RSA Conference 2024 | Keynote Analysis, Day 3

Clips
News
More from RSA Conference 2024

Dave Vellante

Co-Founder & Co-CEO

SiliconANGLE Media, Inc.

David Linthicum

Principal Analyst

theCUBE Research

Innovations in tech security: theCUBE’s Day 3 analysis from the RSA Conference

When it comes to tech security, the current era is defined by complexity and opportunity.Unfortunately, when it comes to innovation, confusion can often converge alongside ingenuity, making it even more crucial for education, collaboration and foresight to help guide companies toward a future where security is not merely an aspiration but a collective endeavor.“[Companies are] really kind of confused about security and they’re trying to figure out what are the partners that they need to partner with to make their security stuff work,” said David Linthicum (pictured, right), principal analyst at theCUBE Research

play_circle_outline RSA Conference 2024 coverage and the expo flow

play_circle_outline Exploring the Intersection of AI, LLM Security, and Zero Trust Network Access: A Guide for Conference Attendees and Vendors

play_circle_outline Addressing Security Gaps in Gen AI: Enhancing Understanding and Technology for Safer Systems

play_circle_outline Elon Musk's prediction of machine intelligence overtaking human intelligence

play_circle_outline Dynamics in AI Attack and Defense: Exploring the Need for Scalable Security Innovations

Info

Keynote Analysis, Day 3

Dave Vellante

Co-Founder & Co-CEO SiliconANGLE Media, Inc.

HOST

David Linthicum

Principal Analyst theCUBE Research

HOST

search

>> Hi everybody. Welcome to theCube's Day 3 coverage of RSA Conference 2024. We're here in Broadcast Alley in Moscone West. David Linthicum and I are going to break down what we've seen so far. David, it's been a huge show. The first time for you at RSA.

David Linthicum

>> First time for me, and I have some PTSD from the expo.

>> It's pretty insane, right?

David Linthicum

>> Oh, God.

>> You were just over the expo flow. What was that like?

David Linthicum

>> It's probably the most amount of humanity I've ever seen since Comdex like in the '90s when everybody kind of showed up to that as kind of the Woodstock of the technology world. And everybody's there for the same reason. They're really kind of confused about security and they're trying to figure out what are the partners that they need to partner with to make their security stuff work. So it was just a number of confluence of people who were providing great information. People were asking inquisitive questions. I witnessed to very deep conversations. Enterprises are looking for that one tool that's going to take them over the path. I don't think they exist, but they're hoping that it exists. So there's a lot of confusion meets innovation. I think that's the best way to describe this conference.

>> Yeah. As you know, we did the survey with ETR prior to RSA. 50% of the 321 respondents were actually attending RSA. And one of the questions was, "What are you most excited about seeing at RSA? What are you going there to learn about?" And the two top things were AI and LLM security, and the second one was zero trust network access. Now how do you interpret that data? When I saw it, I was like, That's interesting, two hot areas." But the flip side of that is they're actually still in learning mode and the adoption of both AI or security for AI, which is kind of a new theme this year, as opposed to using LLMs or the bad guys using LLMs. So that's kind of new, something we can talk about. And then zero trust as we know, everybody's on that journey. Nobody's really achieved, or very few have actually achieved a full zero trust. So the point is, folks are here for education in the early adoption phases. That's how I interpret this data. What do you think about that and what have you seen on the floor that's either supports or refutes that?

David Linthicum

>> No, I think you're spot on. But the thing is, I would even extend it further. Everybody is here who's an attendee, a consumer of technology, is here for education. They're trying to figure out how to take their knowledge to the next level. But I think the vendors are here for education as well. Everybody I talked to, a little confused about what this AI stuff means. They were confused about how they're supposed to protect AI models versus traditional data. There was very few of them that could explain to me how their stuff is unique to specific to AI. So what's been done is they repurposed all their data security stuff for AI knowledge engines, looking at AI knowledge engines, just another source of data. That's not how they exist. They can be be hacked from within, they can have prompt level hacks, all these sorts of things are there as vulnerabilities. And then they admit and said, "We're learning. We just got into this a year ago. We're trying to figure out how to make this stuff work." So everybody out there is learning at the same time. But at the same time, they're trying to spin the market and put their stuff out there trying to AI wash their existing security stuff. So AI is written on everything. Usually it looks like a piece of tape stuck over the logos, but it's exciting to see. But I think it's okay that everybody's in learning mode. It's going to take us a while to figure this stuff out.

>> Well, it is really interesting too to see the, it's like a sort of barbell with actually a big fat bar because you've got established security players like Palo Alto, like Cisco, CrowdStrike up and coming and really well established. Microsoft's just everywhere. And at the other end of the spectrum you've got all these startups sort of attacking those companies. Take for instance, Zscaler. ZScaler's doing incredibly well. They're the pure play SASE vendor. And then you talk to another startup going, "No, no, they have it all wrong. We're going to solve this problem differently." You got startups saying firewalls are dead. You've got Palo Alto announcing some new sort of automation to firewalls. So Cisco bringing the network and the AI and the security together with something they call hyper something, hyper network AI. Jeetu Patel's coming on later, and he's going to talk about that. HyperShield is what it's called. And so you really get lost in all the marketing and all the noise and all the buzzwords, so my question to you is, how do you as a practitioner extract the signal from the noise?

David Linthicum

>> I think we have to do some deeper research and some deeper planning. I mean the articles you write where we're looking at the data as to what people are looking for specifically really needs to be taken heat by the vendors out there. I don't think not enough of that is going on. So they're doing what they think they need to do. They're not doing a lot of deep analysis. And so they're not asking the questions, they're not communicating with the end users. People are consuming this technology, not down working with the enterprises on building these systems and getting them out and deployed. I think that's where the thing lies. I think the problems having come from the consulting angle, I've been an enterprise architect for so many years, is very different than the way that the vendors see them. And I don't think the enterprises are good at externalizing that information to them. And so that bridge needs to be built. I like your barbell analogy by the way. It needs to be built so we're able to bring that knowledge and the people are able to react upon it. And so this becomes a bit of advice that I always tell them, "I think you need to go slower to go faster. You need to understand where you're looking to do in order to build the solutions that people are looking for. And I think those are very different than what you think they are now based on what I'm seeing on your poster board behind you." And so they agree. They agree. They think they need to reset and repivot, but right now they also tell you that, "We're scared." They said, "We'd never seen a market wave like this come up, a tsunami, big time, came up faster than cloud, faster than service oriented architecture, faster than integration, faster than client server. All these other trends that we saw in the past and that we're afraid we're going to miss it. And we've missed some market positions before." Certainly the older companies out here with rise of the internet, things like that, they don't want to miss this. And so they're trying to get out there with everything and anything and throwing resources on it.

>> One of the things that's different this year, and it's pretty noticeable, I think, I'd love to get your thoughts on this. So last year everybody was talking about gen AI, AI this, AI that, big conversation around attackers using gen AI to write better phishing emails. A lot of talk about embedding AI into whatever product, network products, security products, et cetera, to bring automation. This year there's a lot more discussion and some solutions. I don't know about solutions, but some early products to secure AI. Basically, the premise is AI, gen AI is different. It expands the attack surface. It's natural language based, so it creates different new novel exposures so we have to treat security differently. So I've talked to a number of startups, I'd say four or five that are actually attacking that problem. Some of the larger players are at least acknowledging it, saying, "Yeah, yeah, we're going to take care of that. Don't worry." But that's new this year. Discernible difference, in my mind anyway, incremental from last year.

David Linthicum

>> You just hit the nail on the head. That's the fundamental deficit I think we're running this year. I don't think the vendors out there understand how to secure these environments. They're very different. They're treating them like data like we discussed earlier. But the attack vectors, the ability to get at these systems is multiple dimensional. It's not from the outside in, it's through the internal systems, your ability to put harmful knowledge into them, your ability to put time bombs into them, your ability to do things that people really haven't thought of. And a lot of those attacks are occurring now. We're finding them all the time. We just don't have them built in systems that are significant enough to do significant damage. Now these enterprises are moving to these things where they're going to bet their business on building these LLMs and also using common LLMs, things like Gemini and OpenAI and things like that. And in doing so, the ability to secure those systems needs to occur before you build them. And you need to have the technology to make it occur before you roll this stuff out. You need the vendors that are viable to get in there to build those things out. I don't see the knowledge out there as I'm asking the questions. I see a look of confusion when I start talking about the unique needs of AI. But I think they understand deep down that it's different. They probably haven't put enough thinking into it and how to make it work, how to make it play. And I think that's the deficit that's going on right now. And so next year when we come to this show, we better see some improvement in terms of their understanding what the attack vectors are that are different with generative AI systems, how they need to improve their technology to protect against them, because humans can't do that. The technology vendors have to build the weapons to go win that war. So when are you going to build those weapons, guys?

>> So the other thing I wanted to ask your opinion about is coming from your recent consulting world. I was talking to somebody about the market size and security the other day. It's probably, I said it was 150. Somebody said, "No, it's around..." I think it was Howie Hsu. He said, "It's around 200 billion and 50% is services and the balance is hardware and software." And I said, "Okay, that's about right." Like many markets, services dominates. It's also a testament to or underscores the complexity in this market. It's a big services opportunity. I've had the opportunity to do many services engagements. I've only done one in my life on cyber. Literally, one, for a very large beverage manufacturer. And this was probably 20 years ago. What it was at the time, David, and you'll appreciate this, is essentially we were brought in, we had a network of folks and we brought in some SecOps experts, but it was essentially a checkbox item so they could present to the board that they had this book that said they had these policies and everything else, and it was sort of what best practices. We did some analysis in terms of maturity, where they are and what's feasible and roadmaps and the typical consulting stuff. But the outcome was a book that they could show people and say, "Check. We did that." That would be a disaster in today's world. The type of work that services organizations and consultants do today, much more impactful to the business. So bring your consulting knowledge to the table. What does that world look like in this gen AI era? How would you approach it from assessment and identification and maybe rationalization? How would you approach this as a consultant?

David Linthicum

>> I think a lot of the books have to be thrown out the window. But the thing is, that's what we did at the time. We have checklists like check, check, check, encryption standards, different industry checks, different compliance checks, things like that. Those are completely gone. Everything has to be bespoke to the particular problem, the main you're looking to solve. And they all look different. People are talking about the generative AI architectures and common mechanisms to do it. And I'm seeing these common frameworks that are out there. It doesn't look like that in real life, Dave. It's very complex. It's always one-off. It's always going to have something that's going to be annoyingly different based on what other people are working on. You have to have smart people around to make the calls. You have to have AI architects, but certainly security engineers, AI engineers, data scientists, people who are able to look at the multi-dimensions of these things and make sure that we're putting the right security checks into these things. And that doesn't seem to be occurring now. I'm even concerned about the larger consulting firm's ability to step up and make that play because we don't have a lot of skills out there now. If you notice, we have a huge shortage. Probably there's 10 jobs chasing one qualified candidate right now. So we have to, in essence, do what we can with the skillsets that we have, but we have to think very much more sophisticated than we're doing now, look at the components of it, look at the bespoke nature of it, understand that it's going to be a dynamic changing, continuously learning, thinking. And that's the only way we're going to solve this problem. If we try to approach it with these cookie cutter things, we're going to fail each and every time.

>> One of the things I have done a lot in my life is a lot of application rationalization exercises and projects and consulting gigs, literally hundreds. If I think about doing that for security, it's a different animal. Because in application rationalization, you can define business value of an application. You can look at it a number of ways, users, usage. What happens when the application goes down? Is it revenue driving? Is it productivity enhancing? Is it risk mitigation, which really security is? But if I think about it now, a security portfolio, it's protecting data, it's protecting applications, it's tying into business processes. So there's a way to plug it in and tie it to business value. But then the application rationalization, now we're going to unplug that. We're going to just let it die. I'm not sure how you approach security tooling rationalization. It's almost like I'm afraid to pull the plug on that one just in case. I could cause the company some serious damage. How do you think about rationalization in that context?

David Linthicum

>> It's a huge issue. Complexity is the biggest battle that I think these security folks are trying to fight. They have existing legacy systems. RACF for example. I've been in there for 30 years. They're still-

>> Resource Access Control Facility for those of you who don't know.

David Linthicum

>> There you go. There you go. Ding, ding, ding, ding, ding. You're an old timer. So our ability to use all these technologies in a functional way is going to really go to our benefits and our ability to solve these issues. So we're going to have to learn how to depurpose some of these things. Some of these things are going to have to be turned off. We can't run this stuff into ubiquity where we're running just a multitude of different security systems that we're paying for because we're going to get to a level of complexity in terms of the security solutions out there that it's going to be unmanageable. Now security managers come into play. They allow us to leverage abstraction to manage these things through abstract services, single span of controls, single source of truth and all those sorts of things. But we're still dealing with the complexity and efficiency of these systems. We're paying license fees for all this stuff. This is a huge cash drain on the business. So I think we need to have the bravery to look at some of these things as to what their ultimate value is and be able to turn them off. And I think decommissioning some of this stuff is perfectly to make that happen. You may replace it with something better. You may combine the services with other different technologies, but those discussions aren't happening right now for the same reason you brought up. "Am I really looking to bet my career on unplugging this thing and watching the whole world blow up and then it's my fault?" But I think we're going to have to have some brave conversations out there with some CISOs and some CIOs. We're going to have to do this stuff because ultimately we're going to get to an untenable situation.

>> But unfortunately, the CIO gets stuck paying for it even though the business value might not be there, but everybody's afraid to unplug it. We're joking about RACF, but I wanted to bring this up because. So RACF was IBM's security capability in mainframes, and it was awesome. I mean, you knew who had access, who did what, when, where. You had full auditability. And everything because it was a confined system was discoverable and you just knew everything. You had great visibility on what was going on. That ain't the case today, right? There's so much complexity. You've got multiple observability vendors. Some can do a lot, some are really specialized, but there is no one equivalent in today's complex world. Cloud, on-prem, multi-cloud critical infrastructure. There's no today equivalent of RACF that exists. So what it is, you have to cobble together, build your own essentially RACF, and there's just a lot of holes in that. What do you think of that analogy?

David Linthicum

>> I think it's an apt analogy because right now we talked about the complexity problem. People don't have visibility into the core security systems. And one of the great things about using something like that was the point you pointed out, everything was centralized, everything was kept in single location. That's not the case right now. These directories, these repositories, these encryption standards, they're all scattered wide. People are using whatever native security is most convenient for them on the cloud provider. That's something else they have to manage. And they really have no underpinning way of observability across these systems. So you talk about management of these systems, but they can see them turn red and turn green. That's not management. Your ability to look at the performance, your ability to look at this capability to secure the data in a certain way, your ability to expand, to adapt to different attacks that are occurring, all these sorts of things are vulnerability right now. I really think that the vulnerability is not within the single narrow domain of the tools. It's the ability for the attackers to get in there and figure out how to exploit one tool versus the other and how to get in between these little points of integration. And we need to have common services and common mechanisms to see this happen. That doesn't exist today. And that would be a great problem for a vendor to go solve. The observability vendors would be the short list there. Right now they're looking at operational observability, data management observability. How about security observability with the sec-op stuff? Everybody thinks they have a solution out there. When I ask them about their span of control and their span of views, they can only see a certain number of things and they're going to tell you that you need some other observability tools. See the rest of the stuff and another observability tool. See the rest of the stuff. Where can we do this under one abstraction level and see it in one place and look for one single point of class?

>> I got a fun one for you. I want to pick your brain on this. So I heard Elon earlier this week. He was talking at the Milken Institute and he said something to the effect of within, "Let's call it five years." I think it was even less. Only 1% of intelligence will be biological intelligence, human intelligence, 99% will be machine intelligence. It's like, "Okay, so I guess he's talking about AGIs-like. Okay, fine." At that point, is it essentially take the defender and the adversary dynamic that exists today? You take that to the machines and then you have AI, which is smart enough to build the RACF for today's environment, but then you have another AI that's attacking that's smarter than that AI, and the AIs just keep getting better and better and better. And we just take that the entire dynamic that we know today of ping-ponging the arms race to the machine intelligence world. How do you see that playing out?

David Linthicum

>> I think that's where we're going. When you think about this, it's going to be spy versus spy. And I think looking at the security experts out there, they keep coming around to that. And so in other words, it's going to be the ability to have an attack that's fueled from AI, that's refueled through defensive through the same AI level. And so it's going to be, "We're thinking about this vector. We're going to try this vector. Oh, this seems to be working. Oh, we shut this down" and they're going to try something else again. And I'm not sure where that ends. And so everybody's getting smarter. "We're going to build up the intelligence and becoming a better attacker versus a better defender." And so we have to make decisions to look at innovative technology able to get us beyond that and able to figure out how to solve that problem. I don't think we're going to win the security war by fighting it out in mano a mano with all the security threats that are out there. I think this is about thinking very different, very bigger, coming up with new innovative stuff that doesn't exist now. We're not talking about it. But if we're defending against that, I don't see the technology existing that's going to stop us from just scaling that stuff up until it's going to be overly costly, overly difficult to deploy.

>> One of the things that really scares me, I'll get your thoughts on this, is exceedingly intelligent weapons, drones in particular, that somebody could basically build inside the perimeter let's say of the United States or any country and then set it loose on critical infrastructure. I mean, I could see we're so worried about the digital and the digital cyber attacks, but the physical attacks could escalate as you get hyper intelligent, sorry to use that phrase, but exceedingly intelligent systems, drones or other weapons, that could attack critical infrastructure.

David Linthicum

>> That is scary. And that is coming. Hopefully we did hear from the government yesterday, we did hear from Mayorkas who's running Homeland Security and his ability to look at cyber information attacks, things like that, I hope they're having conversations that are getting to that level of seriousness because we do have exposure starting to arise through the accessibility of AI systems that bad actors can really access for free and the ability to defeat security systems that quite frankly are outdated in many instances, easy to defeat. So what are we thinking about? Are we waiting for something to happen before we react upon that where we do get into this next level of intelligence to really kind of defend against that? Or are we going to do this proactively? My challenge is for these security folks to do this proactively, to get this in place now, or else we are going to have an event that we're not going to enjoy very much.

>> David, thanks for kicking off Day 3 with me. You've kicked off every day this week. Appreciate your insights. And if you're brave enough, go back over and see what you can see in north and south of the exhibit floor. Yeah, he's saying, "Yeah, I'm there." All right, we'll have you back and see what you learned then. Keep it right there, everybody. We're kicking off Day 3 from RSAC 2024. We're here in Moscone West and you're watching theCUBE.

Keynote Analysis, Day 3

search

>> Hi everybody. Welcome to theCube's Day 3 coverage of RSA Conference 2024. We're here in Broadcast Alley in Moscone West. David Linthicum and I are going to break down what we've seen so far. David, it's been a huge show. The first time for you at RSA.

David Linthicum

>> First time for me, and I have some PTSD from the expo.

>> It's pretty insane, right?

David Linthicum

>> Oh, God.

>> You were just over the expo flow. What was that like?

David Linthicum

>> It's probably the most amount of humanity I've ever seen since Comdex like in the '90s when everybody kind of showed up to that as kind of the Woodstock of the technology world. And everybody's there for the same reason. They're really kind of confused about security and they're trying to figure out what are the partners that they need to partner with to make their security stuff work. So it was just a number of confluence of people who were providing great information. People were asking inquisitive questions. I witnessed to very deep conversations. Enterprises are looking for that one tool that's going to take them over the path. I don't think they exist, but they're hoping that it exists. So there's a lot of confusion meets innovation. I think that's the best way to describe this conference.

>> Yeah. As you know, we did the survey with ETR prior to RSA. 50% of the 321 respondents were actually attending RSA. And one of the questions was, "What are you most excited about seeing at RSA? What are you going there to learn about?" And the two top things were AI and LLM security, and the second one was zero trust network access. Now how do you interpret that data? When I saw it, I was like, That's interesting, two hot areas." But the flip side of that is they're actually still in learning mode and the adoption of both AI or security for AI, which is kind of a new theme this year, as opposed to using LLMs or the bad guys using LLMs. So that's kind of new, something we can talk about. And then zero trust as we know, everybody's on that journey. Nobody's really achieved, or very few have actually achieved a full zero trust. So the point is, folks are here for education in the early adoption phases. That's how I interpret this data. What do you think about that and what have you seen on the floor that's either supports or refutes that?

David Linthicum

>> No, I think you're spot on. But the thing is, I would even extend it further. Everybody is here who's an attendee, a consumer of technology, is here for education. They're trying to figure out how to take their knowledge to the next level. But I think the vendors are here for education as well. Everybody I talked to, a little confused about what this AI stuff means. They were confused about how they're supposed to protect AI models versus traditional data. There was very few of them that could explain to me how their stuff is unique to specific to AI. So what's been done is they repurposed all their data security stuff for AI knowledge engines, looking at AI knowledge engines, just another source of data. That's not how they exist. They can be be hacked from within, they can have prompt level hacks, all these sorts of things are there as vulnerabilities. And then they admit and said, "We're learning. We just got into this a year ago. We're trying to figure out how to make this stuff work." So everybody out there is learning at the same time. But at the same time, they're trying to spin the market and put their stuff out there trying to AI wash their existing security stuff. So AI is written on everything. Usually it looks like a piece of tape stuck over the logos, but it's exciting to see. But I think it's okay that everybody's in learning mode. It's going to take us a while to figure this stuff out.

>> Well, it is really interesting too to see the, it's like a sort of barbell with actually a big fat bar because you've got established security players like Palo Alto, like Cisco, CrowdStrike up and coming and really well established. Microsoft's just everywhere. And at the other end of the spectrum you've got all these startups sort of attacking those companies. Take for instance, Zscaler. ZScaler's doing incredibly well. They're the pure play SASE vendor. And then you talk to another startup going, "No, no, they have it all wrong. We're going to solve this problem differently." You got startups saying firewalls are dead. You've got Palo Alto announcing some new sort of automation to firewalls. So Cisco bringing the network and the AI and the security together with something they call hyper something, hyper network AI. Jeetu Patel's coming on later, and he's going to talk about that. HyperShield is what it's called. And so you really get lost in all the marketing and all the noise and all the buzzwords, so my question to you is, how do you as a practitioner extract the signal from the noise?

David Linthicum

>> I think we have to do some deeper research and some deeper planning. I mean the articles you write where we're looking at the data as to what people are looking for specifically really needs to be taken heat by the vendors out there. I don't think not enough of that is going on. So they're doing what they think they need to do. They're not doing a lot of deep analysis. And so they're not asking the questions, they're not communicating with the end users. People are consuming this technology, not down working with the enterprises on building these systems and getting them out and deployed. I think that's where the thing lies. I think the problems having come from the consulting angle, I've been an enterprise architect for so many years, is very different than the way that the vendors see them. And I don't think the enterprises are good at externalizing that information to them. And so that bridge needs to be built. I like your barbell analogy by the way. It needs to be built so we're able to bring that knowledge and the people are able to react upon it. And so this becomes a bit of advice that I always tell them, "I think you need to go slower to go faster. You need to understand where you're looking to do in order to build the solutions that people are looking for. And I think those are very different than what you think they are now based on what I'm seeing on your poster board behind you." And so they agree. They agree. They think they need to reset and repivot, but right now they also tell you that, "We're scared." They said, "We'd never seen a market wave like this come up, a tsunami, big time, came up faster than cloud, faster than service oriented architecture, faster than integration, faster than client server. All these other trends that we saw in the past and that we're afraid we're going to miss it. And we've missed some market positions before." Certainly the older companies out here with rise of the internet, things like that, they don't want to miss this. And so they're trying to get out there with everything and anything and throwing resources on it.

>> One of the things that's different this year, and it's pretty noticeable, I think, I'd love to get your thoughts on this. So last year everybody was talking about gen AI, AI this, AI that, big conversation around attackers using gen AI to write better phishing emails. A lot of talk about embedding AI into whatever product, network products, security products, et cetera, to bring automation. This year there's a lot more discussion and some solutions. I don't know about solutions, but some early products to secure AI. Basically, the premise is AI, gen AI is different. It expands the attack surface. It's natural language based, so it creates different new novel exposures so we have to treat security differently. So I've talked to a number of startups, I'd say four or five that are actually attacking that problem. Some of the larger players are at least acknowledging it, saying, "Yeah, yeah, we're going to take care of that. Don't worry." But that's new this year. Discernible difference, in my mind anyway, incremental from last year.

David Linthicum

>> You just hit the nail on the head. That's the fundamental deficit I think we're running this year. I don't think the vendors out there understand how to secure these environments. They're very different. They're treating them like data like we discussed earlier. But the attack vectors, the ability to get at these systems is multiple dimensional. It's not from the outside in, it's through the internal systems, your ability to put harmful knowledge into them, your ability to put time bombs into them, your ability to do things that people really haven't thought of. And a lot of those attacks are occurring now. We're finding them all the time. We just don't have them built in systems that are significant enough to do significant damage. Now these enterprises are moving to these things where they're going to bet their business on building these LLMs and also using common LLMs, things like Gemini and OpenAI and things like that. And in doing so, the ability to secure those systems needs to occur before you build them. And you need to have the technology to make it occur before you roll this stuff out. You need the vendors that are viable to get in there to build those things out. I don't see the knowledge out there as I'm asking the questions. I see a look of confusion when I start talking about the unique needs of AI. But I think they understand deep down that it's different. They probably haven't put enough thinking into it and how to make it work, how to make it play. And I think that's the deficit that's going on right now. And so next year when we come to this show, we better see some improvement in terms of their understanding what the attack vectors are that are different with generative AI systems, how they need to improve their technology to protect against them, because humans can't do that. The technology vendors have to build the weapons to go win that war. So when are you going to build those weapons, guys?

>> So the other thing I wanted to ask your opinion about is coming from your recent consulting world. I was talking to somebody about the market size and security the other day. It's probably, I said it was 150. Somebody said, "No, it's around..." I think it was Howie Hsu. He said, "It's around 200 billion and 50% is services and the balance is hardware and software." And I said, "Okay, that's about right." Like many markets, services dominates. It's also a testament to or underscores the complexity in this market. It's a big services opportunity. I've had the opportunity to do many services engagements. I've only done one in my life on cyber. Literally, one, for a very large beverage manufacturer. And this was probably 20 years ago. What it was at the time, David, and you'll appreciate this, is essentially we were brought in, we had a network of folks and we brought in some SecOps experts, but it was essentially a checkbox item so they could present to the board that they had this book that said they had these policies and everything else, and it was sort of what best practices. We did some analysis in terms of maturity, where they are and what's feasible and roadmaps and the typical consulting stuff. But the outcome was a book that they could show people and say, "Check. We did that." That would be a disaster in today's world. The type of work that services organizations and consultants do today, much more impactful to the business. So bring your consulting knowledge to the table. What does that world look like in this gen AI era? How would you approach it from assessment and identification and maybe rationalization? How would you approach this as a consultant?

David Linthicum

>> I think a lot of the books have to be thrown out the window. But the thing is, that's what we did at the time. We have checklists like check, check, check, encryption standards, different industry checks, different compliance checks, things like that. Those are completely gone. Everything has to be bespoke to the particular problem, the main you're looking to solve. And they all look different. People are talking about the generative AI architectures and common mechanisms to do it. And I'm seeing these common frameworks that are out there. It doesn't look like that in real life, Dave. It's very complex. It's always one-off. It's always going to have something that's going to be annoyingly different based on what other people are working on. You have to have smart people around to make the calls. You have to have AI architects, but certainly security engineers, AI engineers, data scientists, people who are able to look at the multi-dimensions of these things and make sure that we're putting the right security checks into these things. And that doesn't seem to be occurring now. I'm even concerned about the larger consulting firm's ability to step up and make that play because we don't have a lot of skills out there now. If you notice, we have a huge shortage. Probably there's 10 jobs chasing one qualified candidate right now. So we have to, in essence, do what we can with the skillsets that we have, but we have to think very much more sophisticated than we're doing now, look at the components of it, look at the bespoke nature of it, understand that it's going to be a dynamic changing, continuously learning, thinking. And that's the only way we're going to solve this problem. If we try to approach it with these cookie cutter things, we're going to fail each and every time.

>> One of the things I have done a lot in my life is a lot of application rationalization exercises and projects and consulting gigs, literally hundreds. If I think about doing that for security, it's a different animal. Because in application rationalization, you can define business value of an application. You can look at it a number of ways, users, usage. What happens when the application goes down? Is it revenue driving? Is it productivity enhancing? Is it risk mitigation, which really security is? But if I think about it now, a security portfolio, it's protecting data, it's protecting applications, it's tying into business processes. So there's a way to plug it in and tie it to business value. But then the application rationalization, now we're going to unplug that. We're going to just let it die. I'm not sure how you approach security tooling rationalization. It's almost like I'm afraid to pull the plug on that one just in case. I could cause the company some serious damage. How do you think about rationalization in that context?

David Linthicum

>> It's a huge issue. Complexity is the biggest battle that I think these security folks are trying to fight. They have existing legacy systems. RACF for example. I've been in there for 30 years. They're still-

>> Resource Access Control Facility for those of you who don't know.

David Linthicum

>> There you go. There you go. Ding, ding, ding, ding, ding. You're an old timer. So our ability to use all these technologies in a functional way is going to really go to our benefits and our ability to solve these issues. So we're going to have to learn how to depurpose some of these things. Some of these things are going to have to be turned off. We can't run this stuff into ubiquity where we're running just a multitude of different security systems that we're paying for because we're going to get to a level of complexity in terms of the security solutions out there that it's going to be unmanageable. Now security managers come into play. They allow us to leverage abstraction to manage these things through abstract services, single span of controls, single source of truth and all those sorts of things. But we're still dealing with the complexity and efficiency of these systems. We're paying license fees for all this stuff. This is a huge cash drain on the business. So I think we need to have the bravery to look at some of these things as to what their ultimate value is and be able to turn them off. And I think decommissioning some of this stuff is perfectly to make that happen. You may replace it with something better. You may combine the services with other different technologies, but those discussions aren't happening right now for the same reason you brought up. "Am I really looking to bet my career on unplugging this thing and watching the whole world blow up and then it's my fault?" But I think we're going to have to have some brave conversations out there with some CISOs and some CIOs. We're going to have to do this stuff because ultimately we're going to get to an untenable situation.

>> But unfortunately, the CIO gets stuck paying for it even though the business value might not be there, but everybody's afraid to unplug it. We're joking about RACF, but I wanted to bring this up because. So RACF was IBM's security capability in mainframes, and it was awesome. I mean, you knew who had access, who did what, when, where. You had full auditability. And everything because it was a confined system was discoverable and you just knew everything. You had great visibility on what was going on. That ain't the case today, right? There's so much complexity. You've got multiple observability vendors. Some can do a lot, some are really specialized, but there is no one equivalent in today's complex world. Cloud, on-prem, multi-cloud critical infrastructure. There's no today equivalent of RACF that exists. So what it is, you have to cobble together, build your own essentially RACF, and there's just a lot of holes in that. What do you think of that analogy?

David Linthicum

>> I think it's an apt analogy because right now we talked about the complexity problem. People don't have visibility into the core security systems. And one of the great things about using something like that was the point you pointed out, everything was centralized, everything was kept in single location. That's not the case right now. These directories, these repositories, these encryption standards, they're all scattered wide. People are using whatever native security is most convenient for them on the cloud provider. That's something else they have to manage. And they really have no underpinning way of observability across these systems. So you talk about management of these systems, but they can see them turn red and turn green. That's not management. Your ability to look at the performance, your ability to look at this capability to secure the data in a certain way, your ability to expand, to adapt to different attacks that are occurring, all these sorts of things are vulnerability right now. I really think that the vulnerability is not within the single narrow domain of the tools. It's the ability for the attackers to get in there and figure out how to exploit one tool versus the other and how to get in between these little points of integration. And we need to have common services and common mechanisms to see this happen. That doesn't exist today. And that would be a great problem for a vendor to go solve. The observability vendors would be the short list there. Right now they're looking at operational observability, data management observability. How about security observability with the sec-op stuff? Everybody thinks they have a solution out there. When I ask them about their span of control and their span of views, they can only see a certain number of things and they're going to tell you that you need some other observability tools. See the rest of the stuff and another observability tool. See the rest of the stuff. Where can we do this under one abstraction level and see it in one place and look for one single point of class?

>> I got a fun one for you. I want to pick your brain on this. So I heard Elon earlier this week. He was talking at the Milken Institute and he said something to the effect of within, "Let's call it five years." I think it was even less. Only 1% of intelligence will be biological intelligence, human intelligence, 99% will be machine intelligence. It's like, "Okay, so I guess he's talking about AGIs-like. Okay, fine." At that point, is it essentially take the defender and the adversary dynamic that exists today? You take that to the machines and then you have AI, which is smart enough to build the RACF for today's environment, but then you have another AI that's attacking that's smarter than that AI, and the AIs just keep getting better and better and better. And we just take that the entire dynamic that we know today of ping-ponging the arms race to the machine intelligence world. How do you see that playing out?

David Linthicum

>> I think that's where we're going. When you think about this, it's going to be spy versus spy. And I think looking at the security experts out there, they keep coming around to that. And so in other words, it's going to be the ability to have an attack that's fueled from AI, that's refueled through defensive through the same AI level. And so it's going to be, "We're thinking about this vector. We're going to try this vector. Oh, this seems to be working. Oh, we shut this down" and they're going to try something else again. And I'm not sure where that ends. And so everybody's getting smarter. "We're going to build up the intelligence and becoming a better attacker versus a better defender." And so we have to make decisions to look at innovative technology able to get us beyond that and able to figure out how to solve that problem. I don't think we're going to win the security war by fighting it out in mano a mano with all the security threats that are out there. I think this is about thinking very different, very bigger, coming up with new innovative stuff that doesn't exist now. We're not talking about it. But if we're defending against that, I don't see the technology existing that's going to stop us from just scaling that stuff up until it's going to be overly costly, overly difficult to deploy.

>> One of the things that really scares me, I'll get your thoughts on this, is exceedingly intelligent weapons, drones in particular, that somebody could basically build inside the perimeter let's say of the United States or any country and then set it loose on critical infrastructure. I mean, I could see we're so worried about the digital and the digital cyber attacks, but the physical attacks could escalate as you get hyper intelligent, sorry to use that phrase, but exceedingly intelligent systems, drones or other weapons, that could attack critical infrastructure.

David Linthicum

>> That is scary. And that is coming. Hopefully we did hear from the government yesterday, we did hear from Mayorkas who's running Homeland Security and his ability to look at cyber information attacks, things like that, I hope they're having conversations that are getting to that level of seriousness because we do have exposure starting to arise through the accessibility of AI systems that bad actors can really access for free and the ability to defeat security systems that quite frankly are outdated in many instances, easy to defeat. So what are we thinking about? Are we waiting for something to happen before we react upon that where we do get into this next level of intelligence to really kind of defend against that? Or are we going to do this proactively? My challenge is for these security folks to do this proactively, to get this in place now, or else we are going to have an event that we're not going to enjoy very much.

>> David, thanks for kicking off Day 3 with me. You've kicked off every day this week. Appreciate your insights. And if you're brave enough, go back over and see what you can see in north and south of the exhibit floor. Yeah, he's saying, "Yeah, I'm there." All right, we'll have you back and see what you learned then. Keep it right there, everybody. We're kicking off Day 3 from RSAC 2024. We're here in Moscone West and you're watching theCUBE.