Black Hat USA 2024 | Nicole Carignan

Clips
News
More from Black Hat USA 2024

Nicole Carignan

VP, Strategic Cyber AI

Darktrace

Darktrace AI: The vanguard of cyber defense based on continuous learning and advanced threat detection

Even though artificial intelligence has incredible potential to augment the current cyber workforce and expand situational awareness, comprehensive integrations are needed for enhanced visibility, as evidenced by Darktrace AI, that continuously learns daily business operations. As the speed, efficacy, sophistication and scale of cyber attacks continues to grow, Darktrace AI easily spots abnormality by boosting incident detection, cyber resilience and threat vulnerability prioritization since it continuously learns the unique digital fingerprint of a business in real time, according to Nicole Carignan (pictured), vice president of strategic cyber AI at Darktrace Holdings Ltd

play_circle_outline AI and machine learning techniques in cybersecurity

play_circle_outline Rise of deep fakes and need for machine learning detection

play_circle_outline Cyber Crime as a Service and impact of ransomware regulation

play_circle_outline Call for transparent and explainable AI models in security tools

Info
Transcript

Nicole Carignan | Darkface

Nicole Carignan

VP, Strategic Cyber AI Darktrace

At BlackHat in Las Vegas, the cybersecurity community discusses AI and machine learning techniques to combat phishing emails and deep fakes. Machine learning is emphasized for anomaly detection and reducing human intervention. Collaboration among security practitioners is crucial for comprehensive protection. Cyber Crime as a Service is evolving, with ransomware and malware services becoming more prevalent. Changes in government policies on ransom payments may impact financially motivated threat actors. Mental health and stress management techniques are vital... Read more

explore Keep Exploring

What is the current focus and theme surrounding AI in the field of technology and security? add

What is the importance of the security community adopting machine learning techniques to identify deepfakes? add

How are countries regulating the payment of ransoms and how might this impact financially motivated threat actors? add

What steps can be taken to ensure safe and secure adoption of AI within security tools, specifically in terms of transparency and explainability of machine learning models being used? add

bolt Powered by CUBE AI

Nicole Carignan | Darkface

>> Good afternoon, cybersecurity community, and welcome back to BlackHat. We're here in sizzling Las Vegas, and it has been quite the hot week for security, as well as with temps over 110. My name's Savannah Peterson, you're watching theCUBE. Super excited for this segment. I made sure this segment happened personally. Please welcome back to the show, Nicole. You are the best. We had so much fun at Women in Data Science in March. I had to make sure... I was actually on International Women's Day too. I had to make sure we had the opportunity to sit down. How's the show going for you so far?

>> Oh my gosh, absolutely wonderful, and thank you for having me. You are always my favorite to talk with. I was looking forward to this as well. It's a highlight. But it's been such a cool event already. Obviously AI continues to be a hot topic, which is great for my career. There's a lot of education around the different types of machine learning techniques, the right appropriate use cases for those to really drive responsible adoption of AI, really through transparency, explainability, control and privacy. So a lot of that has been to innovate with speed, but with responsibility specifically for the security community, really just being integrated throughout the entire process. So that's been the huge theme. Had great also interactions with other incredible executive leaders here who are bringing forth very innovative ways of combining multiple different machine learning techniques to achieve their objectives.

>> It's exciting. You also were one of the big esteemed talks yesterday.

>> I was.

>> Give us the overview of what you discussed.

>> Thank you.

>> And maybe a little controversy, I know that came up.

>> It was an honor. I got to speak at the AI Summit here at Black Hat, and it was incredible just the deck of people who were speaking at that event. Including Dr. Fisher from DARPA, who I am completely fan girling about her and what all the research and innovation they've been doing at DARPA.

>> She is brilliant.

>> Yes. Oh my goodness.

>> Wildly brilliant.

>> Definitely a highlight. And then, yeah, so my talk was based on really breaking down the various types of machine learning techniques that are really facilitating innovation of threat actors. And last year it really predominantly hit the inbox. So Generative AI gave them the ability to make much more sophisticated phishing emails that were targeted in new languages that they weren't able to target before with-

>> I think you told me it was up 128% or something.

>> Yes.

>> In just those last few months.

>> Yeah. And now we saw in the first six months of this year, over 17 million phishing emails across our customer fleet. And I want to say, 33% of them had very sophisticated social engineering, to include multiple types of phishing that go well beyond the inbox now. So like Teams phishing, Dropbox phishing, QR phishing.

>> Text messages.

>> Yes. And then if you want to talk about how that implies to deep fakes, and really how that's hitting-

>> A big deal right now.

>> The social engineering of market manipulation, initial access, compromise and so forth. I think what we're seeing with deep fakes is exactly what we saw with the inbox of last year, and recognizing that humans cannot be the last line of defense. That we really need to facilitate the use of targeted machine learning techniques that could be accomplished at detecting that anomalous behavior. There are RNNs and CNNs, neural networks that can be trained on pattern recognition of facial signal and biological signal, that could help facilitate the detection of deep fakes. And that was where a little bit of the controversy came on, there was a differing of opinions of speakers in this engagement. But I think the call to action of our security community to be quick to adopt these machine learning techniques to facilitate, to not rely on the humans to be able to spot a deepfake. Because NIH just came out with a study where even when humans were told there would be deepfake imagery, they only had about a 50% accuracy of being able to say something was real or fake. So there's a psychological impact.

>> And that's only going to get harder.

>> Yes. And we can't rely on humans to be that defense. Vet and verify is always key and critical, but in addition to that, we need to augment them with machine learning techniques and detection.

>> Oh, it's going to be absolutely critical. Here we are in an election cycle.

>> Yes.

>> We're already seeing it. And not just from a political perspective, but artists getting impersonated, lots of different deep fakes. How can companies try and be offensive about their risk analysis in that arena? What do we do to protect ourselves?

>> That is a great question. I think there's an element of our infrastructure, and our data, and our identities have become distributed with the way our digital environments are. And so there is an assumed level of risk of breach essentially. So it's really facilitating cyber resiliency, threat vulnerability prioritization, mitigation, and really reducing that amount of risk or damage that could be occurred. And so we look at that as we already have an incredible unsupervised machine learning engine, that understands the entire digital estate across multiple domains. Why not take that same valuable intelligence, shift left, think proactively. And we use graph theory with infection based modeling to understand which assets are the most exposed, or vulnerable, damaging, or critical, and prioritizing that to nest hardening mitigations. As well as performing incident readiness, tabletop exercises simulated onto your environment, testing those tech people processes of the actual response event. And I think using the right machine learning techniques to facilitate this better intelligence, to drive really what is the prioritized actions that could actually have a reduction of risk, and that could actually reduce the amount of damage on an incident, I think are key and critical. We saw this with the IBM data report that just came out.

>> 100%. I think you actually just brought up a really great point, is it's not just knowing what's there, but knowing what legitimately will reduce the risk of that happening versus just the variety of different actions you could take. Because there's a lot going on. And your visibility, and awareness and battle against risk has to be so comprehensive now.

>> Yes. And now we're expecting security practitioners to be experts in machine learning, which is hard in and of itself. And so it's a lot of community knowledge sharing to facilitate what are the best approaches to securing the use of AI by design, NCSE and CISIS guidance, NIST AI risk management framework that helps with the testing, evaluation, validation verification. And then we're working on facilitating better data sharing of data integrity. But as I work with other vendors and other security product companies, I think it's imperative that we all work very well together. Because we're taking very different machine learning approaches, and we have very specific use cases that we're very accurate and good at. And having those comprehensive integrations gives defenders complete visibility across their different domains, and their tech stack and their security stack. And that overlap provides for better detection. We had a great example of this. So Palo Alto's CVE hit late March this year. Right before that we had two customers who are observing anomalous activity on their Palo Alto firewalls. Because we had such a great technical integration with them-

>> Ooh, that's exciting.

>> We were able to see that. And so we had won in the public sector where it was making curl and W get requests to anomalous IPs to download shell scripts. And we had one customer who actually went to Palo Alto and was like, "Hey, what's going on here?" And so this is all pre-CVE disclosure. Now granted, the post-CVE disclosure or it was a madhouse of activity.

>> .

>> But it was very much more targeted and specific. And I think that we really work well together when we have those strong technical integrations partnerships. And so I think that's a theme too as we move forward, is it's not just a one and done. We have to all work well.

>> And I think it's not just the private companies or startups, it's also governments and different agencies across the world. The UK-based company, Dark Trace, navigating conversations with government. I have to say, the more and more I get into cybersecurity, I'm very impressed by the level of collaboration. As much as there's healthy competition, obviously between certain solutions, there really is this awareness that we're all stronger together. And if we share insights, or defensive tactics to de-risk things that we live not just better business lives, but better human lives, so because all of our data isn't getting messed with. How much of your day is spent collaborating with people on these solutions?

>> In my particular role, I have the opportunity to work with all of the organizations within Dark Trace, and that also means all of our customers, and our partners and our technical partners. And so I feel like I get a really cool job where I get to actually hear this feedback, and ensure that we're building out these tight relationships. It's also too, and I noticed a trend yesterday at AI Summit. I was not the only former government speaker there. Most of them were former government speakers.

>> Really?

>> And all of us are now in industry, and we're still fighting the cyber war mission.

>> Interesting.

>> But we're doing it with trying to provide technological solutions that could augment the human experience as a defender or in the SOC. And it was really cool. Because I was like, I think this might be the reason why there's this chasm of really working together, is because at one point most of these executive leaders, we all did work together. And now we're in private industry, and trying to just facilitate all of this incredible knowledge, as well as building out great technical products so that we can help protect the masses.

>> Like you said, it's hacker summer camp.

>> Yeah, it is hacker summer camp.

>> You're hanging out with all your friends.

>> Favorite time of the year.

>> I love that. It's such a nice way to think about it. You just released a new threat report, Cyber Crime as a Service continues to explode.

>> Yes.

>> What are you seeing there?

>> Oh my goodness. Third year in a row, Cyber Crime as a Service. So Ransomware as a Service, Malware as a Service was the highest. And we're starting to see this global shift across different countries, where they're starting to regulate whether or not you can pay ransoms anymore. So if this is going to drastically impact the economic ecosystem for financially motivated threat actors.

>> It's combating threat with policy, essentially.

>> Yes. Yeah.

>> That's really interesting.

>> But if you're taking away this revenue stream for financially motivated threat actor groups who essentially operate as a corporation, they're going to look to diversify the revenue streams. And so Malware as a Service, Ransomware as a Service, and now we're seeing AI as a Service, having the ability to pay subscription-based interfaces for jail broken large language model interfaces that could facilitate malware script generation

>> Yeah. Pretty much.

>> This is just additional streams of revenue that might help facilitate that some countries are going to take away the right to pay ransom.

>> That's a really interesting conversation. I won't throw my friend under the bus, but I was having a conversation this morning with a company who had a ransomware issue. And they decided that the data that had been compromised wasn't worth the $25 million, so they just let it get released on the dark web. And that trade off, I thought, oh my God, that's wild. Just to knowingly let that happen. But it is a trade-off, or in this case illegal for them to comply with the nefarious asks of these bad actors.

>> And in the US, we have strong restrictions on our government to be able to advise whether or not they can, or should or should not pay ransoms. But it's different in other countries.

>> Totally.

>> And so you're going to see a very shift and change in the financially motivated threat actor group landscape probably in the next 12 to 24 months as a result.

>> Oh yeah. I feel like, and I'm curious because you've been in this space for a long time, this feels like one of the hottest moments in cyber security ever. Conversation is buzzing, and it's not just AI driven. I feel like users care more about their data now than ever. We have more data now than ever. So it matters. Are you experiencing that as well?

>> I think so too. And I think it's also too because as we see, especially COVID had such an impact on job markets across globally. But cyber is continuously always looking for additional skilled. So it's always been, even since then, has still been a booming market. Now you're thinking about security practitioners just they can't just know cloud, they can't just know endpoint. They can't just know network. They can't just know AI. And so the need to cross skill, and build up that additional education and expertise is critical. So it's just like we're enveloping in all these other industries to like, "Hey, come to security because this is where we all need it."

>> That's actually a really good point though. We were talking to MK who is a part of Cyber City. He's the president there and the way that they're trying to bring in folks who aren't traditionally data scientists, for example, or cybersecurity experts. And I do think that's really interesting because it does take that diversity of thought to solve all these problems. It's a lot of fun. When we had you on last time, I always love having you on because we can go anywhere with our conversation. We talked a lot about what it takes to be an ally, having a National Women's Day, I know diversity is something we're passionate about. Cube team very passionate about that as well. I'm curious because you mentioned when you walked in this morning that you went to meditation today that was a part of this experience. And just from even sitting here this week interviewing all y'all, cybersecurity professionals are some of the most passionate people in technology. You have to be passionate to get up every day and fight the good fight, I think. What's your mental health advice? How do you stay sane? Every time I talk to you, you always seem so lovely and calm. So whatever you're doing, we should all be doing.

>> I think how I stay sane is, I love the intellectual stimulation of the cross section of these three different domains. So machine learning, data science and security. And so I look at it as if I'm learning every day, if I get to learn from others in a conversation, I think I told you I might have the chance to meet one of the great researchers in AML this afternoon.

>> Which I love.

>> I'm constantly learning, shout out to Harriet Hacks. I find that it is so rewarding, and it's so helpful to also then take all of that shared community knowledge to facilitate better solutions for some of the problems we're facing. But the nonprofit organization today that was hosting the meditation for Black Hat, Mind Over Cyber, they were really talking about how to dispel the belief of meditation needs to be done a specific way. And that it can actually be done through breathing, especially to handle the stress of 18 hour defensive response scenarios.

>> Right. Heart rate up here the whole time.

>> And so they actually take practices from what the Navy SEALs do with their breathing exercises, that you can just do that wherever you're sitting, take 2, 3, 5 minutes just to center a little bit so that you actually have the cognitive load to be able to facilitate hard data-driven decision-making. Otherwise, your decision-making will continue to dwindle and not be as effective.

>> Oh, yeah. And if the Navy SEALs are doing it in their battles, it's the same trenches though. Slightly different form factor, but very similar sense of anxiety and pressure and desire to perform, and take care of your country or your people. Yeah, I love how hungry your mind is. You're like me. I feed on learning, and it totally energizes me if I feel those synapses connecting. And it's why it's always such a blast to talk to you. Okay, one more question for you. I know I asked you this back in March as well, but we haven't been at a security conference together. So next time we're discussing your next threat report, let's just call it actually six months. Because I feel like I'm saying it a bit more frequently now. What do you hope to be able to say in six months that we can't say today?

>> Oh, a big theme of an AI conference last month, so not security, AI, was across multiple industries, a lack of adoption because they aren't able to productize the intelligence from machine learning models, because there wasn't the accuracy level that they were hoping for. And so if we want to talk about the safe and secure adoption, specifically the adoption of AI within security tools, I would like to see across the next six months, most of the security vendors or AI products to be that transparent and explainable to say, "Hey, this is the machine learning models that we use." If we're able to provide confidence elicitation as to how confident we are about this output. Any type of explainability as to the feature importance or the models that cause the alerts, to facilitate the autonomous operationalization of that intelligence. That way as defenders, because adversaries have these incredible tools that they don't have to trust. They can have package hallucinations in their scripts, and not care about vulnerabilities and get that productivity gain. As they're really ramping up and innovating, we have to be able to do that. But of course, we have to do that safely and securely. So that comes with understanding the output of these machine learning products. And so I'm hoping across the industry, everyone's going to start adopting that more, and we can facilitate the SOC to be able to operationalize their experience, and augment them so that we reduce the cognitive load at SOC level one.

>> And increase confidence too.

>> Yes, because they have more data that that's accurate. That could facilitate what they need to have eyes on, how do they prioritize their actions, and so forth.

>> I love that. Well, I look forward to us hopefully being able to discuss that in six months. And Nicole, thank you so much. Really appreciate you squeezing us in this week. I know you are the belle of the ball here at Hackers Summer Camp.

>> Oh my goodness. Again, this is a highlight for me, so I appreciate you having me on.

>> We love the Dark Trace family, and thank you to Madeline your handler, for making sure you got here safely.

>> She's the best. I would not function without her.

>> We all have the people who make it possible for us, in these chairs. That goes for you boys too, right there. I thank all of you for tuning in, fabulous CUBE Community. We're here at Black Hat in Las Vegas, Nevada. My name's Savannah Peterson. You're watching the Cube, the leading source for cyber security news.