, you know, like, you Know, for people here in the US as an example, like are there, you know, know, is the government looking out for things or is it really just up to, you know, ourselves as, you know, business owners or you know, hiring or working with a company like Tenable to make sure that we're protected?

It's, that's a great question because I mean I, I think, you know, attackers are opportunistic, right? Like they'll, they're like water. They'll find the path of least resistance and do whatever they need to do. So to assume that like, oh, you know, you and I, we own a bakery, like nobody's going to target us. Well, if you make yourself super easy to get targeted, they will, you know, if the juice is worth the squeeze when it comes to, you know, somebody else is going to take care of the problem. I definitely wouldn't rely on the, the government to do that though. I will say in, you know, in the last few years we've seen like the, the stand up of cisa which is a government agency that's really focused on trying to, again, they can't enforce private companies or people to do anything, but they've given out great guidance on, you know, to try to, to ensure that people either have the, the resources to work with companies like us or things that they provide and just educate private business to, to make better decisions and inform them. So it really is up to you to kind of protect yourself. But there's more and more, I think help from larger organizations or like government organizations to at least steer people in the right direction.

So you know, obviously with cybersecurity this is an industry that has been using artificial intelligence way longer than most other industries just due to its nature. But you know, Glenn, can you just kind of walk us through a little bit how generative AI know over the last couple of years has, has changed the cyber security industry?

Yeah. Again another great question because it's interesting, you know, within Tenable we've been leveraging different forms of AI before generative AI really kind of took off in a number of different ways. And when, you know, chat GPT came out, everybody got super excited, even people within Tenables like why aren't we doing anything with AI? And it's like, well we have been. It's just that generative AI is more like practically applicable to more people. So like people feel it and see it more. Whereas having a machine learning model that a bunch of data scientists put together and it just outputs something, it's not really the same sort of everyday People don't get the value out of that. So from a security perspective, over the last few years, really generative AI is an efficiency tool, right? Like, whether it's cybersecurity or you work in marketing and you need to write emails to, you know, it's just, it's great to help somebody that knows what they're doing just do what they do quicker, more efficiently, more options. And that same, those same efficiencies are applied within security. So bad guys have been much more efficient in doing some of the things that they do. And it's up to us as security vendors to kind of evolve our products to be just as efficient or allow the good guys to be just as efficient to combat some of the stuff that the bad guys have been doing.

Can you even talk about the, the efficiency and maybe how that changes things for, you know, quote unquote, the good guys in cyber security? Right, because I'm, I'm guessing that there were tasks, you know, when it comes to, you know, threat assessment or detecting vulnerabilities, I'm guessing that there are tasks maybe five or 10 years ago that would take many hours that could be done now in, in minutes. So maybe could you walk us through just, just one or two examples of how generative AI is specifically making kind of this preventative cybersecurity much easier for, you know, companies like tenable.

Yeah. So a very, very basic example, if, let's say, you know, something that, you know, we do is from a tenable perspective and I, I interact with the, the laptop that you're using today, right? And all of a sudden you'll be able to see, we'd be able to tell you specifically, well, you know, you're using Chrome. I'm just making this up, right? But let's say you're using Chrome.

Hey, you got it right. You got it right.

And there's this vulnerability in Chrome that like, is exploitable. We'll give like the technical def CBE dash 2023 dash da da da. Some like, kind of generic, it's not generic name, but like just a name, very little information from a summary perspective and say, well, this is really bad because of whatever the reason might be. So now you as a good guy sit there and be like, all right, well why is it bad for me? You know, like, what does this really mean? Yeah, I have enough and I trust that tenables tell me the right information, but I don't really get. So now with generative AI, like things that we've been able to implement is when we pull all this data together from across like all the tools we have instead of just saying CVE did this, is this, it actually explains exactly what it's about and like continually looking at threat intelligence feed stuff on the Internet, things in the news. So like when you read about it it's like, oh, this ransomware group is using this vulnerability to do this, this and this. So now it's just, it educates the defender on like why they should care about it. Whereas before if they did actually go the extra step to be, you know, more educated on it, they'd have to go to the Internet, start googling stuff and just, it just takes time and they're like everybody else, everybody has way too much work to do and not enough time. So if we can just simplify how people are consuming information and just educating them, allowing them to make better informed decisions, that's, that's a great practical application of gen AI, which is what we've.

Been trying to do, you know, on the other side. Right. Because we kind of already mentioned this, but these efficiencies and the double edged sword is that yes, it obviously makes it easier for the bad guys to, you know, exploit vulnerabilities. So you know, whether it's, you know, individuals or you know, state actors, how, how are the bad guys, you know, using generative AI on the flip side to find these vulnerabilities faster.

Yeah. So there's, I mean there's a bunch of different examples, but two, like I think from a time saving efficiency, like one good example is if, let's say I wanted to, whether I was a nation state actor or just like a, you know, a group of bad guys trying to make a ransomware group, for example, and I wanted to target your business like one of the easiest things to do and this is how it really happens in the real world is I'd go to LinkedIn and start looking at different employees and start kind of looking to see who is who, like kind of what their skill sets is. And you can really infer a lot of stuff like understanding what technology people have because of certifications they use or it's just, it's like just data mining, doing reconnaissance on different targets you want to do that takes time. As you can imagine, generative AI makes it a whole lot easier to start building out and mapping out like how who is who in an organization and how like the, you can infer a lot of stuff like I said, like on technology. So now instead of taking a week or two or three or a month depending on the size of the organization and what you're trying to accomplish, you can really narrow that down to almost no time. Another easy example that's been impacting people as soon as like Gen AI really came out and started hitting the market is phishing. For, for a number of years like these anti spam and anti phishing tools have had different models to look and stop, you know, the spam getting into your inbox. Well, Gen AI makes it really easy to bypass the existing models and things that these different tools have put in place. So, you know, you've seen a lot of these from, from a vendor perspective, these tools having to implement Gen AI again to combat the sort of work that the bad guys have done to bypass those tools. So I mean those are two kind of basic examples, but it shows how generative AI has made some things obsolete from a defender perspective and just the time efficiency from like a reconnaissance and allowing skilled attackers to do reconnaissance on.

A. Glenn, I think, I think that's a great example what you said because you know, traditionally, even if you look at something as, you know, quote unquote, low level as phishing attempts, I think historically they've always been easy to spot a mile away, right? Like it was like, oh, there's a handful of them. They're all the same. They're usually poor grammar, nothing truly personalized maybe aside from, from the name. But now it's like I even have, have friends that have, you know, maybe small business owners and you know, they're, they're getting pretty sophisticated. You know, attacks that are very personalized that, that seem almost handcrafted is that, you know, even when you think of how the bad guys are using it, would you say that there's more of a threat for, you know, those like, lower levels, you know, kind of phishing attacks on small, you know, small businesses. Or would you say that generative AI, at least in terms of the bad guys using it, are going to help, you know, kind of these smaller bad guy groups become bigger and more, you know, more dangerous because of generative AI, which way do you see it going kind of on the bad guy side?

I think it's, you know, it's because attack like if you're really trying to attack something you want, you want your time to be worth something if you're the bad guy. Right. Like I think because things again are more efficient like you want, I think it's going to go more like quantity over quality. And the, the reason why I believe this, and you were kind of touching on it a Little bit is like it's funny people from a security perspective, the overwhelming majority of real attacks when they happen, whether it's to normal like everyday people, like my father in law for example, I swear to God clicks on now like gets infected every other week to like huge government organizations. 99 of the time it's because of something like phishing. Like the end user is the root cause. There's like people like always it's funny in the security industry we don't help but there's always like oh this huge vulnerability and like you're these things on sitting on the things on the Internet are obviously bad and you need to make sure you secure them. But what ends up if you see all these huge real attacks that happen 99% of the time it's by the everyday user clicking on a link and people not practicing good cyber hygiene from a user perspective that allows the bad guy to get in and then they move laterally to do something. And again it's usually through email or somebody clicking on a bad link. And what generative AI enables bad guys to do is more broadly create content that people, it's more believable. So if you know our bakery shop down the road we typically, we probably don't have the money to put in good anti phishing, you know, software and stuff like this. And maybe we only have five computers. But if I, if as a bad guy if we just blast enough stuff out, one of us clicks on that link and now we have ransomware and our five machines that we have don't work at all. Either our business stops or we have to pay some sort of ransom. So I think you're going to see more and more everyday businesses be impacted or just everyday people be impacted with just things like ransomware because the quantity over quality is a more realistic thing with gen AI and stuff like that. Yeah.

And hey, as a reminder here we have Glenn, Glenn Penley, the chief technology officer at Tenable. So if you do have any questions for Glenn, make sure to get them in. Glenn, great, great question here from Sean. So you know we're talking a lot of things, you know, at the big business level, but even personally. So Sean's asking, are there any ways to use generative AI to boost our own personal cybersecurity? Right. It's a good question, but yeah, are there any things that we can do even personally, Are you still running in circles trying to figure out how to actually grow your business with AI? Maybe your company has been tinkering with large language models for a Year or more but can't really get traction to find ROI on Gen AI. Hey, this is Jordan Wilson, host of this very podcast. Companies like Adobe, Microsoft and Nvidia have partnered with us because they trust our expertise in educating the masses around generative AI to get ahead. And some of the most innovative companies in the country hire us to help with their AI strategy and to train hundreds of their employees on how to use Gen AI. So whether you're looking for ChatGPT training for thousands or just need help building your front end AI strategy, you can partner with us too. Just like some of the biggest companies in the world do. Go to your everydayai.com partner to get in contact with our team or you can just click on the partner section of our website will help you stop running in those AI circles and help get your team ahead and build a straight path to ROI on Gene.

So I do know and I've had to do this because I wasn't just joking my father, I swear to God himself every other week a lot of the, you know, the tools that you can buy like you know, on app stores and stuff, like security tools for personal use, a lot of them are starting to implement different gen AI capabilities into their own technology. Gmail does I think a pretty good job of their anti spam and phishing stuff. I would give a recommendation when you go, whether you use Gmail or Yahoo, if people still use it or Microsoft's offering, make sure you go in and enable because a lot of times they won't enable a lot of the extra security features because people are too worried about or like the Google is more worried about you having a good experience with it and security might not be the most important thing. So whether it's your web browser, your, you know, your email client that you're using, go in and try to find the enhanced security settings and enable them because a lot of times the more and more software, you know, is leveraging gen AI and but it's not necessarily enabled by default. So that would be one recommendation. And if you're downloading like you know, software on your own personal laptop, you know, make sure you're looking to see if they, the features and functions they have included. That would be my recommendation.

You know that that actually is a great transition here to Cecilia's question. You kind of just said there, hey, be careful with downloads. So Cecilia asking, you know, could you review the top basics of good cyber hygiene? So maybe not, you know, having to, you know, rattle off a list of your top five, you know, right off the bat. But you know, maybe aside from, you know, being careful what you download, you know, you know, being a little suspicious in a good way of random emails coming in, are there maybe could you name one or two other kind of good, you know, cyber hygiene things that all of us can take into account?

Yeah, the first thing is, especially from an end user perspective, because most people overlook that. They just think of their servers like it's, you know, 1999 and like we're still getting hit with worms. Make sure that like the machines that your everyday users are using are up to date. Like the software, whether it's Chrome, it's automatically getting updated, that you're patching your machine, that like, that you don't have vulnerabilities sitting on your endpoints, that in the event that there is an attack, there's not. Like, so if somebody clicks on a phishing link, for example, with a malicious link, if there's no software to exploit the machine, like then it doesn't, it won't matter. So keeping your machine up to date from a software OS perspective is first and foremost. And two, from a user, like don't over provision users where you can, the whole zero trust concept. Don't make everybody in your organization administrators for everything because when somebody gets exploited, if everybody has the keys to the kingdom, you're done. You know, so those are the two. I mean it's easier said than done to do all those things, but if you do that, at least you're minimizing the field of fire that the bad guys can take advantage of.

Glenn, I think there's a lot of listeners on this show who maybe find themselves in the position of they work in a small or medium sized business. Maybe they're a CEO or they're a director of a large department in their company. At what point, especially with the speed now of generative AI making it easier for the bad guys to do their work, at what point do businesses need to say, all right, we're relying on our own internal Windows or Mac virus protection and these best practice phishing techniques. But at what point do they have to say, all right, we might need to bring in an expert to help us on the preventative side? Because I think once people get attacked, it's always like, oh, at that point it's too late, you know, and it's probably going to be expensive. But at what point is it, all right, hey, this is best practice personal security. We're a small team versus all right, we should be, you know, having, you know, a partner to help us on the front end prevent this.

Yeah, I mean, the, I mean in a perfect world it'd be like immediately. But the reality of the situation is, you know, money might be tight, like you have a budget, like you're trying to grow a business. Like, it's, it's easy for me to say like, oh, you should be buying our stuff, you know, yesterday, like, what's taking you so long? But the, the reality, my recommendation is based on the reality of the situation. If I, I would make some form of investment in again, regardless if we're our bakery shop or, you know, the other end of the spectrum is do the basics like, like whatever security vendor you, you go with, whether you know, tenable or you know, whoever, whatever part of preventative security. And it's, it is defensive. Death is important. It's not like, like as soon as you do preventative security, you don't have to worry about attacks because attacks will happen. So again, you have to balance things. But I, I see way too often, especially in smaller companies, people get like caught up in the hype and they'll, they'll buy like this super fancy slick sort of tool that's like, that will do you no good because you're not even doing the basics of like trying to minimize again that field of fire, like the scope of what could be attacked. So I, I, you know, as, as early as you possibly can, like do the basics, take advantage of the, the security tools that do come with like different software that you use from a business perspective. You know, Mac, Windows, like, you know, the security things that they have, like I mentioned a few, like the email clients there, in a lot of cases, there are good security things that are embedded in different software nowadays, just people don't enable it. So I at least do that. And if you do start, when it's time and again at any time, start investing in security tools from different vendors, just do the basics like get, go work with a vendor that's going to make the most impact and not something like this slick thing that you just got pitched by some random sales guy.

Yeah, exactly. I think that's important. So, so, so Glenn, we've, we, we've talked about a lot here on the show so far today. So we've talked about how generative AI is, is making it easier for the bad guys, but it's also helping, you know, the good guys, you know, to detect these vulnerabilities faster and more accurately. But you know, as we wrap up the show here, looking forward, how do you see generative AI even changing, you know, the cybersecurity industry in the years to come. Is this going to be something where, you know, threats and vulnerabilities are going to be coming even faster as the technology advances?

Well, yeah, I mean I, I think as you know, new models, new LLM, like as things evolve, that will evolve as well. I think from, I think we'll see emerging markets from a cybersecurity perspective. The need to secure as more and more companies start building out their own large language models and applying their own stuff versus just using like ChatGPT or Bard or whatever it is, the need and the desire to secure their own models because there are attacks against like actual gen AI tool like prompt injection. There's like lots of things you could do to mess with the models that people are using. So I think we'll see the emergence of more and more security tools and a desire from companies that are building out their own gen AI models to secure that. So I think that's something that we'll start seeing probably. I wouldn't be surprised with this, within this year we start seeing that and I do think like the deep fake, you know, we start dealing with like that, like I think that's, that could get really gnarly pretty soon and it's an extremely difficult problem to solve. So it'll be interesting to see how that. But between those two, I think we'll start seeing more away from text based, you know, things that have been applied with Gen AI up to this point from a security perspective to some of that.

That's a good point. Yeah, you gotta, you gotta have your like family safe word. Right? Especially as these, as these clones start, you know, coming in quick and are super, super impressive. Well this, hey, I don't know about everyone else but I learned a ton here, you know, best practices on not just personal, you know, cyber security, but even just having a better understanding now on how generative AI is being used on both sides of the field. So Glenn, thank you so much for coming on the Everyday AI show and sharing your expertise with us.

Yeah, my pleasure. Thank you for having me.

All right, and hey everyone, as a reminder, tomorrow we're going to be talking about GPT Goldmine's clever ways to cash in with OpenAI probably releasing the GPT store any hour now. This is going to be a great show. So if, if you caught something maybe on the show and you want to know more, make sure to go to your everydayai.com. we're going to be talking a lot more in depth about the conversation that we just had with Glenn Penley, the Chief Technology Officer at Tenable. So please sign up for that daily newsletter and we'll see you back tomorrow and every day with more Everyday AI. Thanks, y'.

All.

And that's a wrap for today's edition of Everyday AI. Thanks for joining us. If you enjoyed this episode, please subscribe and leave us a rating.

It helps keep us going for a.

Little more AI magic. Visit your everydayai.com and sign up to.

Our daily newsletter so you don't get left behind.

Go break some barriers and we'll see you next time.