Black Hat USA 2024 | Zeus Karravala | ZK Research

theCUBE.net

Clips
News
More from Black Hat USA 2024

Zeus Kerravala

Founder & Principal Analyst

ZK Research

Three insights you might have missed from Black Hat USA

The growing threat of cybersecurity attacks along the increasingly complex AI landscape reflects one reason Black Hat USA 2024 is one of the biggest cybersecurity conferences of the year.With 17.8 million phishing emails in the last six months — 62% of which bypassed existing domain barriers — it’s easy to see why robust, versatile cybersecurity and risk management solutions are more crucial than ever.“I think the next five years, and then the next 10 to 20, will be a reset for security,” said John Furrier, executive analyst at theCUBE Research. He added that generative AI could be an opportunity to solve data security problems at scale

Transforming cybersecurity: The crucial role of AI and data management

The cybersecurity industry is experiencing a transformative phase driven by the rapid adoption of artificial intelligence and the escalating need for stronger data security.As organizations navigate the complexities of integrating AI into operations, the focus is on ensuring that these powerful tools are secure from the ground up. The industry’s practitioners are emphasizing the necessity of protecting critical infrastructure and data to maintain operational resilience and counteract the evolving threats posed by cyber adversaries

play_circle_outline Challenges of AI adoption, data security, and AI for security discussed.

play_circle_outline Need for security to be integrated from day one in infrastructure builds.

play_circle_outline The Growing Threat: AI Breaches, Deepfake Technology, and the Vital Role of Endpoint Security

Info
Transcript

Zeus Karravala | ZK Research

Zeus Kerravala

Founder & Principal Analyst ZK Research

Las Vegas, Nevada is hosting Black Hat, the largest cybersecurity conference globally. The focus is on technical discussions, AI, data security, and the need for resilience in infrastructure. The importance of security in AI adoption is emphasized, as well as the challenges of managing multiple security platforms and vendors. The need for better data portability and interoperability among vendors is highlighted. The conversation also touches on the potential for unexpected developments in the industry, such as data freedom and potential AI breaches. The impor... Read more

explore Keep Exploring

What is the biggest hindrance to AI today? add

What caution does the speaker have for the industry in terms of security and the implementation of AI technology? add

What are some potential implications and consequences of breaches in cybersecurity on individuals and society as a whole? add

bolt Powered by CUBE AI

Zeus Karravala | ZK Research

search

>> Good evening, Cube Fam and welcome back to Las Vegas, Nevada. It is quite a sizzler this week, and it's not just because the temps are over 100. We are here at Black Hat, the largest cybersecurity conference in the world. Our guests have just been action-packed. Super excited to break it all down for you in our closing analyst segment. My name's Savannah Peterson, joined here with John Furrier and one of our favorite VIP Cube guests, Zeus, how are you doing, man?

Zeus Kerravala

>> Great. And it is the temperature outside that's making it sizzle. It is hot out there.

>> Turn the AC on. I'd say turn the heat lamps off.

>> Yeah, I know the inferno here, it's real. Zeus, you've been coming to this show for a while. You've got legs and depth in cybersecurity. What does this show mean every year?

Zeus Kerravala

>> Well, the thing I like about the show is its more a practitioner show. When you go to RSA, it's turned largely into marketing event, there's a lot of vendors talking to vendors. Black Hat's got a lot of security pros here to learn about how to protect their companies, what's the latest and greatest coming? Most of the keynotes are very technically focused as well. So to me, this is the security show for security people, where again, you can look at some of the other ones as maybe more the security show for marketing people.

>> I think that's actually a really a unique lens, and I think it's reflected in the community as well as in the guests. Even the vibe, it's cas, it's integrated, it's collaborative, I think it's cool.

Zeus Kerravala

>> Yeah, the people I've talked to are very excited to be here. I mean, late last month, we had a couple of events happen that raised the bar on cyber-

>> I don't know what you're talking about....

Zeus Kerravala

>> resiliency and digital security and things like that. So in fact, that couldn't have been better planned. They have people come out here and now I take another look at things. And for once while AI will be the lead, I guess, digital resilience and cyber resilience is right up there now. And I think the thing we have with CrowdStrike just gave that another shot in the arm, and it's some that I think that we'd forgotten abour. You have to be resilient in your infrastructure in order to protect yourself and be up and running all the time. All this AI stuff is great, but if your infrastructure's not up and running and ready, none of that AI stuff does you any good.

>> Well, and the adoption of AI, which we're seeing ubiquitously across the market, means that there's that same tool in the hands of nefarious actors, which changes the whole ballgame.

Zeus Kerravala

>> Yeah. Well, the other side of that too is AI is all data-driven, and so now if you don't have access to your data, then you can't run your AI algorithms and more and more companies... In fact, the biggest hindrance to AI today is what to do with data. About a year ago, I think companies were trying to consolidate their data into one big database or data lake somewhere, then they realize, "Well, that's not really practical. I can't keep copying my data moving it everywhere, so can we keep it at rest and then be able to apply AI to that?" I think the answer's somewhere the middle, but to me that's been the biggest barrier. But if I leave too much data in too many places, now I got to think about how to protect them. And it's interesting that when you look at all the AI for whatever: networking, collab, whatever that you've seen, AI for security has been out there, but there hasn't been a lot of talk about security for AI, how I secure my data, how I secure my AI. And I think that in some ways that's been a bit of a missing piece because I think it's hard to do and nobody's really figured out how to do that yet, although there's a lot of startups trying to do that.

>> Well, I think that's a really great point, and I think the last two years have changed the need for that solution to arise and the velocity at which we deliver those solutions.

Zeus Kerravala

>> Well, once we roll it into production, certainly. And I think right now we're still on a big kicking the tires phase with AI. If you just look at the ecosystem of who winning, people are buying lots and lots of GPU enabled servers. But the rest of the ecosystem: network, the storage, things like that have lagged behind, and to me, they're trialing things, but they're not building out their full AI stacks yet. But once they do that, then security has to come. And one of the cautions I think I have for the industry is when you think of security, typically the security of stuff comes up a couple of years after the stuff. We roll out IoT and then go, "Oh, I got to secure this." We're rolling mobile devices, and we go, "Oh, I got to secure this."

>> Oh, Edge is a liability.

Zeus Kerravala

>> Yeah.

>> Yeah.

Zeus Kerravala

>> Yeah, but I think with AI, I don't think you can afford that lag. I think that's got to be part of that deployment. And so I do think you'll see that be a big part of the show here.

>> Oh, it's been a big part of our conversations here today. And the attention to your earlier points, Zeus, because of the CrowdStrike incident, there's been all eyes on cybersecurity now all of a sudden, because so many people were impacted. I mean there were millions of people bricked, and that's an insane experience for everybody. So I almost feel that this show is timed at a really unique market moment for us to be able to have these conversations. And those conversations are now more relevant than ever, not just to the CISO or the decision maker in the organization, but to these dev teams, to the end user, to everyone who's involved, which is super cool. John, who is your favorite guest so far today? We've had some bangers.

>> Well, first, I want to counter what Zeus just said about RSA. I don't think RSA is just a marketing show. I think they do a lot of business conversations, more business transformation, and it is bigger. So it becomes a marketing show, which is why we like it. But it has got a businessman. This show, you're right, I mean I would agree. This is technical, but it's also CISOs are here too with their teams. And what I like about this show is that it's not as posturing as the business side because the business side, they talk about different issues.

>> I think that's .

>> How do you budget? What's the business transformation journey? All that stuff they talk about. But here like you pointed out, it's authentically technical, and they're talking about real things, like red team, blue teams, how do we do it? What does cyber resilience look like? We had the NYSE business CISO on. And so those are much meatier conversations and it doesn't get the fanfare in the broader market, but it does here. And I think my favorite conversation here is the focus on the product sprawl, the consolidation conversation around that debate. And then two, what we're seeing with the data platform we just had in SuperStudio, we've been tracking that, Zeus, you commented many times on theCUBE, we are seeing first time in my life a significant, from a scope standpoint, comprehensive re-engineering of the enterprise platform. And I haven't seen this kind of level of attitude, conversations and thinking around this since it was going the other way from mainframes into-

>> That's a solid transformation.

>> And it's not an easy thing to do. It's like it's not IT as a department or the classic, "They're the business." It is absolute end-to-end infrastructure, like plumbing and concrete. So I think this has never happened before, I've seen. So I think security has to be baked in from day one. So this industry is not only fighting the threats and then dealing the resilience. They got to actually zoom out and go, "Okay, how do I build out an infrastructure? So platform engineering's in there, you got physical security, you got data security." I mean right now there's 13 categories just in InfoSec. I mean that's just the categories of siloed solutions. So I think the solution sprawl, the number of vendors, that has to be addressed, either gets vaporized or gets abstracted away with another layer. So again, that's kind of fun.

Zeus Kerravala

>> The data you brought up in the last segment too about companies expanding their security footprint, which is counter consolidation. Both can be true. And I think it's how you think about it. When you think about how consolidation occurs in security, you commoditize the legacy or the commodity. So if you think about what a next-gen firewall is, it's a bunch of standardized things, IPS firewall, things like that that have been standardized into one box, consolidated into one box. SSE Consolidate and SWIG and CASB and ZTNA and things like that. But I think to your point, our infrastructure has gotten so much more broad, the attack surface has gotten so much bigger, that all these new areas that we're adding on aren't ready for consolidation yet. And so I think we are simultaneously seeing people consolidate through the use of SSE, but also in XDR, but then also expanding their security footprint for things like AI security and reputation protection like one of your guests talked about, things like that. So there's a bunch of new security categories coming as well.

>> It's interesting too, Savannah, we had Ryan Hebert from ICE who oversees all the security, the trend to building their own build versus buy. So if you look at, say, application security, you mentioned firewalls, endpoint, you got endpoint, applications, they're all kind of blending. So his view is, we're going to vertically integrate on site and look for best of breed specific vendors, versus people jumping around, "I can do all three of things for you." That's interesting, Zeus. And again, I don't know how that plays out because... I just don't know. Every infrastructure is different, it's not like you can just say-

Zeus Kerravala

>> Yeah, the tech goes through waves though. As you mentioned, we add mainframes, then we moved in this big open system area, then we consolidate it down to platforms. You think about things like all the big enterprise apps at one time: SAP, Oracle, they were all these vertically integrated stacks. Then companies go, "I don't want to buy a vertically integrated stack. I want this open." Then they realize they can't put this stuff together. And so you look at the AI stacks, you're now be more vertically integrated. They'll come a period of time when we have better best practices and we'll want take that and break that out again. And then we'll re-consolidate.

>> Question is, do they buy a vertically integrated stack or they build their own and they're a vendor to themselves? I mean, it's interesting. I'm not sure how that's going to play out. Not everyone can build their own.

>> It's kind of like we've got Dell's AI factory. You see a lot of companies trying to come with that full solution to be that AI partner, whether it's full stack. Consulting side too.

Zeus Kerravala

>> I think the leading companies where tech really is that difference, like the New York Stock Exchange, they're going to build their own. For most companies though, they want to take all that tweaking and tuning time out of it. You build these vertically integrated systems. Remember even with computer infrastructure, the early days of VCE, companies would say it would save months and months of time, but then eventually we got good at it and then we could take it and disaggregate it. So we love this pendulum of disaggregate and then reintegrate.

>> And meanwhile, the threats are coming in all the time.

>> Never been faster, at a greater velocity.

Zeus Kerravala

>> That security consolidation will happen again, it'll just be... Now where the industry's being challenged is, while I mentioned, I think NG Firewall, XDR, cloud security, those are all separate platforms. Companies aren't going to one vendor for all of those, or very rare they do. And so now you're having to manage multiple platforms and multiple vendors, and that creates a problem I think that security pros haven't had before.

>> One of the things, Savannah, I always kind of keep in the back of my head is when you have these waves, there's always something that no one's talking about that comes out of left field or something people think is either stupid or irrelevant and becomes a thing. And every single inflection point is always that moment. Even the web was laughed at in early days. And if you think about the role of silicon and coding down closer to the silicon, more kernel developers have been talking about that on theCUBE recently. And then with all this data trained, you mentioned it earlier, the data modeling layer, I think data will force some new things that we don't yet know. And this is what I keep my eye out for. And Zeus, I'd love to get your thoughts on the things that could be out of left field that could change the game. And that's something that you're starting to see the signs, that it's boiling up, the open data formats. You're seeing the cataloging, data being separated from databases and more in the catalogs to let data be free. We had Bruno on former founder of Sumo Logic, now he's got Bedrock security. He had a great interview on this place. So I think there's some stuff evolving from that's coming in from the GenAI, whether it's transformer technology or how it treats data Neural nets and using all kinds of techniques to get better recommendation engines. "Hey, don't push that update CrowdStrike, don't hit the button." You don't know.

>> If they could pull that one back.

>> I mean, this is the thing. Is there in your mind some left field things that could happen, coming out of left field?

Zeus Kerravala

>> Well, I guess if they're in my mind, they probably wouldn't be left field, but yeah.

>> That would seem crazy today that would kind of change the color of the industry.

Zeus Kerravala

>> Yeah, I do think when you look at what happened with CrowdStrike, and all the VMware customers are thinking now because of Broadcom locking them down, this whole concept of data freedom, is there a way to unlock my data from the underlying platforms that they've been locked into for so long? I remember talking to Dave Vellante about this VMWorld last year that the cost of moving off of VMWorld is so high that Broadcom can do whatever they want from a licensing perspective if they're locked in. So what if there was a way to actually create better data portability? And so if I want to move from VMware to AHV or something like that, Nutanix, I can do that. Or even if you look at a lot of the Slack and Microsoft Teams tools, people say they can't move off because their data's locked in. And so I think the data freedom is a space to watch and how we were able to actually create better portability. The CrowdStrike example is great. I bet you Delta would've loved to be able to take their data, move it somewhere else to a different platform, right?

>> Especially like that.

Zeus Kerravala

>> Yeah. Because we tie ourselves into these single vendor solutions so much and leave ourselves with no options if something like that happens. Then you see, Delta reported 500 million on losses or something like that? That's crazy.

>> And that's immediate loss. That's not even brand .

Zeus Kerravala

>> In fact, I think that's where... They lost my golf clubs by the way, so I was pretty upset about that. But let's listen to this.

>> Geez Delta, get it together.

Zeus Kerravala

>> But this is where I think customers should be demanding that the vendors provide some path out from their platform if they want to move. If you really think your product's the best, give your customers the option to move off it instead of locking them in.

>> All right.

>> I think that's a really good point though. And one of the things that was really interesting that Ryan brought up, as Andrew on our production team had a great question as he was exiting the room today, was how do these companies work together? How do you bring two groups together or all these different bodies? And he brought up something that was cool. He said, "It doesn't matter if we're direct competitors in cybersecurity, we all talk to each other because we've all got to figure out how to handle some of these solutions." And I think that's really compelling. That's kind of the opposite of, say, Silicon Valley behind closed doors' whisper, whisper culture. It's much more a build in public, solve in public and make not just our companies or our customers more secure, but even per our conversation we were having with Sharad at Microsoft earlier today, make our nation more secure, make our national secrets more secure.

Zeus Kerravala

>> Well, that's the lip service from the vendors, and I hope they're doing that.

>> Yeah.

Zeus Kerravala

>> And I think it is necessary because the bad guys all share info and it's a little bit of fight fire with fire. So if you've got every threat actor out there willing to share information, and you've got all the vendors keeping all their stuff proprietary and to themselves, it's a losing battle. Especially now with AI being used, the quality of data and the size of your data set matters. And so I do hope the vendors take that to heart and they actually do that, and they're not just giving out... I do think there should be a better standardization even and things like that. You look at... We talked this a little bit with this RSA, this whole concept of vendors reporting their own vulnerabilities. Some do it, some better than others. Well, why isn't that all standardized? Why is it up to customers to report things to the vendors? Some like it, some don't.

>> So I have some insight there, and I can't reveal my sources, but a little birdie told me this week that the National Institute of Standards and Testing is about to drop very new guidelines that are more intense than RSA's guidelines and a lot of things to do precisely that, and to get folks on the same page particularly at the federal level and across some of these larger enterprises and monoliths that operate in our space. So I think you're spot on there, and I think we're quite literally going to be talking about this next week or the week after and how it affects the market. So we'll have to have you on the show.

Zeus Kerravala

>> Yeah. Well, to me, that's a necessary part of it. I know the media loves to pick on the vendors, the big vendors that report a lot of vulnerabilities. As a practitioner, I would much rather see that than the other way where they're not reporting.

>> Well, it's like getting your blood work done. You want to know what you need to work on, and you want to have awareness of that. Not when you're in a moment of crisis having a CrowdStrike meltdown, but you're having a proper just day-to-day. How can we be more mindful of this and lower our cholesterol or our collective digital risk?

Zeus Kerravala

>> But if they do share data and they are more interoperable, then you have more eyes looking at those things. And perhaps you could have one vendor helping another vendor out, right?

>> A hundred percent.

Zeus Kerravala

>> And you don't see that very often today. And it is very competitive out there, but I think the security industry is one where everyone needs to win in order for it to work.

>> Yes. One of my classic questions for guests is, what do you hope you can say this time next year when we're back sitting here? And something that I really loved coming out of the RMS team earlier, Nadir there this afternoon, was saying he hopes that nothing horrible happens in this industry, some huge AI hack or breach or something that goes down that then lowers the water level of the whole industry because of its severity. And I thought that was a really astute situation, basically saying hopefully we all continue to rise together, the water level rises up, versus kind of this collective downward spiral. I thought that was a really interesting insight.

>> That's the key message I've been hearing is bring order to the chaos, but enhance the security outcomes so that it doesn't fail.

Zeus Kerravala

>> Yeah. I'm actually surprised we haven't had a big AI breach yet.

>> I agree with that.

Zeus Kerravala

>> And probably because most companies haven't rolled this into production.

>> I think it's still R&D. I think that's kind of the-

Zeus Kerravala

>> But I'm expecting one sometime. And even all the deepfake videos and voice calls you're seeing today are getting so much easier to do. To me, that even brings in the play of the role of the PC. It was the HPCI PC event, and they had a number of security vendors there showing all the threat mitigation you can do on the local PC instead of having to go to the cloud back. So you think about the distributed nature of security, cloud network and endpoint, endpoint is going to play a much bigger role here. But all that has to work together. Just because you find a breach on an endpoint doesn't necessarily mean that's where it emanated from. So I think if the ecosystem doesn't work together, it leaves these big gaps, and that's how companies get breached and how threats move laterally.

>> And that's how customers and humans on this planet are very negatively impacted by this, whether it's everything from a flight delay to not having your medical records available when you need them because you're about to go into surgery. I mean, it touches every aspect of our lives.

Zeus Kerravala

>> It does, yeah, more than most people I think realize.

>> Exactly. Well, and I think that's actually why the event of CSHIO was such a moment. I mean, I've got friends in the US Army, for example, who were bricked as a result. And I'm thinking, "Wait a minute, the military is inoperable right now." I mean, it makes sense obviously when you think about it, but it is interesting from a systemic perspective just how vulnerable we as, not just companies, as a society are. And I think that's why our conversations this week are so relevant and so interesting. I'm having a little more fun than I expected this week. I'm not going to lie. It's great.

Zeus Kerravala

>> And I think the data that I saw was the number of affected computers is 8% of the Microsoft overall base, right? So that was just 8%, right?

>> It got bigger.

>> I didn't know that. Wow. I mean, you can only imagine.

>> I don't know what it was worth, but it was 8%.

Zeus Kerravala

>> It seemed massive.

>> Right. Well, everyone who was impacted was talking. So it becomes a pretty big share of voice moment when you have a chaos like that. What an awesome week, guys. I know. This has just been a great week. Zeus, it's always a blast to have you on the show. Our segments always fly by. You're a wonderful perspective to have, and I look forward to continuing to have fun with you.

Zeus Kerravala

>> Always love being on theCUBE.

>> Yeah. And John, what a great day. Thanks for bringing me out here.

>> And we get tomorrow too.

Zeus Kerravala

>> Big day tomorrow.

>> I know. Big day, power-packed lineup. So many guests, every segment's booked. It's going to be awesome folks. And thank all of you for tuning in wherever you might be on this beautiful rock. We're in fabulous Las Vegas Nevada here at Black Hat. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.