mWise Conference 2024 | Peter Bailey | Google Cloud & Steph Hay | Google

theCUBE.net

Clips
News
More from mWise Conference 2024

Peter Bailey

VP/GM SecOps

Google Cloud Security

Steph Hay

Senior Director, Gemini Product + UX

Google Cloud Security

From automation to collaboration: AI in cybersecurity accelerates the future of security operations

As artificial intelligence continues to mature and cyber threats evolve in both sophistication and scale, AI in cybersecurity is emerging as a game-changing technology that is reshaping how organizations defend their digital environments.Beyond traditional defense mechanisms, AI is driving efficiency by automating complex workflows, reducing human labor and enhancing the speed of threat detection and response. As businesses increasingly rely on distributed computing, AI’s ability to scale security operations is becoming critical to ensuring resilient and proactive defense strategies

play_circle_outline Importance of expertise and automation in security operations

play_circle_outline Strategic Threat Prioritization in Business: Future AI Recommendations Revolutionizing Decision-Making

play_circle_outline Transformation of security operations with AI agents

play_circle_outline Over-hyped fear around autonomy of AI

play_circle_outline Top Security Risks for AI and Importance of Securing Platforms for Practitioners

Info
Transcript

Peter Bailey | Google Cloud & Steph Hay | Google

Peter Bailey

VP/GM SecOps Google Cloud Security

Steph Hay

Senior Director, Gemini Product + UX Google Cloud Security

In the midst of mWISE in Denver, Colorado, an exciting cybersecurity conversation is taking place. AI is influencing security operations, making it easier and more effective to defend against threats. AI can automate tasks, provide insights, and offer recommendations to improve security posture. The future of security operations may involve specialized agents and AI working together to identify and prioritize risks. However, there is concern about the potential risks of AI, such as prompt injections, training data poisoning, and sensitive information disclosu... Read more

explore Keep Exploring

What are the key components needed to build a modern security operation? add

What is the potential future role of AI in making prioritized recommendations for threat assessment within organizations? add

What are some ways security operations are expected to evolve in the future? add

What is the speaker's opinion on the current state of hype and deployment of AI, particularly in the context of security? add

What initiatives or measures has your organization implemented to ensure the security and protection of AI technologies in workflows? add

bolt Powered by CUBE AI

Peter Bailey | Google Cloud & Steph Hay | Google

search

>> Hello, cybersecurity fans, and welcome back to Denver, Colorado. We are here midway through day one of mWISE and it is such an exciting cybersecurity conversation. I can't wait to continue it. My name's Savannah Peterson, here joined with John Furrier. I'm having a fun time today.

>> Yeah, I know. It's a cool day today. Chilly in the air, but this is a great show. Again, just one of my favorites. And this segment's going to be about how AI is impacting security operations. And again, as the world continues to go, how do you make it easier and more effective to run operations, to defend all the threats that are out there?

>> I know. A lot of cool guests too.

>> Yeah, great stuff.

>> Speaking of, we get to have Steph back. Steph, thanks for coming to see us twice.

>> Hello, again. Did you miss me?

>> Yeah, nice.

>> I did. I missed that smile. I missed the energy. Now, I can tell you're even more relaxed for this segment, so I think we're going to have even more fun than we had with earlier today. And Peter, welcome to the stage. Thanks for taking the time today.

>> New guy. Got it. Yep.

>> New guy.

>> New guy.

>> Well, but you're a CUBE alumni. You're actually an OG.

>> That's true.

>> That's right. I'm the newbie.

>> I had black hair back then, so-

>> Well, now you're both CUBE veterans. You're part of the collective. You'll be in John and I's seats next time at the next Mandiant. Actually, speaking of, Peter, I would love to give you the opportunity. Y'all had an announcement this morning.

>> Yeah, we did. Thank you. So we have Google security operations platform and we announced today that we're now offering our Mandiant expert services, Managed Defense, inside the platform and that allows any of our customers to be able to of pivot and bring in Mandiant experts inside the platform to help augment their security operation. So Mandiant expertise is the best on the planet when it comes to cybersecurity, so now being able to team up inside the platform to augment your team, we think is a huge benefit to our customers. So we launched that today. We've got a couple customers on it already and yeah, super exciting.

>> That is exciting. So it's basically an extension for all of your customers' teams. They just got like a VIP squad to come in and help them defend? That's super cool.

>> Yeah, we like to think of cybersecurity as a team sport and it's an expertise sport. So the more you can bring expertise to bear to help defend your company, your employees, what have you, all day long. So we're excited to be able to do that.

>> And as a CUBE alumni, we did an interview back in 2016, what I love about the CUBE doing it for 15 years, you have to go look at the tape, as they say. Now it's digital bits. We were talking about horizontal and vertical scalability. Cloud obviously brought in gen-one horizontal scalability, but that vertical specialization, the app is where the domain expertise, that's where the data is, that's where you have that AI and really gaining value. But also data is going to be horizontally scalable as well, which is a whole other set of conversations. But I want to get your thoughts because now running Security Operations Center to build a real resilient security operation is not trivial because of the distributed nature of the world now. So should be computing heterogeneous, a lot of tools and technologies available. How do you build this next-gen inflection point, a security operation that's resilient, robust and not compromising the security posture? Sure,

>> We were just talking about this.

>> Yeah, we were just talking about this.

>> That's convenient. Share with us.

>> So to kind of simplify the problem, if I can, you have a data problem, you have a knowledge problem, and then you have kind of a people action problem to solve in security operations. So getting the data in so you can see all the signals across your network to have visibility on attackers and whatnot, then to know what to look for. So that's threat intel, that's IOCs. Mandiant has some of the world's best intelligence to be able to tell our customers what to look for and then what are you going to do about it, which is all the work streams, work flows. And as everyone in cybersecurity knows, there's a shortage of people, the actions piece of it is complicated and hard. And so you kind of need all three of those pieces nailed to build a modern security operation. And then what we would say is that at scale, at speed sort of implies the next step, which is to the extent we can start automating those pieces using AI, that's where we can provide incredible advantage to our customers. And so that's sort of the journey we've been on and we're really excited to talk about.

>> Yeah, as said, this is a team sport and I think that convergence too of the different roles, making sure that you're bringing in the expertise of a threat analyst and a tier two SOC analyst and maybe a cloud security practitioner to be able to bring those together into a common experience is going to transform the SOC.

>> Taylor was just on from Google, he's in the office of the CISO. He brought up a great point, which was kind of a.to connect for us, which is gen AI is just another application security problem. And so that's a data problem. So you got data, you got the application security. Work flows are huge, Steph. And we talked a little bit about in your last segment, this really applies to the security operations. There's a lot of work flows that are end to end that are well established where gen AI could come in and eliminate some toil, yet also provide capabilities. So you get the benefit of lower cost higher productivity, but now you have a capability advancement. The ball moves down the field, your favorite expression.

>> .

>> Take us through that because this is an important point because it's the benefit of getting in early now and putting in that foundation. What's your thoughts?

>> Yeah, I mean this is why it's I think very exciting to be in user experience right now in the security domain because number one, the practitioners need to have tools designed for them at the level at which we would expect it of a consumer experience, the level of intuitiveness where things are just starting to happen for you, but the enterprise context generally that hasn't been prioritized. So we have to sort of manually plunk our way through disparate work flows. I do this little piece here and then I have to go over here and I have to be trained to go read docs in order to do that. And that's what I think is really a transformative power of both really elevating experience to be first class in an enterprise context and say, "Actually, we're all safer, including our consumer experiences when we prioritize making the security practitioners life easier." And we can do that in the traditional UI, but I do think that GenAI through its ability to take in lots of context from disparate sources is really uniquely positioned to streamline it.

>> Peter, I want to get your thoughts on this because if you look at the GenAI wave and everyone's hyped up about it, but it is an inflection point. We talked a lot about it on theCUBE. It gets compared to the web and those inflection points, the winners are the ones that reduce the steps it takes to do something, made it intuitive and easy to use. So in the security ops center... I'm speaking her language. I know you're going to jump in on this one. You should.

>> Peek into my .

>> You, first. What is being reduced in the ops for a task perspective? Because it used be how many clicks to find, what you're looking for. Again, the Google axiom. What are the security ops that's going to be reduced with GenAI and what's easier and what's the intuitive areas that you see that can be worked on that's being worked on?

>> So something I think Steph talks a lot about is sort of the steps along the way for AI specifically, which is of an assisted experience, maybe a guided experience, then maybe semi-autonomous and then ultimately autonomous, which may or may ever happen. But along that, I mean again, back to security operations, it's a people, it's a process, it's a technology set of issues. Those first two are all human. And so to the extent we can start creating workflows, work streams that begin to automate steps along the way, which is today a very complicated set of work streams. So from onboarding data sources to searching to creating detection rules to investigations and remediation, there's just a ton of complexity along those steps. And yes, we will always look to simplify those experiences through the UI. You can use AI today through assisted experiences like, "Hey, let's go find out all the information out there on the planet about what I'm seeing right now and bring that all back and summarize it for me. Now maybe help me write a detection rule while you're at it." So those are steps in the old days that maybe took hours and days maybe in today, they can be right at your fingertips and go very, very quickly. So you can respond faster, you can add faster, and that ultimately is going to reduce your risk and improve your security posture. So we think about it in terms of looking at those work streams and really trying to give tools and automation to those practitioners that allow them to go faster, be smarter and ultimately reduce the risk factor.

>> And have a comprehensive scope of everything that you're talking about. Just like you're talking about all the different pieces coming in together, talking about legacy systems, you're talking about new tools, you're talking about someone's personal edge device that they happen to be using or whatever to make sure your old system is clear. There's a lot of different components.

>> Single sign on, one app.

>> That's some of the early days exciting tasks that we are starting to transform. Being able to disparate data and summarize it so I don't have to know each individual piece and then mental model how that's a risk and what I'm supposed to do about it. To take IAM over permissioning and summarize that and then give the next steps to remediate and then in the future when it's more semi-autonomous to just actually handle that for me. So I never even have to de-risk the potential threat. What am I going to do with free time instead is great. And that's even in the threat-intelligent platform that we have today. Normally you'd have to go out and look for different sources for OSINT data for example. We're automatically ingesting that now and summarizing it and just taking what would normally be an hour and making it a minute. What am I going to do with that time now? That's so exciting.

>> What a great question to be able to answer. Who doesn't want to be thinking about that? I think it was McKinsey you were talking to, Rodney, back at Google Cloud Next and he actually said that, "The thing that's going to benefit the most from AI is the dog because you're going to have extra time to go walk the dog and play with your animal." And I always kind of think about that in the back of my mind. Thank you, Rodney, for that. I appreciate you.

>> Blood pressure, blood pressure.

>> Yeah, exactly.

>> benefit.

>> Yeah. Right, right. Well we can design our healthier lives. What are some of the... And I love that you're so passionate about UX AI is UX, like I said, I'm stealing your line forever because I care about it as well and this intuitive experience is going to lead to the adoption of everything. But what do you think are some of the big mistakes that companies make when it comes to security UX in particular?

>> Yeah, well I definitely think practitioners already have too much that they have to learn across all of their tasks. And so a mistake tends to be making them learn a new thing called the AI experience. So we have a principle just called in our SecOps work, which is called Gemini is all up in your workflows. And that is very specifically we want Gemini to be baked in to the existing inputs. For example, today a practitioner using Gemini or using SecOps might search their SIM using the query language that they have very unfortunately had a toil to learn.

>> Right. Basically, they're on SQL for that.

>> Yeah. But in that same interface now they can use natural language inputs. And what we've seen over time is that by baking AI into the user experience first, once they start experimenting with it, we start to see that usage go up. And this has been the kind of data that gives us some wind in our sails. That is the right UX strategy is to infuse AI rather than to create standalone systems that are abstracted away from the tools that the practitioners are already using.

>> On that point, I think it's most people try hit the home run with technology as we use the baseball metaphor, just hit a couple singles. So the question for you guys is what do you see as those quick wins to get that going because there is that experimentation where people are learning, "Wow, I like this better." And we experienced it all of ourselves when we used Gemini and AI say, "Oh, that prompt. I should do it better." Intuitive learning in AI as you use it, what are some of the wins to get that flywheel going to get that adoption up? What's your thoughts on that?

>> I have a quick response, but curious of yours too.

>> Yeah, I mean again, I think about it like what are the high barriers to entry to getting proficiency in a products. It could be learning a query language, it could be learning about the data that you're seeing, trying to connect dots around it in terms of like is this good, is this bad, and being able to research that. So if we can make that stuff easy, those are really quick wins because you're going to get more use of the product, more easy use of the product, you get faster adoption of the product. You're hopefully going to get that practitioner to doing things that maybe before we're kind of grunt work to now that's more strategic in terms of looking at your attack surface. Let's figure out how we are going to monitor that and reduce risk here or there across the different attack surfaces that we're managing. And so the more we can reduce the toil aspects along the way, those are always quick wins and that is going to win a lot of a loyalty we hope from our users.

>> I think a few specific examples right now in our GTI platform we have a feature called Code Insight. And so Gemini just automatically inspects any file and then summarizes that. That's for any file that's uploaded. And then we've also got a detection generation, I mentioned that earlier today in fact. I can put in my natural language what I want to have happen. It's going to give me all the semantic that I need in order to get this thing created and deployed. And then finally, playbook generation is another one. I want to put into how I want this thing to respond. I can put that in a natural language, Gemini gives me the playbook that I'm able to run. These are the super time savers that would just . Even for an experienced analyst, they would take hours.

>> It's interesting, Savannah, I do a lot of research as well-

>> I was going to say this really plays well into our lives....

>> as well as commentary. But one of the things you mentioned is insights. One of the things that's coming out this GenAI wave is that you're seeing insights become really not just a punchline or hyperbole, a real value. And you mentioned the other piece of impact. So I want to get you guys thoughts on something we're seeing as kind of new categorical value, real-time insights or high-frequency insights and impact and influence. I mean influence in the way of enforcing someone's job and whatnot. What's your guys thoughts on that? Do you see similar trends in that area? Insights, impact, influence?

>> I mean, let me speak to insights for a moment because, and we're a little bit of a broken record on this, but I'll hit it again. So we have these incredible experts called Mandiant. And we have incredible experts inside of Google and imagine taking all those brains and making them available real time to help answer a question, to help give you insights into something that you're seeing. That is table stakes. We have that in the product. That is a huge powerful way to create those insights that might take hours or days to piece together over time. And those insights allow then to take action. So I think for sure insights is a key thing we are seeing as a benefit. I think influence is then... So if you can also for example, use the security operations example again, take those insights and share those out in your organization to create more credible bases for taking action, for prioritizing something. I think there is the ability to influence because you have better data, better insights to share across an organization. So I think it helps in both of those ways.

>> It's also, I think it's context and agents. So all the things that you just mentioned, Gemini is uniquely positioned to take all of that in and generate recommendations. But with specialized agents that understand how security work gets done, doing the monitoring, knowing the business context, which is super hard, this customer cares more about this than that is going to be required in order to be able to surface the right risks. Because an insight for one company that has already accepted a particular risk is noise. So Gemini has to get really good at taking in all of these inputs and then we have to have agents who are specialized to particular outcomes who then in the combination of that surface to the user what is truly helpful.

>> So go full circle then on that then, context drives situational awareness augmentation to the security practitioner?

>> Yeah. So then we can move toward that semi-autonomy on the day design. Yeah, that's right.

>> That business context piece is so critical. To your point, not everyone prioritizes the same threats or risks across their observability or across their entire organization. I mean, I hadn't really thought about Gemini or any AI having to make that decision on its own to understand what is a priority or what someone's already accepted might be just a part of their threat landscape.

>> I mean, I think-

>> It's kind of wild to think about honestly now that I'm sitting in this moment, yeah.

>> I think that's a promise and we're we've got so much work to do. We're not past the assistive stage and we've even got to build a lot of trust with the use in being able to give them those productivity boosts like I mentioned. But there's going to be a future state in which we have more of the business context that Gemini is going to start making more opinionated recommendations with a specialization of something like a second LLM, a specialized security language model that goes into concert with that, where now Gemini can become much more of the sort of guide that you would want who might say, "I've noticed you don't ever action this thing that we keep prioritizing for you. Do you want to go ahead and should I ignore this in the future?" Now the human is actually accepting risk and training Gemini, that sort of future state is where we're going. We're not there because we have a lot of work to do to get there, but I think that is what is going to enable teams to work more effectively.

>> And I want to build on that because that's a transformation of security operations in the future where today you have section engineers saying, "Hey, I want to go query my network to look for this bad IP to make sure it's not anywhere in my network and indicating someone's in my network I don't want to be in there, et cetera." Imagine in the future you have agents, they're able to go perform HUN functions or other types of functions and that same engineer is now helping configure and design agents because they have knowledge of their own infrastructure and they're on crown jewels assets so to speak. And they're really managing a fleet of AI that is going out their performing these functions and bringing back outcomes. And so that is one way for sure we know this is going to evolve in the future and what we're-

>> That's real impact right there. That's real impact to the security question.

>> Yeah, I know it is. And it also helps build that trust that you're talking about within the user experience because now it's learning from you. Okay, so I asked this to our last guest and I'm really curious to ask you two because you're both quite smart and especially since you've been on both the Google on the Mandiant side. So I'm a very authentic and blunt person, so I'm not just being nice to you. You're probably thinking, .

>> .

>> This is not what I think. Well, it is a clever question because I think... And I'm very curious to hear both your perspectives. What do you think is the most over-hyped thing right now in security?

>> AI. No. I think it's the nervousness. I mean, it's understandable because there's so much new risk. There are AI native risks. Prompt injection is a real thing.

>> What you're talking about.

>> Being concerned your company might make a promise to a customer that you can't keep because it deployed AI. All of these things are totally legitimate concerns. But I do think that where we are in today's state, there's a lot of hype around what AI is doing and it's not quite doing that yet. And it's because we need to deploy it responsibly, especially in security though. We need to have such a level of precision and substance in every single thing that the practitioner sees before we would put in front of a customer too. We've got a lot of work to do there still. So I think the fear around autonomous or that tomorrow, entire teams are going to be eliminated because of AI is a little over-hyped.

>> Well, Kevin Mandy at center of the stage, GenAI is coming, your users will use it, get your policies. So my final question for you guys is on that security risk piece on AI, because it is here, the Open Worldwide Application Security Project listed the following things as the top areas. Prop injections, you mentioned that. Training data poisoning and sensitive information disclosure, your thoughts around that and is that accurate in your opinion? What did I miss? Is there anything top or high order a bit above that?

>> Yeah, I mean spot on. Our CISO's office created last year white paper declaring a safe framework, SAIF, which is sort of a guide for how organizations are really trying to bring AI into their workflows need to be able to start thinking about these protections. But of course in Google, we already have some things like sensitive data protection, which is live today. We've got things like Model Armor, which is in preview, which is really helping to protect applications. And across four different layers, we're working on solutions to secure AI, the model, the application, the infrastructure and the data. And so the three that you just named right now are top of mind and I think all of us because we want AI to be really transformative and realize its potential are focused on making sure we're addressing both sides of the coin, securing the platform so that you can do AI and then enabling the practitioner with AI.

>> Everyone talks about prompt injections, but the training day, if you get that early, it's getting in the mind of a child in preschool, you can then inject biases.

>> I mean, the whole data-

>> What an analogy jump.

>> It's like getting in early because that's going to impact all the reasoning and all the inference.

>> Yeah, there's all movement around data is code. You've probably heard about it.

>> I think we've coined that term.

>> That data is being something you're going to be inspecting and managing like you would a code repository. And if you think about also then we have customers putting their data in to train models, you really have to have a very disciplined framework around how to treat that data. Making sure that we're not bringing anything board that would be sensitive or PI or otherwise. And those are all the kind of things that Google thinks about all day long because we have to deal with that in the real world all the time.

>> Yeah, definitely. Peter, you didn't get a chance to answer. Do you agree with Steph that AI is the most hyped? I'm not letting this go yet. I'm not done.

>> Are we still talking about the singularity emerging soon?

>> Yeah. Artificial general intelligence. Here we go.

>> I'm all for Star Trek.

>> What do you this is most hyped?

>> No. It's a hundred percent AI. Yeah.

>> We have CUBE alumni that said everything in Star Trek will be invented, except for teleportation and that's still AGI potentially.

>> I want teleportation though. Yeah, I don't want to fly United ever again. Sorry, Denver.

>> Yeah, no, listen, I think there's such great potential, but we have a journey ahead of us. And so I think I'll just sort of say we are very grounded in trying to help our customers, help at the workflow level, help at the user level. And that's keeping us from getting too bullish on and speaking about where this can go next week, next month. But we think over the next several years, five years from now, things are going to look very, very different. Your secure operations organization's to look, different org chart, investing in different things. And so we think in that timeframe, there will be some very big changes.

>> And the game is still the same. The symmetry between offense and defense. Getting that right, a hundred percent.

>> A hundred percent. Yeah. For sure.

>> I love it. Well, this was a very grounded conversation in grounding our AI.

>> No hallucinations at this .

>> No hallucinations at this table. We're even warming up a little bit in here. I love it.

>> Thanks, Peter.

>> Thank you both so much. We could have chatted all day.

>> Yeah, likewise.

>> Thank you.

>> I feel like we're going to have you back on the show. I mean, Steph's moving into the desk, so going to be here next. Now we're bringing you in.

>> second grade now.

>> Yeah. So we're ensuring. We're evolving here.

>> I'm getting trained and I'm soon to infer.

>> Thanks for having us.

>> Really appreciate it.

>> There are about seventeen jokes I could make right now, but I'm not going to make any of them. You'll have to tune into theCUBE After Dark for those. No, I'm just kidding. My name is Savannah Petersen. We're here at mWISE in Denver, Colorado. You're watching theCUBE, the leading source for cyber security news.