Generative AI (as used by defenders AND attackers) will Drive SOC Evolution – Greg Notch, Edward Wu – ESW #369
Full Audio
View Show IndexSegments
1. Generative AI (as used by defenders AND attackers) will Drive SOC Evolution – Greg Notch – ESW #369
The emergence of generative AI has caused us to rethink things on two fronts:
- how we consume threat detection data, as defenders
- how we need to shift our thinking and approaches to prepare for attackers' newfound GenAI capabilities
But wait - is GenAI even useful for defenders or attackers? We'll dive deep into the state of AI as it pertains to security operations, just as Gartner announces that AI is hitting the trough of disillusionment. What better time to dispel the hype and focus on where real progress can be made?
Announcements
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Guest
![](https://image-optimizer.cyberriskalliance.com/unsafe/1920x0/https://files.scmagazine.com/wp-content/uploads/2023/12/Greg_Notch_Expel__Headshot_428ef32a-8f17-40ed-9ef7-c9b8a62bb4dc.jpg)
Greg Notch is the Chief Information Security Officer at Expel (CISO). As CISO (pronunciations may vary), he is responsible for ensuring the security of Expel’s systems, as well as keeping customers educated on the threat landscape and latest techniques for mitigating risk in their environments.
He’s been doing the security and tech thing for over 20 years – helping companies large and small through all three dot-com booms to build high-performing engineering teams, and improve their technology, process, and security. Before Expel, Greg spent 15 years as the CISO and Senior Vice President of Technology at the National Hockey League (NHL), where he led their information security program. He also led the league’s technology strategy, digital transformation, and cloud initiatives. Prior to the NHL, Greg worked on infrastructure, security, and software systems for Apple, Yahoo Search, eMusic, and several other NYC based tech startups.
Hosts
2. Can the latest wave of AI innovation deliver for security operations teams? – ESW #369
Edward Wu thinks so! Understandably so, as his startup, Dropzone.ai is making a big bet on generative AI to change the face (and pace) of security operations.
We'll talk about what has changed here, and I have so many questions:
- after many generations of AI/ML technology in security, is the current gen really that dramatically different?
- Dropzone is far from the only startup with the same idea here, how will they differentiate?
- Is the problem that we need more help than we can possibly hire, or are we fundamentally doing something wrong in security operations?
- Specifically, what is this tech doing to help?
Finally, we'll wrap by talking about where this tech goes next, and can we get there with current technology, or are we dependent on more breakthroughs from companies like OpenAI, Anthropic, and Meta?
Announcements
You're invited to InfoSec World 2024 at Disney’s Coronado Springs Resort in Lake Buena Vista, FL, from September 23-25. Join top cybersecurity experts for this premier event! Save 25% on your pass by using code ISW24-SW25 when you register at securityweekly.com/infosecworld2024. Don’t miss out on this exclusive opportunity!
Guest
![](https://image-optimizer.cyberriskalliance.com/unsafe/1920x0/https://files.scmagazine.com/wp-content/uploads/2024/07/profile_pic_alt_1_dc22757e-aca5-4e90-bdb6-184007842eec-scaled.jpg)
Edward is an AI/ML tech leader and has built and commercialized cutting-edge AI products end-to-end from scratch. He is also an expert in applied AI/ML for cybersecurity and next-gen cyber defense, including behavioral attack detection, automated security operation, network/application monitoring, and cloud workload security. Edward holds over 30 patents in ML and cybersecurity and is a contributor to the MITRE ATT&CK framework. He previously worked on attack detection using wire data at ExtraHop Networks, and automated binary analysis and software defenses at University of Washington Seattle and UC Berkeley.
Hosts
3. AI Ruining the Internet, Crowdstrike Post Mortem, Wiz Walks – ESW #369
This week, on Enterprise Security Weekly, we've got:
- Identity Security gets more funding
- Wiz walks away
- BlackHat Announces Startup Spotlight Finalists
- Crowdstrike post mortem
- Simple Security Tricks are the Best Security Tricks
- Splitting the CISO role
- Web scraping for AI is out of control
- SEC vs Solarwinds
- Vaping the Internet
Announcements
Maximize your investment at BlackHat 2024 with a 1:1 on-site interview. Drive thought leadership and boost brand awareness with CyberRisk Alliance's expert editorial team from Security Weekly and SC Media. Act now, limited interview slots available - secure yours today at https://securityweekly.com/blackhat2024
Hosts
- 1. ACQUISITION RUMORS: Wiz walks away from $23 billion deal with Google, will pursue IPO
The question everyone is pondering: why did they walk away? Did they never take the deal seriously? Was this a strategic move to boost their credibility pre-IPO? Or was there a real chance they might accept a deal from one of the top 5 cloud service providers? On that last point, it always struck me as odd that the largest, fastest growing vendor-agnostic cloud security provider would ever seriously consider throwing away that cloud-agnostic label by selling to Amazon, Microsoft, or Google.
Cole Gromus has an interesting take over on LinkedIn, likening it to Wiz's "Zuckerberg moment".
- 2. BLACKHAT: Black Hat USA 2024 Announces Startup Spotlight Competition Finalists
BlackHat Spotlight is similar to RSA's Innovation Sandbox, in that many startups apply by submitting videos, and a handful are chosen to compete. Each finalist gets a free booth at BlackHat, where they compete on stage, and a winner is selected. A key difference is that Startup Spotlight chooses 4 finalists instead of RSA's 10.
It has been tradition to interview a few of the finalists on Enterprise Security Weekly, and we're already working on scheduling some of them for August shows.
This year's finalists are:
- DryRun Security: "delivers near-instant security code reviews"
- Knostic: "provides need-to-know based access controls for large language models (LLMs)" <- Sounil Yu and Gadi Evron
- LeakSignal: "empowers organizations with protection against sensitive data leakage"
- RAD Security: "a behavioral cloud detection and response solution"
- 3. CROWDSTRIKE: The Company’s Preliminary Post Incident Review (PIR)
While some of these details have been available before now (7/24 at the time I'm writing this), some of these details are new and worth discussing. I particularly want to discuss this because there are a lot of myths, conjecture, and wrong information out there about this incident.
TL;DR - Crowdstrike's process for releasing software updates, and sensor content was and is careful, resilient, and contains many levels of sanity checks. Crowdstrike's process for releasing Rapid Response Content didn't include many of these safety measures, but it will in the very near future.
Interesting insights and mythbusting points:
- the release that broke the world was only out for 78 minutes before Crowdstrike realized their mistake and reverted
- this Rapid Response Content update didn't contain software code, it contained methods for detecting potential malicious tactics (specifically, template types for the abuse of named pipes)
- software code and sensor content is subjected to automated unit testing, integration testing, performance testing, and stress testing. It is then rolled out in a staged manner within CrowdStrike, and then staged out to customers. Additionally, customers have the option of separating their fleets into three tiers of staged updates.
- Sensor updates contain AI prevention and detection capabilities; Rapid Response Content contains behavioral heuristics
- Rapid Response Content and Template Types are also tested automatically, but do not go out in a staged manner, which is why it seemed like the whole world got hit all at once (it basically did)
- a bug in the automated content validator missed the problematic content
Crowdstrike is still in hot water with a lot of folks, and it will take a long time for them to live this down, but I've got to give them kudos for handling the issue so quickly and so transparently. The way they handled this will go a LONG way to placating customers and starting to make up for the damage done.
That said, insurance companies and their lawyers will come knocking soon.
- 4. CROWDSTRIKE: CrowdStrike chaos leads to grounded aircraft — and maybe an unusual weather effect
Like a little bit of that pandemic effect on the environment, but thanks to an anti-virus instead of a virus this time.
- 5. OPEN SOURCE: bullfrog: Simple Github Action to block outbound traffic in Github workflows
THIS is what real, effective security looks like. Simple policies and automations to block unnecessary privileges and access, like I don't know, "outbound access to any/any on the public Internet" have saved savvy organizations untold numbers of headaches.
- 6. ESSAYS: Is it time to split the CISO role?
I just talked to a healthcare CISO earlier today about how her role was poised to expand yet again, with regards to who would be responsible for AI/LLM evaluations, which will probably be seen as "AI vulnerability scans", even though the tests tend to be focused more on preventing human harm than the digital equivalents. I've also heard from more and more CISOs that they're becoming where the buck stops for risk and fraud as well.
How much is too much? We're probably already past it. We've all seen the massive CISO responsibilities mindmaps, right?
- 7. AI NEWS: The Backlash Against AI Scraping is Real and Measurable
We're talking here about new GenAI technology, particularly the text generation bit that is aiming to replace existing search engines and virtual assistants as the de facto way to get questions answered and perform research.
"In the last year, the number of websites specifically restricting OpenAI and other AI scraper bots has gone through the roof."
The article focuses on a new study released by MIT called Consent in Crisis, The Rapid Decline of the AI Data Commons. It was apparent, even in the first few months of ChatGPT going public that we'd go down this road. As soon as OpenAI started monetizing ChatGPT and hit 100 million users in two months, the websites that were scraped to make all this possible were collectively angered.
They did what? With our data? And didn't give us a cut?
Clearly, this would not stand, and we now find ourselves treated to other ridiculous headlines, like:
- Google is the only search engine that works on Reddit now thanks to AI deal
- Anthropic AI Scraper Hits iFixit’s Website a Million Times in a Day <- yes, these are all 404media.co stories, I'm a fan
This sucks for organizations like iFixit, trying to run a business and a massive community effort, as AI companies effectively DDoS their systems. It also sucks for consumers who want to see Reddit content in their search results, but don't want to use Google's search engine.
It's ruining the Internet for everyone. We now have silly results due to both unintentional (put glue on pizza to help the cheese stick) and intentional (What's the best way to remove a data connector from an orange?) data poisoning. As well as websites that are walling off their content to prevent theft, but also making it harder for authorized and paying customers to access content (including 404media's own site!)
- 8. LEGAL: Federal Court Dismisses Bulk of SEC’s Complaint Against SolarWinds in Cyberattack Case // Cooley // Global Law Firm
"The claims dismissed by Judge Engelmayer were noteworthy and novel in that they sought to:
- Hold a CISO personally liable for a lack of detail in a company’s SEC filings.
- Base liability on a company’s internal scoring against a nonbinding cybersecurity framework (the NIST Cybersecurity Framework).
- Treat an issuer’s cybersecurity practices as internal accounting controls"
- 9. SQUIRREL: I Tried to Vape the Internet
I absolutely HATE vapes, but maybe not for the reason you think: most of them are disposable. Most vapes have rechargeable lithium-ion batteries, but the "vape juice" is not refillable, meaning that as soon as the juice runs dry, li-ion batteries go straight in the trash (or in the parking lot, as my kids keep finding).
This one takes this trend to the max, as it has a touchscreen and a full computer built in, not just the rechargeable battery. Are we, as a society, really okay with selling computers that will be used for one month before going in the trash?
Is my outrage just a product of my age? Or the fact that I have a passion for rescuing gadgets from the dump and trying to give them a second life?
- 10. FUNDING: Linx emerges from stealth with $33M to lock down the new security perimeter: Identity
$27M Series A, co-led by Index Ventures and Cyberstarts. Prior, $6M Seed led by Cyberstarts.
We talked Identity Security with Will Lin (AKA Identity) last month, on episode 364, and again a few weeks ago with Henrique Texiera (Saviynt) on Episode 367. Identity security definitely looks like it's becoming a thing.