Cybersecurity Meetup - AI and Cybersecurity

Hey everybody, welcome to this Demo Forum discussion with Matt Rosenquist. So, you know, Matt is extremely well known in the security world and it's our pleasure to be able to talk to him about various topics. Welcome, Matt.

Thank you. Pleasure to be here.

Hey, Matt, let's— I mean, the topic of the week for sure, and maybe since January, has been ChatGPT, and it's taken all of 2 months for vendors to start rolling out and at least market about their integration of ChatGPT into their tools. So I thought that would be really topical to jump into.

Sounds great. And you're right, it is a hot, hot topic. Everybody's, you know, discussing it. And, you know, you've got the marketing managers going crazy in every company out there trying to figure out how do we capitalize on this?

Right. Yeah. And it's not just capitalizing on the buzz because I'm seeing some real tools already. There's one that's under embargo right now, but they've shown me what they're doing and it's the, it's in SecOps. So, you know, we know the daily task of triaging and threat hunting, figuring out what's going on from this massive data that you get from all of your sensors and your SIEMs feeding them to you, but you've got in, you know, incoming threat intelligence from your threat intelligence feeds, and you gotta match those all up. And that's the basic of SOC operations, right? And, but the ones that are coming out are taking the feed of alerts, passing it off, you know, it's called embedding, right? So they're vectorizing the data in such a way that it can be mapped onto the large language model that is GPT, and then querying it. So that the analysts in the SOC can go, "Hey, you know, what's the implications of this IOC that we saw on our network?" And the GPT engine speaks to them. It's like asking Siri, "What is this all about?" And it comes back and says, "Well, that indicates that such and such threat group is targeting you and you should do this immediately." And I think that's definitely the first realm of applying GPT. It's totally different from every other vendor who's told you for years that they use AI. Those were, you know, algorithms, and that's different. Algorithms are great because they're very concise. They give you real results by actually using a large language model to interpret your questions. That's new.

Yeah, I would agree. And we do have to keep in mind AI, especially ML and DL, machine learning and deep learning, have been used because they are so good at taking vast amounts of data, doing the analysis, synthesizing it, and coming out with results, especially if you're trying to identify something unusual, right? Or something specific, something unique. The original kind of test platform for a lot of these AI, ML, and DL systems was, you know, find pictures of cats on the internet. You train it on a million pictures of different cats, you throw away that training, and then you unleash it, and a new picture of a cat that has never been released shows up on the internet, and it can use that— those multi-neural layers to determine, yeah, this is a cat, with a higher degree of accuracy even than a human. So AI has been in, um, security operations actually for a while, for several years. I know many vendors that use it because they are dealing with massive amounts of data and it's not clear, it's not labeled, right? You don't know if it's a threat or if it's good or if it's bad. So they use these engines. Now the secret The secret sauce that ChatGPT brings to that is doing all that analysis is great and you'll end up with, from a massive database to a massive spreadsheet of numbers and priorities and weighted values. And again, it's really ugly to look at. It's even worse to get a good summary of information or find something unique. And when you bring in generative technology, right, these AI capabilities that can understand neural language and you can just ask it, hey, what are my biggest threats today? Bam. And it gives you a few sentences that you can understand because again, the data's there, the analysis is done, it's in the spreadsheet, but you don't have time to go through 50,000 lines in a spreadsheet and all these different charts You just want to ask it a simple question and have it give a simple answer. And that really makes it much more efficient. Instead of having a crew of analysts to go through just the spreadsheet, not even do the analytics, that's done by tools, but now you have to sit down with them and they've all got a different opinion and everything else. Have a GPT or a ChatGPT type interface and a senior manager could ask the question and get their answer, and then they can use it in their, you know, super important PowerPoint presentation to their executives or whatever they need. But that can help at every level because that shortens. It shortens from the analysis point to the understanding, the relevance, you know, moment of truth. You shorten that, you make yourself more efficient, you focus more on what's important. As long as the tools and the GPT are doing their job appropriately, they need to be tuned. You get an advantage, right? Kill chain, right? You shorten the kill chain. This is exactly what ChatGPT can do for many organizations.

Absolutely. You know, this really struck home on Sunday, which was a week ago for me. And in the green room, I was telling you about, hey, I started taking lion's mane, which is a mushroom extract. And Sunday morning, I'm drinking my coffee with lion's mane in it, and I just had goosebumps because I had this great idea. I took the entire manuscript for my book, Security Yearbook, and it's got a directory of all the vendors in it from last year, mind you. So 2,800 vendors with their headcount and their growth rates. And I uploaded it to a tool called chatbase.co. 15 minutes later, I had a chatbot and I could query it about the contents of the book. And it blew my mind. It was so cool. You can ask it who's the fastest growing vendor in whatever country or something, 'cause the data's in there. It gives me the right answers, which ChatGPT won't do. But if you've embedded your content, and I can see on a massive scale, if you're embedding your threat and alert content and logs into this, it's gonna just give you the ability to understand what you already have. So much faster than traditional threat hunting.

Absolutely. And it's not just what you have now, right? ChatGPT version 3 wasn't connected to the live internet. Now we're seeing vendors, we're seeing Bing, we're seeing Google, so on and so forth. They are going to put their latest and obviously all future generations. So it's not just the input that you can give to yours. It can be a hybrid situation to say, look at my private, you know, proprietary data for special insights, but also query the world, the open internet and do a synthesis and come in. Now, there need to be checks and balances. We saw that which had GP3 and, uh, GPT-3 and 4, and we're going to see it where it gives the wrong answer. It may— it even sounds confident when it gives the wrong answer. So there need to be checks and balances. But now companies are going, okay, how can we use AI to check the AI to make sure? On and on and on. And it's a beautiful thing because it works at speed, and you can fine-tune your checking and oversight to be able to fine-tune your, your main AI system. But on the downside, it also gives a— puts more reliance on AI to check AI, and we get one more step out of the loop in truly understanding is something right, wrong, ethical, good, bad, contextual, you know, does it have that emotional quality to it, not, all those kinds of things. So there are some downsides to it. But I think, you know, as we were talking kind of in the green room, I think we're going to see two different vectors with cybersecurity, just like we saw with blockchain. And when AI came out, the marketing teams are going to go off and figure out how do I embed this in every single presentation, infographic, marketing piece out there? We're going to say we use, you know, GPT-type technologies. But then on the other side, you're gonna have the operations teams going, okay, how do we actually use this for a competitive advantage, for agility, and to keep up with the attackers? Some of them are gonna find that way. Others, it's gonna be just more marketing, right? And when it comes down to it, when those companies are queried, hey, okay, really, how do you use it? Oh, well, we use it in our marketing. We use it for SEO analysis. So you're not actually using it in your product. No, no, no, no, no. But yeah, we use it at the company. So there's going to be a lot of misdirection, right? Just as we saw with AI, everybody used to say, hey, we do AI. Okay, how many data analysts do you have? Oh, we don't have any of those, but we use AI. No, you're really not sure.

Yeah, there is one particular vendor that we won't malign here But they've been claiming AI forever and it's what they lead with. And yet you look at all of their people and there's not a single data scientist or artificial intelligence person on the team. So how did they do that? And it's because they're just using Bayesian filters as usual.

Yes.

25 years since I heard people say, oh, well, we use Bayesian. Okay, that's a statistical process. Great.

Yeah.

And I can't help but think every time I think about AI and cybersecurity, I think of Neuromancer by William Gibson. Here's a guy who invented cyberspace, essentially, just out of watching kids play video games in an arcade, and invented AIs that were attackers and defenders, and visualized them, which will be a long time before we get to see what these look like because they have 1,500 dimensions to them. But even so, he gave you that concrete Oh man, this thing is slowly going to try and break in and this other one's slowly going to try and fight back. And we're going to get to Cisco's self-defending network, which they announced in 2000 and never delivered on. Yeah, yeah.

In a perfect world, right? In a perfect world, we'll do that. And at some point, the arms race will escalate to that where if you're not using AI, you will be at such a disadvantage, you're not relevant. But that's true for any great powerful tool. At some point you either have to adopt it or you become extinct. And I think AI is one of those technologies, right? And it's— AI is not new, but we've seen big advancements in the subset of machine learning and especially deep learning in the last few years and over the last 10 years, right? Neural processing, things of that sort that has increased as well., but these tools are just going to combine and morph and start, you know, consuming other tools and adding functionality. GPT-4 is multimodal. How long did it take to go from GPT-3, which was text only, to GPT-4 that could also analyze images as well as text?

4 months, right? And it was ready last July. So it's actually negative. Yeah, they were ready to go.

Yep. It's going to be amazing how these tools expand. And if you're not up with the Joneses, you're going to be left behind.

Yeah. And I'm, you know, on two sides of vendors for sure. And there'll be new vendors that adopt the new language models and the integration with the other modes. But I also like to think about, you know, the SOC itself. You know, there are some very large well-funded, well-staffed SOCs that are gonna be all over this. They go, well, we've got data sources, we can do this ourselves. And they'll start trying to figure out how to basically start with triaging quicker, but to map the attack against either the kill chain or ATT&CK or DEFEND and see where we are in the time to catch them. It's gonna be mind-boggling.

Oh, I agree. And you know, you had mentioned new vendors. I think there is gonna be a ton. This is a new revolution, right? This is the perfect time for innovators with smart ideas who can leverage this tool. It's just a tool, right? Leverage this tool to do something new, something innovative, something faster, something more efficient. We're gonna see that cycle again that we always see in cybersecurity where those innovators are being able to use new tools and all sorts of new companies and businesses and models come out. And then shortly after that, you have the fast followers, the big companies that go in there and start sucking them up, not only to integrate into their product, but also deny their competitors the ability to integrate in their product. And we get back in that cycle. And that's, that's a good healthy cycle for the cybersecurity side because that drives our innovation and integration of innovation into our tools, processes, techniques, capabilities. But we can't forget the bad guys are doing the same thing. In fact, I would argue the bad guys are innovating ahead of the good guys. They don't have to wait for that lag. They're willing to take risks.

Yep. They're much more nimble.

You mentioned GPT-4 was ready last month. You're right, but you just, when something is ready or in beta, you just don't throw it out there. You have to test it. You have to evaluate. You don't wanna bring down things. You're worried about that. Integration is a huge cost for potential disruption. Bad guys don't care, right? They're willing to integrate. Let's try it. Let's see what happens today. Let's see what breaks. If it breaks, great, we'll fix it. If it doesn't, oh well, you know, we've got a great new tool. So we are always behind their innovation. We respond to their initiative. They have that combat initiative and they are going to seize it. Not only with ChatGPT, you know, 4, 5, whatever, but all those tools that we've been talking about, all the hybrid mixes and integrations and tools to support tools and everything else. Oh yes, we are going into the Wild West once again in cybersecurity.