Clips
News
More from mWise Conference 2024

Upen Sachdev

Principal

Deloitte & Touche LLP

Steph Hay

Senior Director, Gemini Product + UX

Google Cloud Security

Gen AI security: Enhancing protection through collaboration, trustworthy AI frameworks and data management

Based on the integration of artificial intelligence into critical business systems, gen AI security should be top of mind since large language models are vulnerable to various attack vectors.To mitigate these risks, security and data teams should join hands throughout the AI development lifecycle, laying emphasis on continuous monitoring, input/output controls and early security involvement, according to Steph Hay (pictured, right), head of UX, Google Cloud Security, at Google.Deloitte’s Upen Sachdev and Google’s Steph Hay talk to theCUBE about the need for gen AI security.“Being able to collapse the attack surface and enable teams to work together,” Hay stated

play_circle_outline User experience challenges with GenAI in cybersecurity

play_circle_outline Trustworthy AI framework principles for security

play_circle_outline Collaboration between teams in identifying and defending against threats

play_circle_outline Convergence of SecOps, cloud security, EDR for future SOC

play_circle_outline Collaboration and white paper on transforming SOC

Info
Transcript

Upen Sachdev | Deloitte & Touche LLP & Steph Hay | Google Cloud Security

Upen Sachdev

Principal Deloitte & Touche LLP

Steph Hay

Senior Director, Gemini Product + UX Google Cloud Security

The cybersecurity community gathered at mWISE in Denver, Colorado to discuss the importance of AI in cybersecurity. Experts emphasized the need for trust in AI and the challenges of user experience. Collaboration among teams and the integration of GenAI into security operations were highlighted. Data management's role in leveraging GenAI effectively was also discussed, with real-life examples shared. Training models correctly and setting guardrails for precision in security operations were key points. The human aspect of AI was reinforced, stressing the impor... Read more

explore Keep Exploring

What are some challenges in combining user experience with security in the context of AI technology, specifically in the future of the SOC? add

What are the two perspectives when looking at the use of GenAI in protecting against attacks and ensuring responsible and secure usage? add

What are some foundational elements for creating a SOC of the future vision, particularly in terms of automation, collaboration, and AI-infused experiences? add

What are some key components of the SOC of the future? add

What work were the co-authors discussing and who do they give credit to for their collaboration? add

bolt Powered by CUBE AI

Upen Sachdev | Deloitte & Touche LLP & Steph Hay | Google Cloud Security

>> Good morning cybersecurity community and welcome to mWISE here in Denver, Colorado. My name is Savannah Peterson, joined by my fantastic co-host this week, John Furrier. John, welcome back to Colorado.

>> Great to see you Savannah. Love this show. It's one of my favorites of the year. It's deep tech, a lot of experts, and as the AI technology continues to evolve, it's enhancing business operations in significantly new experiences, new capabilities, but it's also introducing new security threats and that's going to be the focus of the show this week. So we're going to dig in.

>> I'm really excited to learn and what a better way to start than with Upen and Steph today. Good morning. How you all doing?

Steph Hay

>> Hi. Good morning. Fabulous. How are you, Savannah?

>> You're doing great in the cold

Steph Hay

>> jacket. That's right.

>> Good color on you, by the way.

Steph Hay

>> Thank you.

>> Thank you both so much for taking the time to start us off today. Quite a week in cybersecurity. Deloitte and Google working together for a long time on these AI challenges. Upen, why don't you open us up? Why is this week so important to Deloitte and why is the cybersecurity conversation front of mind?

Upen Sachdev

>> Security is front and center of AI. We cannot have good generative AI without good cybersecurity. Making it trustworthy. And I feel that's why this week, this partnership, is so important to us.

>> Yeah, absolutely. Steph, when you think about AI and user experience.

Steph Hay

>> Oh, yeah.

>> I love that this is your ... and we're combining that with security. How important is thinking about user experience in keeping everything secure?

Steph Hay

>> This is such a softball. By the way, I love it.

>> I'm warming us up baby. It's day one.

Steph Hay

>> I think about it, I'm a true nerd. I lead the user experience team. It's a joy. It's also a huge challenge for similar reasons too. Because in security you need to have precision, you need to have speed, but you need to have confidence. So therefore, a lot of the tools that we would design for the defender, we would want to be easy to use, but also be able to convey the signals of trust that would be required to be able to rely on those. And GenAI it's so early right now. Of course the security practitioners, like can I trust this response? Is this going to help me or is this going to hinder me? And so there's a huge user experience challenge with AI. In fact, I often say AI is UX, especially the future of the SOC.

>> I'm going to borrow that. I'm going to give you-

Steph Hay

>> Okay great. Maybe you should get a T-shirt.

>> Yeah. One of the things that comes up is that user experience, it came up in Kevin Mandia's keynote is the collaboration between teams. That was a huge point. Not only the SOC advantages in terms of the AI piece, but also working together, identify the threats. How is the UX bringing into the collaboration? Because the business is seeing more threats, especially with Miles, and the questions every year, he lists them on the keynote, new questions pop up. What boards are thinking. Risk management. Big part of it. So how are teams working together both internally to solve the threat problem, but also is it getting easier with GenAI? What are some of the innovations?

Steph Hay

>> Yeah, yeah. I mean I can talk about something then I think maybe we talk a little bit about some of the principles around trustworthy AI. Definitely being able to collapse the attack surface and enable teams to work together. LLMs are uniquely positioned to bring in disparate data that might be, for example in threat intelligence, some of the latest Mandiant research reports that we'd be able to summarize those, be able to identify particular issues and then generate things that would be pushed into the SOC automatically. A new detection rule for example. Those are the kinds of things that are trying to create a much more streamlined user experience that enables a CTI team and a SecOps team to work together much more fluidly.

Upen Sachdev

>> And so when we talk to clients, we look at this from two perspectives. The first perspective obviously is GenAI attacking us. Now you have a hacker that doesn't need coffee breaks, doesn't sleep, it's at it all the time. And so how do you protect against it? And the only way to do it effectively is to use GenAI ourselves and get that SOC analyst who doesn't need coffee breaks either. That's one aspect we work with a lot. The second is making sure we use GenAI responsibly safely in a secure manner. And that's where we built what we call our trustworthy AI framework. Basically with three core principles. One is you want fairness from your model. Second is you want accountability. You want it to not hallucinate, you want it to do what it is supposed to do. And finally keeping that model secure so we are not giving away our data, we are not giving away our intellectual property. But that's how we look at the world. One is GenAI attacking us, how do we protect against it? And then secondly, how do we use GenAI securely in a trustworthy manner?

Steph Hay

>> Yeah. And these were also some of the foundational elements for partnership that we had in creating a SOC of the future vision, which was all about making sure that automation, that the collaboration and the AI-infused and really AI-guided experiences are just how this is going to be so that the teams can hopefully defend better.

>> At Google Next last year, one of the big things that came out on our CUBEs data segment there was the data is self-forming. So you get a lot of data engineers and data scientists and then you got security teams. So we heard again in the keynote get the security teams involved faster on the new AI stuff, but also bring the data engineering and data science teams in which are different teams that are now working on real time threats. This is where the action is. Are they rubbing together? What's your thoughts and reaction to that and what do you guys see in happening?

Upen Sachdev

>> So we have two sleeping giants really take off for us after generative AI. We are getting more work around master data management, which is organizing an organization's data. And then securing an organization's data doing role-based access, making sure there is good data sanctity in terms of what gets absorbed into the model. I feel data is the underlying layer behind GenAI and we are seeing organizations more in that foundational stage of doing better with their data to make sure they can leverage GenAI in a much more effective manner. And I feel that trend will continue. GenAI continues to generate more data and so you will need better

Upen Sachdev

>> Exponentially. It's just going to continue to cycle up. Upen, I have a follow-up question from something you said a little bit earlier, when you're talking about making sure that your models are secure, GenAI warfare basically, between two GenAIs. Because you work with so many different customers, when you're working with a customer, how long does it take you to spin up that model to a point of trust where you feel like it's going to be secure and able to defend?

Upen Sachdev

>> It depends on what you want the model to do and what is the level of risk involved in the decision that the model is making. The way I explain this to my clients is think of it as me adding a firewall of wisdom to your very young AI model that can think like a kid sometimes. And so if you wanted to decide what is an attack versus what is normal activity and you're going to have a human overlay it, then maybe that is ready in 30 days, 45 days. But if you want something more advanced that is making decisions on access provisioning, that is probably a six-month journey. We need to figure out the use case, look at the risk behind it. That's where good governance comes into play around risk management. And then you have these effective models.

Steph Hay

>> And just imagine, this is the sort of thing that our customers are dealing with right now. So we have to add scale, create the kinds of controls on a few different levels to be able to protect the model, the application, the infrastructure and the data. And so things controls a lot.

>> Actually here.

Steph Hay

>> Right? It's a big world, but we have to do it to be able to make it safe to use AI in production and to do that quicker than the bad actors are going to be using it against us, right?

>> Yeah.

Steph Hay

>> So things against prompt injection, notebook security scanning, being able to monitor all this. One of the things that we're doing is protecting all of the four layers and then surfacing that in security command center so that the cloud security analysts can see workload performance across these different vectors, which is going to be critical since it's the new attack vector.

>> Upen, where are we in the progress bar with customers? Because you have the confluence of this inflection point of a lot complexity, now you've got multiple clouds, you have multiple environments, edge to core, and real time is happening. So what are some of the best practices and where are the customers right now? Are they setting things up? Are they trying to reduce the steps it takes to do something? They trying to make it easier? How would you peg-

>> Are they overwhelmed?

>> They probably are overwhelmed.

>> That's what I'm thinking.

>> But where would you peg the progress and what are some of the best practices you could recommend?

Upen Sachdev

>> Yeah, let me give you some real life stories. Let me tell you what my clients are currently doing. Just about four weeks ago we did a completely Gemini-powered war game for one of my clients. And it is almost 70%, 80% there where what would take us 200, 300 hours to generate a war game took 20, 30 hours, we delivered it.

>> That's an order of magnitude.

Steph Hay

>> Yeah.

Upen Sachdev

>> Gemini was able to assess responses and generate the next inject after it. So pretty effective with low risk activities. Another place where I am using GenAI very effectively is analyzing malware. Taking an APT, using it on to get good effective IOCs and so on. So to answer your question, there are users in pockets where adoption is really quick, but when I talk to my clients, Steph calls it usability, I call it operationalization, but my clients want to start getting value out of it day one. So what can we operationalize with low risk? And that's where Gemini integrated into SecOps comes into play. I can get value out of it day one for you, within 60 days you are seeing cost reduction. You are seeing a partner in crime helping you fight crime, and that's when we are seeing a lot of value.

Steph Hay

>> We just had an example where Etsy was able to migrate a bunch of their detection roles within a week over using Gemini and just having to sort of edit about 20% of them because of the breadth that Gemini has. But back to your question about data science, data engineering and all that coming together, the big large language models ... and Gemini is amazing. Two million in token context windows.

>> Huge.

Steph Hay

>> But it doesn't necessarily know what a Mandiant analyst knows when it's doing an investigation. We have to pair that with the precision of something like a specialized LLM. We have one called SecLM. It's been trained, Deloitte's been helpful in this as well, on some of the ways in which an analyst conducts an investigation. And so bringing that breadth and that depth together is what enables the in-product experience to be precise.

>> First of all, Gemini is getting great traction. Congratulations on that front, Google at large. But specifically to security, do you guys have a scenario where it's like be a Mandiant analyst and use a pilot AI system? Because I can see the simplification of the data being formed on behalf of the two teams to take all that grunt work of wrangling data. So the UX meets coding-

Steph Hay

>> You got it.

>> So take us through that. This is where I think everyone's focused on right now because you guys should both share. That's a hot topic.

Steph Hay

>> Well, I'll give an example. Gemini in SecOps we have an investigation assistant and the whole point of that is that I'm in my tool. I don't have to go learn some new surface. I'm a defender. I already have a bunch of those that I have to toil across. I'm in my tool and I can ask a natural language question, "Hey, tell me about this particular piece of malware." We are able to go, Gemini goes and gets the latest frontline intelligence, so it's grounded, which prevents the hallucinations and brings that in and then takes next step to look over let's say the last 90 days of your activity to see if you have any IOCs. That kind of collapsing of the roles, the jobs, the tasks is where we're at right now. We're still in a very early assistive phase. Before we can get to this semi-autonomous phase, which we will, I say, "Hey, just be a Mandiant analyst." Do some always on threat hunting. I have confidence in that and I'm going to trust it.

>> But the needle's moving in your opinion now?

Steph Hay

>> Oh, yeah.

>> Your thoughts where you see that?

Upen Sachdev

>> Yeah, by the way, we need a AI-powered thermostat in the room for sure.

Upen Sachdev

>> I'm trying not to be

Steph Hay

>> right now.

>> I'm activating my core right now.

Steph Hay

>> Where's the nest for the desk right now. We need a little more work.

Upen Sachdev

>> I think where the reality is today is human class. So when you see the SecLM model, which is grounded in security data, I think it is augmenting our security analysts. It is not taking over from there. But to be able to go to a model and say, generate IOCs and generate an investigation query for me in Yara is extremely powerful. And that's where I feel purpose-driven models will come into play more and more. I don't want to ask a friend of mine where to go for pizza when he eats sushi all the time. You need the guy who eats pizza all the time.

Steph Hay

>> What a great metaphor. Deliciousness.

>> Context is everything. Grounding in context. As you said.

Steph Hay

>> I'm thinking about pizza already.

>> Now we're hungry. Don't warm us up.

>> Now I lost all my questions. I'm thinking about sushi and pizza.

>> I have a question for you because you just brought up something that I think is really interesting. You've given some great examples of where GenAI is great for solving problems and security. Is there anywhere where it's just blatantly not the solution?

Steph Hay

Upen Sachdev

>> Let me tell you this. It is always the solution provided you train it correctly. Let me give you an example.

Steph Hay

>> Yes.

Upen Sachdev

>> We are working with a client in high-tech manufacturing, I'm going to change a few names, but they build alloys with platinum and they trained it with a lot of data including airline data of loyalty programs. So now you think platinum is a status about flying, but it also goes into alloy, which confuses the AI in terms of what responses to give.

>> Of course.

Upen Sachdev

>> I'm just giving you example. But if you get your data practice correctly, if you have good master data management where separate data is training different data sets and you have a purpose-driven model, I feel chances of hallucination go down. But you need to think through it thoughtfully even before you start on that journey and get the right underlying data.

>> Yeah, go for it, Steph.

Steph Hay

>> I have a slightly different perspective.

>> Let's go.

Steph Hay

>> I don't think ... maybe it's the opposite perspective now that I'm saying out loud, but I don't think the AI is a solution for everything. If something like a rule is able to get the job done in combination wrapped in some of the generation or some of the translation that LLM is in particular uniquely positioned to do, I think it can be transformative. What sort of static age-old technology, let's call it, because the new stuff together, I think we have a lot of runway still there to do. And throwing AI at the problem isn't always the solution.

>> So this brings up the-

Steph Hay

>> I'm curious about, would it be expensive to solve the problem?

Steph Hay

>> Yeah, and again, because we're still early days, back the level of confidence that somebody might have to move some GenAI into their critical workflows, you still have a lot to get that specialization right.

Upen Sachdev

>> And talk about human plus, right? Does it give you an additional thought-

Upen Sachdev

>> The nice way to frame it.

Upen Sachdev

>> Yes.

>> Let's direct that to reinforced learning with human feedback. A big topic in the algorithm side of it. We heard Mandia say, for the first time I heard him on the keynote say, human in the loop. Human reinforced learning, reinforced learning with human feedback is a big part of how these models are working. This brings up the comment he said about, "Hey everyone in the audience, gen AI is being used by all the users get used to it, it's never going to go away. And so have a policy." So you have security people tend to be like, "I really don't want the AI. I want to make sure we have everything tightened, buttoned up." But it's in there now. So how do you manage that human aspect driving AI? How does that weave in? What are customers thinking about? Is it early days? Because the human in the loop will be a key because it's in the reinforced learning now with human feedback.

Steph Hay

>> Yeah.

Upen Sachdev

>> So I think that's why I agree with Steph, right? If you ask me is a model there today, I think we are still in the generative era of the world. We are not in predictive or action era of the world. I would not trust a model to go block something for me or go make a decision in my cloud infrastructure. I would want to inform my analyst some more to go make that decision. And to your point, that'll keep entering into the feedback loop and that model is just going to keep getting better. But I feel that's the foreseeable future and that's where someone like us comes into play. I monitor hundreds of accounts, hundreds of clients, and the model that we are training is a bit more versatile in terms of what it can do. And then we are able to apply it into different use cases and we have good predictive insight as to what it does better and what it doesn't.

Steph Hay

>> I think that's a good differential.

Steph Hay

>> We talk at a scale of manual, assistive, semi-autonomous, autonomous. And human in the loop, right now we're in the assistive phase doing low risk things like natural language summary, natural language input, translation, that sort of thing. And we're actually not doing immediate feedback. So what the user is doing is not immediately retraining the model. That's also very expensive. We're taking that in, we're critically doing model updates. But to get to that state of semi-autonomy, for sure, let's say a low risk malware triage, we would want to have Gemini tee that up and the user would have to say, "Yeah, go ahead and do that."" We're going to be in that stage for a while, but we're not there even yet.

>> So that's where people talk about guardrails, input-output controls?

>> Yeah.

Steph Hay

>> Yeah. I don't want Gemini to do something that I haven't explicitly given it approval.

>> So we set some guardrails around it at this point-

Steph Hay

>> Especially in security.

>> It's kind of like we're in the low end of the pool with the bubble on.

Steph Hay

Upen Sachdev

>> Am I allowed to do it?

>> Yeah, but guardrails, this is where the guardrails come in. That's when the safety governance comes in and some of the explainability. Are we still in that?

Steph Hay

>> Got it. Because it's real risk. We need have precision and confidence in the security space.

Steph Hay

>> I'm curious, you're both at two very famous company that most people heard of on this planet and you're dealing with a lot of talent within your own organizations as well as talent skills gap when it comes to your customers that you're serving. How are you seeing, or even how are you doing it internally? How are you attracting the top talent in this rapidly emerging growing space? It has been around forever, but

Upen Sachdev

>> Did want me saying that first?

Steph Hay

>> Let's do it.

Upen Sachdev

>> Yeah. So first of all, we are a very talent-centric organization.

>> Deloitte? I'm shocked.

Upen Sachdev

>> Yeah. And it's like finding unicorn and then making sure the unicorn can code in Python, right? It's not going happen.

Steph Hay

>> That's a very talented unicorn.

Upen Sachdev

>> Yeah. It's not going to happen overnight. So training individuals, and not just people who work in our team, that's why we have very specialized programs for CIOs and CISOs on adopting AI, proliferating that talent downstream. But we'll have to solve that problem together. Google, Deloitte, all our peers where we'll have to train the next generation of GenAI and AI leaders.

>> And that's why the rise of center of excellences, cross-team training comes in. So in those formative years. Any best practices on team training, cross-training, centers of excellence, is that too groupthink or is that where we're at right now?

Steph Hay

>> I think there's something interesting that's happening right now, which is there's always been a cyber talent gap. Finding the expert practitioners, for example. We think Gen AI is going to be able to ... I need to come up with a better metaphor than move the ball down the field, but that's what I'm using right now.

>> We love all sports analogy stuff.

Steph Hay

>> Move the ball down the field for the experts. They don't have to do low value sorts of things and then new folks coming in are able to be more productive early on. But the experts are now training some of these models on how they work and really getting that expertise into these systems so that they can become more semi-autonomous over time. And the data scientists, again, are now learning about these use cases that are specific to threat intel and security. There's this kind of interesting merging that's happening because of the potential that we're all in the right now.

>> We definitely want to follow up with you guys on that because I think as we get our research going, we're watching all this. It's evolving very, very fast with great improvements on the business operations today. But yet the vulnerabilities are coming in real time. So again, it's the balance of how do you get that real time capability.

Upen Sachdev

>> Yeah, absolutely. I got one more question for you because it came up when we were chatting ahead of time. This has been really fun. Our time's flown by. Cyber. So one of the lovely things about living in San Francisco and Palo Alto, John, you can relate, is our billboards are the nerdiest billboards on the planet. I think without question, there's always some feel like right now every-

>> Okay, here come the Black Mirror question.

Steph Hay

>> Every single one of them says AI on it right now. But you brought it up earlier and when you proposed this question, I could see it as one of our Silicon Valley billboards. So what's the SOC of the future look like? Because that would literally be on one of our billboards?

Steph Hay

>> By the way, I'm from Ohio and I love our billboards in Ohio, by the way. It's sort of like pull barns, that's all it says on the billboard. But anyway-

>> We should do billboard comparison. We should have AI pull up some of the best billboards in each state.

Steph Hay

>> Okay, let's see if that becomes part of mWISE

Upen Sachdev

>> I'm thinking about Los Angeles billboards now. But SOC of the future. I think I go back to what I said earlier, SOC of the future is all about crossing that bridge between generative to predictive AI and converging your SecOps with your cloud security, with your EDR, and with all the other tools that you have in your tool stack to make better, faster decisions with that human plus in mind. I feel we have a real opportunity over the next few years to at least have a very effective human plus models and combat the bad actors.

Steph Hay

>> Yeah, we had co-authored paper on this, and I definitely think it's back to John, that question that you had asked earlier. There is a convergence right now because of the GenAI and the SOC of the future is going to bring together clouds ... the vulnerabilities, the misconfigurations that are part of the cloud experience, the active threats that are part of the SecOps experience, the research that's part of the CTI experience. All of that is merging and it's going to give the defenders the advantage.

Upen Sachdev

>> I'll give a huge shout out to my team that worked on that white paper while I have this opportunity, but Mitch and Alex, and they're somewhere here. Fantastic work on that white paper. Anton collaborated with us.

Steph Hay

>> Yeah.

Upen Sachdev

>> It is a must read if you are building a SOC or thinking about transforming your SOC.

Steph Hay

>> I love that. It's a must read.

Steph Hay

>> Well, I mean you guys are always great on theCUBE. We've been following Deloitte for many, many years now, going back a decade. Always on the customer side of it from a tech pro perspective. But the guardrails, this is fun. This is the best time to be in tech right now, I got to say.

>> Amen. Couldn't agree with you more, John. Wow. Well, this has been great. We're over time. You're both brilliant. I'm excited we have you coming up again in another segment. We're going to have to get you back on. This was great. You were absolutely fantastic.

Steph Hay

>> Thank you both.

>> Thanks for taking the time.

Upen Sachdev

>> Thank you.

>> And thank all of you for tuning in to our two days of coverage here at mWISE in Denver, Colorado. My name's Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.