AI, Ransomware, & The Security Poverty Line - with Randy Rose: täielik transkriptsioon

just financial, but people resources, training resources, right? Getting all of that stuff aligned in a way that actually has real impact in reducing risk and building resilience. Those are probably the things that I think about a lot more than, you know, The overall state of cyber in general. there's always things to worry about, right? It's like Aaron Mog: Always. It's a never-ending pit of despair some days. Randy Rose (CIS): Yeah. Aaron Mog: so part of the way that you get visibility into that the ecosystem is is the MSI SAC. And I'm not gonna take for granted everybody knows what that is. Maybe you could just level set like what is that? What is its charter? Why do you do it? Like what is what is MSI SAC? And you certainly touch on election too, but just as like a concept, what is that? Randy Rose (CIS): Yeah, I mean high level really it goes back to the the late nineties. so under President Clinton there was a what's called a PDD, a presidential decision directive that was written to try to align critical infrastructure with which much of which is run privately or you know not at the federal level, to try to align some of the the risk and resilience with the federal government. So PDD sixty-three, if anyone's interested in looking it up, PDD63 laid it all out and talked about a national risk management council and what this would look like to to encourage public private sharing with the federal government at the time. And it introduced the concept of an ISAC, which is an information sharing and analysis center. And the idea behind these was they'd be privately run. And they would they would, you know, they would be focused on critical infrastructure. At the time, we didn't have critical infrastructure really well defined. Today you can go to the DHS CESA website and look up. Critical infrastructure and all the region of the 16 sectors, and you know, you got water sector and chemical sector and agriculture and energy, government facilities, things like that. Well, post-9-11, in New York, there was a state CISO, the New York CISO, a guy named Will Pelgrin at the time, he's still around actually, but he's not the CISO anymore. but at the time he realized, like, hey, there are some major issues in communications challenges when this the terrorist attack happened. The state lost a lot of communications capabilities with the city and with our neighbors, right? New Jersey was impacted and Pennsylvania was impacted and Connecticut. We lost a lot of that communication security. So in order to to build resilience, Will was like, you know, we need to have better connective fiber to share threat information and and build some resilience between the states. And so he started local. we started building it really within the state of New York. but in order to get federal funding, which D the DHS is a predecessor was looking to fund a program like this, we had to move it to a private organization. So it came under the Center for Internet Security and officially in 2010. And we started really expanding beyond just the states. The idea was, well, we'll communicate the states and it'll trickle down to local governments. But unfortunately, that doesn't always happen. Aaron Mog: Right. Randy Rose (CIS): so we started really working with larger counties and and large cities and stuff in addition to the states. but that's why the the name multi-state ISAC. You it's that's that was the original name. but that's the MSI SAC in a nutshell. And then fast forward to twenty sixteen, you know, you got Russians mucking about in the US election space and the federal government's like, you know, we really should have a dedicated elections infrastructure ISAC. But elections are run at the municipal level, so it made sense to to co locate it with the MSISAC. but we carved it out as a as a separate focus area. much of the the support elements from a cybersecurity support services element like my security operations center, my CTI team, our instant response team, like all of that stuff. They're they support both the MSI SAC and the EI ISAC. And there's a ton of overlap between the the the members of both. but we do have, you know, specific resources dedicated for elections. and I think we're by volume, I think we're the largest ISAC, technically the MSI SAC's the largest, I believe, in the world. the first was FSI SAC. They're one of the the longest running and they're the financial sector Isaac. and they're very successful. but we're also one of the we're not the only one, but one of the only ones that offers like actual operational cybersecurity services. I know electricity ISAC offers some stuff too. They have some similar tools that to to the detection telemetry tools that we have. so yeah it's kinda the ISACs are kinda all over the place. Like some are really just information sharing, some are communication hubs. Some are like ours and we actually deliver Like operational services. Aaron Mog: Yeah, and I think, you know, as somebody who has a lot of experience with the ISEX, like, you know, FS is a couple of hundred members, retail's three, four hundred Randy Rose (CIS): Yeah. Aaron Mog: members. You guys are like tens of thousands, right? Like thirty thousand plus. Randy Rose (CIS): Yeah, well, before last year, so we had some funding challenges. We were funded in part under what's called a cooperative agreement. So it's it's kind of like a grant with some additional strings attached. but at our height, I think we were just over 19,000 members. Aaron Mog: wow. Randy Rose (CIS): and then now our we're we've shifted to a membership model after the the funding issues from last year. and I don't off the top of my head, I don't have the exact number of member organizations. I think we're up over six thousand. but the the reach is actually significantly larger than the nineteen thousand because we we have we have statewide members. And so if a state like Texas, for example, is a statewide member. So Texas funded

every organization within Texas that's state or municipal, like Aaron Mog: Okay. So la Randy Rose (CIS): yeah, so exactly. Texas is a huge state, right? Within Texas, there might be I'll throw a rough number out, there might be fifteen thousand organizations. There might be more than that. Aaron Mog: Right. Randy Rose (CIS): But like fifteen thousand seems close to right. Right. So so one so Texas pays once, but now fifteen thousand organizations have direct access to anything they need from us, right? From IR consulting services to our threat intelligence to you know, twenty four seven around the clock support from our SOC, you know, all sorts of stuff like that. Threat briefs, et cetera. Aaron Mog: Yeah, it's it's a it's a hell of a charter. It's a massive responsibility. And so many of those things, as you mentioned, are things that we count on, right? Election Randy Rose (CIS): Well a little bit big. Yeah. Aaron Mog: monitoring and water and electricity and regional, you know, Randy Rose (CIS): Yeah. Aaron Mog: police fire, like all that those guys, right, can can join and be a part of it. Right. Randy Rose (CIS): There's there's stuff people don't even think about. there's like Florida and I I don't think they're the only ones, but I know for sure Florida has them. There's something called mosquito controlled districts. Right. I mean and they're funded at the local government level. So, you Aaron Mog: They need it. Yeah. Randy Rose (CIS): know, but parks and rec, libraries, K twelve schools, public higher education, community colleges, all of that stuff. and it's you know, what's interesting about this this community, it's a vast community, right? I mean, there's tons of organizations of different types, different different you know, purposes and yeah, they have, you know, obviously you have fire and and and nine one one and police and stuff are all public safety. But then you also have legal, you know, you have judicial, you have state courts and local courts. I have something like, you know, ninety percent of all courts are state and local courts. We think about Aaron Mog: Yeah, yeah. Randy Rose (CIS): the federal court system, it's actually pretty small, you know, from a scale perspective, but it's the one everyone talks about. But yeah, yeah, I mean you you name it, right? You run the gamut from the types of services that are run at the municipal level. And a lot of them are are under resourced. They're, you know, there are people that are wearing two or three hats. They might not have a lot of IT resources locally. And like at the DMV, for example, maybe they the three, you know, Department of Motor Vehicles in your area all rely on one vendor to provide IT services or something like that. So yeah, it's it's an interesting environment overall, but it's also what what brings a lot of value, I think, for the ISAC model in general is that we're we're focused on this community exclusively, just like electricity ISAC is focused on the electric community, water ISAC on the water community. So we learn nuances that are unique to the community and and how to communicate with them. And so a big thing that we do is I I like to I I'll steal it from our instant response team manager. He says we communicate with care for this community, and he's a guy who came from State government. A lot of our team comes from state and and municipal governments, right? They understand the challenges that these organizations have. We're not just like another commercial provider that's gonna treat you like any other customer because that's not really what we are, right? We're here to to help. We're serving the servants, right? Our job is to serve public servants and and empower them to do their job effectively. Aaron Mog: So I think that's awesome. I think it's massively needed. I think, you know, in our world, you know, the Fortune five hundred kind of suck all the oxygen out of the room, right? Like it's all about big banks Randy Rose (CIS): Yeah. Aaron Mog: and and you know, AI labs and like it's it seems so Randy Rose (CIS): Yeah. Aaron Mog: as a security vendor, so critical. But like the reality is the numbers you're talking about massively outweigh the size of those orgs. Even the largest orgs don't even come close to the government. you know, Walmart is Biggest, I a biggest employer in America, but it compared to government, it's tiny. So that's great. Obviously, it gives you a lot of visibility and sort of wisdom about the market. At that level, with those folks, like what are you seeing as their are they just terrified of AI? Are they thinking about, you know, obviously they don't face quite the same threats Chase Bank faces, but like, what do you what do you see as sort of the macro trends in that? Randy Rose (CIS): Well, I wouldn't say that people are terrified of AI. I think the the they recognize that the landscape is changing because of AI. So we we really think about it in two ways, right? There's the threat landscape portion of it, and like what's powered by AI, like what's changing in the threat environment, what or what are threat actors doing differently because they have access to these tools. But then there's also the side of it's th that where it's, you know These tools are available, we're under resourced, we can use these to benefit our, you know, our our programs or add efficiency, but we're worried about doing it in a way that's secure. So we're really offering both sides, right? We're offering support, education, threat intelligence analysis, all of that stuff on the threat side, and also best practice guidance on like how you can run a an LLM in your environment in a way that's secure and you're not leaking a bunch of data. It's a little unique because, you know, po Public data sets in general, we have this k had this idea that if it's public information or it's public service organization, that the information within is also all public. But not all of it is public, right?

A a school district, yes, their budget information is public, but they are also housing student medical information or private information about you know, payroll information for their staff and and faculty. Which includes bank account information, right? That's not public information. So, there's all sorts of things like that that are and it you know, you look at judicial, there's stuff that maybe eventually somebody's prison record will will become public, but while they're undergoing trial, some of the information could be of a sensitive nature and that's that shouldn't be that's protected under like sieges data, for example. So so there's this kind of back and forth on on what should be public and what shouldn't be public. And that is a challenge in the AI world, right? Because you know, data gets uploaded to these models and now it's just available in in like a training data set somewhere, right? so that's a challenge for I I think for a lot of a lot of our members. But in terms of like a pure threat perspective, I would say the two biggest things that that we see within this space, at least it's tough to say if it's exactly If they're the top two today, but they're they're definitely two that we see, you know, over and over again. A lot of our IR cases are tied to these is still ransomware. and then business email compromise. And I I think the reason for those are that they're both financially motivated and those budgets, unlike a lot of private companies, municipal budgets are publicly available in most cases. So if you look at a rural school district, might be relatively small school district, as a threat actor, you're thinking. You know, this is a small district, they probably don't have that many controls in place. It's gonna be easy security to bypass. And they have a sixty million dollar budget. Right. They're like, this seems like a pretty good payday to me. Yeah. So Aaron Mog: Get a chunk of that. Yeah, yeah, sure. Randy Rose (CIS): right. So so they're getting hit with ransomware and BEC all the time, because that date that financial data is public. They don't care. Threat actors don't care that that money is accounted for, right? That that's going towards school lunches Aaron Mog: yeah, no, not at all. Randy Rose (CIS): and Aaron Mog: Yeah. Randy Rose (CIS): you know, pe teacher salaries and stuff. They want a payday, quick payday. And they know those are critical services, right? If they go after a water system, if they go after a a school district, if they go after a a a public hospital, I mean there's a lot of pressure on those organizations to pay the bill quickly to get those services back up and running. Because you're talking about potentially, you know, students that they're out of school, they're missing exams, they're not eating. I mean, there are s students around this country that only eat when they eat their school lunch. They there's no food at home. Right. So th that's a major disruption to the community when a a school district is ransomed. Think about a rural hospital. I mean, that's that might be the only hospital within driving distance for many people. And if they're taken offline, that's a that's a huge there's a tremendous amount of pressure on the administrators to get that up and running again. And one attractive option is paying the ransom and getting your services back. And that's what these cyber criminals are are banking on. Aaron Mog: I the whenever I see the threat group attacking a hospital or a school, I'm like, like what a pe like go pick out a law firm. Like, why are you picking out these guys? Like, come on, jerks. Randy Rose (CIS): Well what a scumbag move. Yeah, just Aaron Mog: so within that, I'm just curious because I know you have history in this, is you know, there's been a lot of activity in the commercial side around OT, some big acquisitions, buyouts, things like that. Like in and a lot of the OT, at least in the states, is run by state local agencies. Randy Rose (CIS): Yeah. Aaron Mog: you know, energy companies, things like that, like it's so distributed versus corporate, which isn't as OT centric. Are you seeing that in your world too? Or like are people more kind of OT aware or thinking about it's a tough thing to do because like a lot of things you buy you can't change and so stuck Randy Rose (CIS): Right. Aaron Mog: with what you got. But like is that part of the conversation? Randy Rose (CIS): So about if you t if you take out f l the like defense OT. So you get rid of things like navy. I mean if you think about it like a Aaron Mog: Mm-hmm. Yeah. Randy Rose (CIS): navy ship, it's you know, it's it's a massive it's a city within itself, but it's a a massive like interconnected system of OT, right? It's you know, they got power Aaron Mog: Right, yeah. Randy Rose (CIS): systems and and nuclear power propulsion and all this, right? So it's all it's all OT. But if you take all that defense stuff out of the picture. And you just look at the remainder of of industrial technology within the US, about a quarter of it is municipal. So it's it's not really as high as you might think of, you know, in terms of but that's that that's including like things like you know, industrial power plants and car manufacturers and stuff. So they are, you know, if you look at you know the the the automobile industry, I mean that's a makes up a massive amount of the OT that's out there. But I think the big difference is Those organizations typically have the resources to put all of that operational technology behind a security stack. Aaron Mog: Right, right. Yeah. Randy Rose (CIS): And they have dedicated teams that are, you know, securing those assets. Right. And they're respon they're trained and they're responsible for, you know, ensuring that the whatever the HMIs and PLCs that are, you know, helping to make sure the robot arms are putting the door on the car the right way. Like that's all protected. And isolated and segmented from the

corporate network and all that kind stuff. We don't always have that in the municipal space. And if you think about like the water sector in particular, which is has been in the news lately, Aaron Mog: Yeah, yeah. Randy Rose (CIS): those a lot of those PLCs that are running pumps or controlling valve operations and and some of the safety systems, they're not necessarily behind the security tools that they should be, not because a deliberate choice was made to do that. By the municipal government, but because the government is working with an integrator, and that integrator is like, I have to be able to get to this thing remotely. And so the integrator is making choices that are introducing risk to the local government. And you Aaron Mog: Interesting. Randy Rose (CIS): know, if you slap a cellular router onto you know, a the a PLC, even if Aaron Mog: Right. Oops. Randy Rose (CIS): even if the IT person did everything right and was like, hey, I have this behind a security stack thing, well, now you have this rogue access point. That the IT administrator doesn't even see. They don't even know it's there. Aaron Mog: Right. Yeah. Randy Rose (CIS): Right? Because this third party integrator, you know, put it in place. So there's challenges like that that I think, you know, are are pretty unique in the municipal space. I mean, you do sometimes see it in commercial or somebody I mean I Aaron, you probably remember I mean, I remember when I was a pen tester, like I don't know, probably fifteen years ago or so. I remember one of the big things that we were always looking for during the initial audit phase of it network was rogue access points. Aaron Mog: Yeah. Yeah, true. We used to walk around with those stupid Randy Rose (CIS): Right. Do you remember that was like a thing, like somebody's gonna rope with Aaron Mog: can the potato chip cans trying to find APs. Yeah. Randy Rose (CIS): Yeah, I like yeah, I used to have a tablet with Kismet loaded on it so I could go around and find these things. Yeah. So that was like a big thing. Well, i it's still a problem in OT environments. You're not seeing it as much. It's like a lot those are a lot easier to control today in a standard IT environment. It's still a challenge in OT. Right? Somebody's slapping a cell router in there and it's like when we just don't we're finding out about it when PLCs are being compromised, right? And that that's the challenge. So yeah, I mean but it eventually eventually, ultimately it comes down to, I think, to some of the same basic IT controls just applied in an industrial environment, right? If you we had really good inventories, we knew exactly where our PLCs were, what they're touching, how they're getting out, you know, to the internet. We knew if we knew that there were cell routers connected to these things. you know, if we did regular vulnerability scans of these environments and identified this stuff. If we were running you know, all of our our IP infrastructure through things like Shodan and seeing what our exposure is. I think a lot of those like basic controls that we take for granted on the IT side, if we were able to apply them on the OT side, we would reduce a lot of risk. Aaron Mog: Yeah. It's it's always been tough Randy Rose (CIS): Okay. Aaron Mog: for OT medical device, like the vendor control is so different than it is in like Salesforce or some app where it's like I have a lot more to Randy Rose (CIS): Yeah, yeah. Aaron Mog: say. So it's interesting talking about this with like the OT challenges and also just, you know, the challenges of being a municipal or local or state urgency. One of the things that I'm having a lot of conversations about and sort of thinking a lot about is a you know in a in a sense of like where A is I AI is headed. Ultimately, we're hopeful that it creates these like awesome new security tools. But we've always had the security poverty line, right? Like which I think Wendy invented 20 years ago, right? Which is like below that line, you're sort of in trouble if they notice you, then if you're above it. And AI is now becoming a global version of that, right? Where you have these trillion dollar companies, and then like, you know, is rural America gonna get left behind by AI is the question, right? Is it can we create these amazing security advisors with AI? that are the new security layer that make, you know, a mom and pop local agency IT shop as good as Chase. Like can we do that? Like is that achievable? Or is it just gonna be the big boys Randy Rose (CIS): Maybe. Aaron Mog: have all the best toys and the little guys get screwed again? Like, do you are you seeing that? Or is that something you think Randy Rose (CIS): Yeah. Aaron Mog: about? Randy Rose (CIS): It it's it's interesting because so I refer to generative AI anyway as the great democratizer, right? So it it it has allowed but I usually am talking about it in terms of the threat actor side. It's it's allowed Aaron Mog: Okay. Randy Rose (CIS): threat actors to level up their game. I remember like a few years ago we would teach people what to look for in a phishing email. look for this, you know, bad language or this disagreement between the signatory and the email address and you know, look for the typos and you know, all that kind of stuff. Well, that that's not really a a great way to identify phishing emails anymore because threat actors that where English is not their native language, they're using generative AI to help write those. Yeah. And it sounds great. Aaron Mog: Good Claude to write it, right? Yeah. Mm-hmm. Randy Rose (CIS): if they can get a hold of some of your emails, they can feed those into a generative AI model and then they can say, craft me an email that sounds just like Aaron and then I'm I'm using that. If I'm the attacker, I'm using an email that sounds like you to launch my BEC. And I'm it's very convincing, right? So when you look at those kinds of financial fraud or or ransomware or phishing

attacks or whatever, it's really, you know, we have a and I think this is one of the reasons why we're seeing a blurring of of of like kind of characteristics across different actor types, and it's getting harder and harder to to attribute to like, this is a this is a Aaron Mog: yeah. Randy Rose (CIS): Cyber criminal versus this is a hacktivist versus this is a state-aligned actor because they're all using the same tools. And so a lot of the threat and tell that we used to rely on that these indicators of like, well, this this you know looks a lot more like a financial fraud kind of attack. Now it's like, you know, we're like, crap, like this is we Aaron Mog: Yeah, who knows? Randy Rose (CIS): we thought this group was a hacktivist group. Now they're you know doing destructive wiper stuff that looks Aaron Mog: Right. Randy Rose (CIS): a lot like this other group. So, you know, it is it's kind of leveling the playing field for a lot of those actors that. You know, it's allowing them to level up their game to a certain extent, at least get closer to that that middle tier. but it's it's not I think there are there's value in it from the defender standpoint that we can use AI for the same things. The challenge that I have is this all of this stuff that's it's trained on on this data that kind of pushes the response towards the mean. If think about it this way, like if you're really, really good, if you're a great musician Aaron Mog: Mm-hmm. Randy Rose (CIS): and you use AI, let's say you're a great songwriter, and so you start using AI to help write your lyrics, they're probably gonna get worse. But if you Aaron Mog: Right. Probably. Randy Rose (CIS): suck at songwriting and you're like, help me write lyrics, you're probably gonna write the best song you ever wrote, right? Because it's gonna level you up to the mean. Aaron Mog: That's funny. Yeah, that's great. Yeah. Randy Rose (CIS): But and and I think the same thing is happening in cyber. Like you have people, I know people who are brilliant. And I can tell when they sent me something that they used AI to to write. I'm like, this doesn't sound anything like you. Aaron Mog: Yeah. It's not very good. Randy Rose (CIS): It's not very good. I expect more out of you. Right. So I I think that's the challenge. Like if you're really, really good, AI's not gonna help you in the things you're really good at, but it might help fill the gap in the areas where you're not. Like I I don't have a financial analyst background. So one of the things I use it for is helping me help help augment those skills that I'm missing, right? I don't I'm not good with financial analysis. So if I'm pricing something out, I use Claude and I go help me, you know, price this out. But I'm pretty good at giving presentations. I'm not going to Claude and be like, create a presentation for me. That'd be that'd be wild, right? It just would Aaron Mog: Right. Yeah. Randy Rose (CIS): make no sense, you know, for me. So I think that's one of the challenges that that people are facing today is they're wanting to use it in ways that use generative AI in ways that maybe aren't the best ways, right? Don't let it It's not really creating anything for you. It's it's pulling things from other places and giving you a maybe a different perspective. But if you're a creative type, you need to create something new, that's a human skill. Give it the direction, prompt it the right way. It can help you take your ideas and turn it into something. whether those are for defensive purposes, you know, putting together a business proposal, whatever it is, I think it, you know, it's fine either way, but. I think from a defender standpoint, like we can we can use generative AI to get us like the the value in generative AI is is how quickly it can compress a whole bunch of data into something easy to understand. Let's use it for that, right? It's just like machine learning on steroids, right? Let's use it for the the the data compression capabilities, Aaron Mog: Right. Randy Rose (CIS): the translation capabilities. The I love it for things like convert this CSV to a a you know a tab. separated values documentary or Aaron Mog: Right. Just do it. Randy Rose (CIS): yeah I had I had a whole bunch of old stuff that from years ago that was all XML encoded and I was like turn this into JSON it would have taken me hours to do it did it in like it Aaron Mog: Right, yeah. Yeah, it's so much easier, yeah. Randy Rose (CIS): did it in like you know 30 seconds. Aaron Mog: Yeah. Randy Rose (CIS): So use it for things like that, right? The same remember the old book automate the boring stuff do you remember that series? okay there's a there was a book series Aaron Mog: No, but I don't think I remember that, yeah. Randy Rose (CIS): on it was like a coding series it was like you audit Aaron Mog: code okay, for code, yeah. Randy Rose (CIS): Yeah, it's like automate the boring stuff with Python or whatever. That's the kind of stuff I think is is really valuable and helps us level up. But like so, I'll give you a good example. So my CTI team found when they were experimenting with different ways to to use Claude, we introduced Claude specifically into some of our operations teams, they realized like as they were feeding stuff in, the project that they were building was starting to run away with the analysis. And then they would it would spit stuff out and they're like I don't know how it came up with this assessment and I can't defend this. So they had to like really scale back what they're doing. And and they one of my analysts in particular built this project that has all of these security gates in it where it'll feed data to Claude and it'll say, This is the assessment I came up with. Here's my evidence. Put this into this format. Right? You don't make any they have to give the the the agent the specific guidance. You are not making an assessment. I'm making the assessment. Your job is to take my words and put it into

this format, right? Make it make sense. And I think those kinds of things can work really, really well. but you you have to you have to rely on your own subject matter expertise. And that's the champ part of the challenge that we have with under resource organizations, whether it's nonprofits, small businesses, rural municipal organizations, many of them unfortunately don't just don't have the expertise and they're using these tools and they want to use these tools and they should be able to use these tools, but they don't necessarily know because AI is written to be convincing. And you it sounds right. Aaron Mog: Right. It sounds right. Right, yeah. Randy Rose (CIS): So if you don't have the expertise to be like, this this isn't right. It sounds convincing, but it's not right. If you don't have that expertise, you know, it's Aaron Mog: Yeah, I'm like super obsessed with skills right now, like AI skills and inside Claude Randy Rose (CIS): Yeah. Yeah. Aaron Mog: and like how do I take a really smart person and turn them into a skill and then that sits Randy Rose (CIS): Yeah. Aaron Mog: in front of the L. Like that part is very fascinating to me and I think is really needed for the you know the smaller shops, the companies that struggle with security. Randy Rose (CIS): Hundred percent. How and how can it augment your team? Not not it's not really that's why I sometimes have an issue with artificial intelligence. I go back and forth on on whether or not I even like that term. Like I decided long ago I didn't like APT years ago. I was like, I don't like advanced persistent threat because Aaron Mog: Okay. I like it. Yeah. Randy Rose (CIS): be because we were using it as a as a stand-in for like, you know, state aligned actor groups and we just assume because they're state funded, they have you know, they're advanced or they're persistent. But I mean, doing IR with the military for years, I realized some of these guys really aren't that advanced. And and many of them aren't persistent. It depends it depends on the campaign they're launching, right? Sometimes they're going for persistence, sometimes it's smash and grab. So Aaron Mog: Or persisted. Right, yeah. You sure? Yeah. Right, right, yeah. Randy Rose (CIS): I I didn't like that. You know, I decided very early. I was like, I don't like this. I'm gonna use state aligned actors. and so I switched my language to that. I'm I'm on the fence about AI. Like I one, it it's a bloated term. I mean, there's a lot of stuff under AI. but two, I just I don't it it it appears to be intelligent, but it's not really asking questions. It's not really creative. It's not there's things that I think we look for in intelligence. In order for something to be an intelligent being and have its own agency, w we would have specific criteria that a machine just can't do today. Aaron Mog: Right. Yeah. It's so hypey, right? It's so like it's there. I'm Randy Rose (CIS): Yeah, yeah. Aaron Mog: like, it's good, but like it's a prediction engine. It's not AI yet. Like Randy Rose (CIS): That's it. Aaron Mog: it's just very good at pick thinking what the next word should be, or Randy Rose (CIS): That's right. Aaron Mog: you know, and that's one of the reasons I love it for security, because you know, I'll give you an example, right? Like you and I XML to JSON, like you and I can both do that work and but like AI could do it faster to your point. But like there's a thing, Randy Rose (CIS): Way faster. Yeah. Aaron Mog: is example of If you somebody shows you a domain name, you almost get like a gut reaction if it's a shitty domain name or not. Like if they're doing something bad with it by just almost a vibe of just having seen 20,000 crappy domain names in your life, like I Randy Rose (CIS): Okay. Aaron Mog: can I can look at a whois data set and know almost immediately if a domain's good news or bad news. Teaching a machine to do that is so hard. Like it's incredibly it's a perfect example of like an easy problem that is a really hard answer. you need wisdom, experience, like the idea of like having processed a bunch of them and have somebody who's done this in AI, like it'll miss almost everything if you try to do that exercise with it. And so it's not intelligence, it's prediction. Randy Rose (CIS): And if you tr if you tried to program it in, it might yeah, I mean if you tried to program that in, it might actually create a bunch of false positives. You're like, you know, so it's hard it it is, it's intangible. Aaron Mog: Yeah, and wisdom, right, is a big part of human intelligence. It's like, I was just talking to somebody about these new companies, right? And and you know, the AI labs and you know, open router and clo and Chris and all these companies that are like brand new. And I'm like, I know they're trying to do security, or at least they're pretending to try to do security. I don't know yet. But there's something that comes from getting kicked in the teeth over and over and over again that makes you good at security. Right. Like Randy Rose (CIS): Yeah. Aaron Mog: Google's good at security because they failed a million times. Microsoft's good at security. God knows they've failed a million times. And like you create like a a wisdom or an experience. And the analogy I Randy Rose (CIS): Yeah. Aaron Mog: use is like the remember like the Vietnam movies when like the new recruits show up and they're all like clean and out of boot camp. And then the old vets come out and walk past them like you don't know what the shit's like. Like that's AI companies. I'm like, you Randy Rose (CIS): grizzled. Yeah. Aaron Mog: guys are not ready for this at all. Like how Randy Rose (CIS): Well Aaron Mog: hard it is to do this well. Because they're moving so fast. And so I Randy Rose (CIS): What that Aaron Mog: look at it like how do we jump start that? How do we get further? Like how do we take some wisdom and embed it in AI so it doesn't do dumb shit? Like that's kind of a big

thought for Randy Rose (CIS): I don't know. It's it Aaron Mog: me. Randy Rose (CIS): it's hard it's hard to because you know, Microsoft wasn't in the security game for most of its existence, Aaron Mog: Yeah, most of its existence, yeah. Randy Rose (CIS): right? It it it was forced into it. and Google wasn't really in the security game, really. I mean it r I don't think I'm probably wrong on this, but I I I don't think that really that Google really entered security until Gmail took off. And they're like, crap, we gotta deal with all this like, you know, Aaron Mog: Yeah. Randy Rose (CIS): spam and phishing. And they bought I think I think the first thing they bought to help handle with that was a a company called Postini. And yeah, they were dealing with like, you know, how to do spam at scale in the cloud and for webmail and stuff like that. So but that's one of those things that you know, those companies learn because you're right, because they they get kicked in the teeth. But they also they didn't set out to do that. Right. And I think that's the thing with anthropic. Aaron Mog: No, it's like force on him, yeah. Randy Rose (CIS): Yeah, anthropic learn with mys like even with mythos, it they didn't design mythos to be this vulnerability discovery tool. They've discovered after the fact like, crap, this thing's this thing's really Aaron Mog: Right. Oops. Right. Randy Rose (CIS): good at finding these. I mean, it's really good, but also a lot of these things are not practically exploitable. But still I it was it was it's a mess. Yeah. And it would but it was like it was accidental. Aaron Mog: Still a mess, yeah. Yeah. Randy Rose (CIS): And that's that's the thing that probably more than anything else is scary. It's like we're creating all this stuff that we have no idea what it's actually capable of. Aaron Mog: Yeah, they're all on the news saying, you know, it got out of the lab and it's attacking things and oops. And I'm like, hacking's not an oops. Like you just broke a law, but okay, like sure, oops. But I I do worry about the velocity of AI-driven attacks. Not Randy Rose (CIS): Yeah. For sure. Aaron Mog: necessarily they're gonna be that different, like than a maybe even a traditional ransomware campaign or BC, but to your point about like they're better, they're closer to good, not good, but closer. But like just how fast it can go. Like you could take an idiot and 10x their idiocy with AI, who's just gonna mess with companies or do dumb things. And you know, there's always been a little bit of fear of hacking OT because it's like consequences, right? Like you take down a come a country's power grid, you have a chance that you're gonna get a military retribution. Stealing credit card Randy Rose (CIS): Mm-hmm. Aaron Mog: data, like you were never gonna get shot, probably. so like you know, I do think that's it. I'm sure it has happened, but in the States at least you're like, I'm I'm okay, I'm safe if I'm just doing credit card fraud. So I I

do think I am worried about velocity for this little guy and and what can we do to help them and how can we Randy Rose (CIS): Yeah. I mean you you Aaron Mog: up level them as fast as possible because it's coming, and what that's gonna look like. Randy Rose (CIS): Well, you used the phrase the which you said cybersecurity poverty earlier. I mean, it's already been a challenge. Did you see the Verizon DBIR this year? Aaron Mog: not yet, no. Randy Rose (CIS): So they that was one of their key findings is that basically we're getting this is by the way, this is 2025 data. This is before, this is pre-mythos. Aaron Mog: Right. Randy Rose (CIS): They they basically were like, We're getting worse. There's more stuff to patch, and we're getting worse at patching it. So bad combo. Pre mythos. Aaron Mog: Bad combo. Yeah, that's not good. Yeah. Yeah. Randy Rose (CIS): Right. This is this is before we had any generative AI models that were discovering vulnerabilities at a at a pace that's hard to keep up with. It's like the I always think of the I love a good analogy. So I think of the Jim Gaffigan joke about having five kids. He's like having five kids is like imagine you're drowning and then someone hands you a baby. Right. That's kind of what it feels like, right, with this vulnerability, you know, situation. Aaron Mog: Right. Yeah. It does feel like that, yeah. Yeah. Randy Rose (CIS): We're already drowning in these things and you know, now they're we just released a bunch of tools to the wild that are unfortunately very good at making our jobs a lot harder. Aaron Mog: And there there's models right behind that that are even worse, right? That are coming after Mythos that are Randy Rose (CIS): yeah. We're we're at the bottom. Like we're at looking up at this steep cliff. Like we don't even know what's coming two months from now or three months from now. And we're so we're at the bottom, like looking up this thing, like, you know, and there's clouds. We can't see what's coming. And we're we think it's bad now, but we're like, Good Lord. Aaron Mog: Yeah. It could be a nightmare. And you know, and unfortunately in security, we generally learn the lesson after something bad happens, right? It's like we go through this Randy Rose (CIS): Yeah. Aaron Mog: rough period and then we probably shouldn't have every company in the world have local credit card numbers. we probably should do, you know, OWATH Randy Rose (CIS): Yeah. Aaron Mog: instead of storing password. Like we learn these lessons after getting beat up forever. I don't know what that's gonna look like for AI, but like today, right? a CISO at a state comes to you. And says, what should I be doing? What are you telling them? Like, quit? Go do something else for a living? Like what are you what kind of advice are you giving out? Randy Rose (CIS): Yeah. Yeah. Have you have you considered underwater archaeology? Aaron Mog: Right. Anything but this. Randy Rose (CIS): you know, it's I kind of said it earlier,

but I I think the and it's it's a l maybe a little bit of a cop out in a way, but I I do think, you know, getting the essentials right is critical. so you know, whether you're you're dealing with AI related issues, OT issues, ransomware. I mean, the yes, the scale of these things are it's coming at us faster. the actors are more sophisticated. But what we're finding is back almost, I think, to one of the first things we talked about, right? That soft underbelly, the the the you know easy to compromise organizations are the ones that keep getting popped. The more layers of defense that you have in place, the more resilient you're gonna be. So And it starts with, honestly, I mean I work at CIS, so I have to pitch the controls and and benchmarks, right? Our security best practices, they're Aaron Mog: Do it. Bring it up. Yeah. Randy Rose (CIS): di they're developed by a community-wide global community of experts. The controls are not something we come up with, right? That we convene an entire community of cybersecurity experts from around the the world to put those together. So there's a reason why inventory of your hardware assets and inventory of your software assets are, you know, numbers one and two. but we really tried over the last couple of years to break the controls into manageable chunks. So we have these implementation groups and there's there's safeguards across all of the controls that we recommend putting in place first as part of implementation group one. So if you're not as an organization, if you're not if you did an audit and you were not IG one compliant, I would say start there. The second thing I would say is there are capabilities, right? There's a there are a lot of resources available. Whether it's through CIS, there's a bunch of free stuff. Through the MSISAC, there's a bunch of services available. Through the federal government, there's still services available. A lot of people think there are not services available either through the ISACs or through the federal government because of some of the, you know, the news around like CISA being downsized and stuff. They still have resources available. The FBI still has stuff available. There's a lot of stuff you can get for free or for very low cost that you should go after first, whether you're federal government, state government, local government, private business, nonprofit, there's a there are a lot of free resources available. so I would say d you know, focus in those areas and see what you can do to boost your posture and and reduce your risk on those low cost and no cost solutions before you spend a dime on some expensive capability. Because a lot of what you can do in terms of building your stack is you can do for very low cost. You can drive a lot of risk down. And the goal is never yeah, it'd be great if you could get down to zero. That's never gonna happen. Right. But Aaron Mog: Sure. Yeah. Randy Rose (CIS): you gotta it's the same thing like we do with our bodies, right? You exercise, you eat healthy, you know, you you try not to sit around and be lazy all day. and try and, you know, get off our our phones as much as possible and read an actual book or go outside, get a little bit of sun. Aaron Mog: Sometimes. Randy Rose (CIS): But We're gonna we're gonna die anyway, right? We're just trying to extend our lives and and and and live healthy and make it so our knees don't ache every time we go up the stairs. but eventually, right, we we're you know, you you can't reduce the risk down to zero. The risk that we're gonna die at some point is gonna happen. So you can't do same thing in cyber, you can't drive it down to zero, but we can do those things, right? We can eat healthy, we can exercise in those same ways, you know, in our exercise in our network environments. but it is You know, it's I I I don't mean to imply that getting those basics right is easy because it's not easy at all and it does require dedicated resources. you know, but you have to be deliberate and you have to focus in those areas. And I think a lot of people jump to, you know, like, I need a pen test. Or I need this, you know, this real sexy tool I heard about, like that's what I need, you know. Probably not. Like you probably need don't start with a pen test. Like you don't, you know, if you're you're talking about a house, like you don't start with a guy like I want to see if somebody can break in when you haven't put the doors and windows and locks and all that stuff in your house, right? Aaron Mog: Right. Yeah. Yeah. Randy Rose (CIS): Get all that stuff right first. then go for the pen test, right? When you're when you're IG one compliant and you have you know adequate security control. Like if you don't have somebody who's actually monitoring your security for you, why are you gonna go do a pen test? Aaron Mog: Right, what's the point? Right. Yeah. Randy Rose (CIS): Yeah, it doesn't make any sense, right? So don't jump to the most advanced thing. Even if people around you might be doing that, you might not be at their level. Get to their level first, right? Focus on hitting that minimum watermark. and there's so many ways to do it. And honestly, each I obviously I I want all state and local governments to participate in the MSI SAC. It may not be practical for everybody. I understand that. but there are communities regardless of what kind of organization you are. Right. If you're a small business, there are a bunch of other small businesses in your area that you can partner with and you can communicate with and you can establish if you're not, you know, involved with your chamber, your local chamber of commerce, to meet those folks, maybe start there. Find out what other people are doing to to both you know build a more resilient business just from a business perspective, but also, hey, what are people doing from a security standpoint? I know where I live in upstate New York, I'm in the Saratoga area of New York, the Saratoga County

Chamber. brings together nonprofits, governments, and businesses in the area. And they host all sorts of different events and educational opportunities, many of which are focused on building, you know, data s like data security best practices, Aaron Mog: Yeah. Randy Rose (CIS): how to how to make wise decisions around emerging technology, moving to the cloud, what does that look like? How do you do it securely? I mean, they they're covering all of this kind of stuff. challenges with state funding, challenges with federal funding. I mean, it's th they're bringing all of those resources to bear, which I think is really cool. so I would recommend any organization, whether you're local government or not, like find your community. Aaron Mog: Yeah, I'm a a big community person. And I I think in the hype and sort of greed of the modern market, like some of that gets lost. But like I I think it's the best way to do cyber because like I don't know what you know, you don't know what I know. Like we Randy Rose (CIS): Hundred percent. Yeah. Aaron Mog: like where did that go, right? To a certain extent. So I I'm a huge anybody who knows me know that I'm a big believer in that. And I I love just while I have you for a few more minutes to extend that to people, like like beyond companies and orgs. So You know, as we're talking about all these challenges, things like this, some of this creates opportunity for people right to get jobs and and go there. But the the question I love to think about and and I love to ask people is, you know, you're at a conference, you go to one of these events, whatever, and the kid or maybe somebody in a career transition comes to you and be like, How do I sort of be you or how do I get into cyber? What are you saying to them? Like, what would be that advice? Randy Rose (CIS): I say, don't do it. Go into any other field. No, I'm kidding. yeah. Yeah. Go learn programming. Aaron Mog: Good. Go be an AI scientist. That's my advice. So I told my kid, go learn LLMs and make a million dollars a year. Randy Rose (CIS): Yeah. it's funny actually because you know, a lot of the advice that just a couple of years ago we were telling people, it's kind of a lot of it get thrown out the window, right? Like we tell people just a few years ago, like, go into coding, you know, learn computer science and programming. Like it's the most secure, high Aaron Mog: Nope. Randy Rose (CIS): paid, like, well Aaron Mog: Oops. Randy Rose (CIS): Turns out turns out L LMs are really effective at that and and code developers are not they're having a hard time finding jobs. yeah, I mean I I think for people that that want to get into cyber, it's you know, my I didn't I actually didn't set out to do this. I wanted to be well originally I wanted to be a writer on SNL. but then I was really obsessed with Indiana Jones when I was a kid. And so I wanted to be an archaeologist and then I was reading the books and stuff and realized he was actually a professor of anthropology. And so I when I went to college, that's what I did. I went for anthropology and I had some issues in in, you know, going through college and I ended up leaving and going into the Air Force and I kind of fell into cyber accidentally through through that. And it was just I did well on the ASVAB and they put me into this field that they I actually went in when I They have you fill out a dream sheet of jobs you want. And all of mine were like combat videographer, photo editor. It was like all these arts artsy fartsy kind of things. Aaron Mog: Yeah, yeah. Randy Rose (CIS): And they're like, Well, what about this computer on? I'm like, Yeah, whatever, that's cool. Throw it on there. It was like my last choice. And of course, that's the one, you know. Yeah, they Aaron Mog: That's where they put you. Randy Rose (CIS): manip they manipulated me into putting that one on. But it worked out for me. and but it was funny because it was like, you know, essentially my career has been a series of accidents. So, you know, I I ended up in that field, I got out, I was the last person that the state of New York when I was out of out of the military. I was the last person they interviewed. And I didn't I was probably not really fit for that pen testing role I got, but I was so excited about it. They were like, hey, have you ever used this tool or that tool? And I'm like, you guys use that? that's so cool. You know, I would love to use it. So I think my excitement got me the job, even though I didn't really have the experience. And then you know, it's kind of pivoted. I I when I went to the Navy, I originally went to do one job and happened to be right place at the right time, they needed me to, they needed somebody who had some kind of, you know, pen testing experience to help run their their malware lab. And I just happened to be like the most technical guy on the leadership team. And so they were like, you know, hey Randy, we're gonna slide you over here. And you know, so each time it's just kind of been right place at right time. So I think my best advice would be for people is follow the journey, right? Don't don't stress too much about The journey, but you got to start somewhere. And I certainly I recommend starting in public service. it doesn't pay as well, but it gives you a lot of opportunity to do really cool stuff. whether you you start at the federal government or your local government, I mean you get to have a an impact in your community, right? You you we rely on the government mostly on the local government, but local, state, and federal government. for the things that we all take for granted every day. So if you can start in public service, it's a great opportunity. We need good people, right? We need people who are dedicated servants, public servants, and we need talented people. And it gets you that experience. It's really hard to get in with a a commercial company right now to get past the AI filters and stuff. The municipal government

is like one of the few places where, you know, they're not employing those AI Yeah, they're still reading resumes. Aaron Mog: People are still reading resumes. Yeah. That's great. Randy Rose (CIS): And and what nothing's stopping you from going down to your local, you know, town hall or something and and asking questions and getting involved, get to know people. There's great opportunities to get involved. I mean, I'm a I'm on the board of two local government, not government, two local nonprofit organizations. And I've met some incredible people. you know, I get I'm involved in my chamber. you know, you you can go sit in on board meetings, you know, school board meetings or town hall meetings and zoning commission meetings and just meet people. That's a great way to get your foot in the door. so I I just you know, I think I always wanna make a pitch for people to to start in public service. I think it's so important. you know, that that'd be my pitch. Start there. Aaron Mog: Yeah, I I think there is Sort of negativity about it in in in the sense like for sure the the money, but also just like that you're not going to be on this cutting edge. And then I I talked to people, I'm like, when you start out as an analyst at some Fortune, you don't get to touch the cool shit either. You're sitting in a sock watching reports go by all day. Like, you might as well go get to touch more stuff. you know, and and almost everybody I know who's of a certain age gonna cyber came in a weird way because there wasn't no degrees or anything like that. So, like, Randy Rose (CIS): Right. Aaron Mog: we all learned by Help desk, IT support, you know, I'm sure you fix printers, I fix printers. Like that's how I came up. And I'm like, I you can't Randy Rose (CIS): Yes. A hundred percent. I did that for a long time. Aaron Mog: skip the queue. You can't go to the front and just be a God level AI security guy overnight. Doesn't Randy Rose (CIS): Yeah. I found I was funny, I was just telling somebody about this recently. I I was working on printers for a while. I right when I got out of the the military, I came back here and I worked for a contractor. and we were mostly working at at a there's a power laboratory, it does like a a t a nuclear research lab that's kind of nearby. So I was mostly working there doing server support for them and they have a bunch of supercomputers. So I was doing all the supercomputer and server support there. but we had this contract company I worked for, we had other clients. And most of them were hospitals in the area. And so they had all these funky printers and all these printers always have problems. And I would just, you know, to earn a couple extra bucks, I would in the evenings when I was done with work, I would go, you know, I would take on extra you know, service calls. So I was doing a bunch of printers and I found if I couldn't fix a printer on site, I would take it, I would put it in my car and I would drive I would go get like food and I would come back and plug it back in and it would always work. I was like, the printers just Aaron Mog: Yeah. Randy Rose (CIS): Yeah, the printer's like, I'm tired of being here. I just wanna take a ride in the car. Yeah. Aaron Mog: They have printer cues and post script cues and all that crap they used to have. yeah, I I spent a lot of my youth in IT banging my head against printer drivers and PSQs. yeah, I mean you gotta learn somehow. Randy Rose (CIS): terrible. And those little those little rubber things would always go bad in the HP printers. You had to like replace the little rubber wheels all the time. Remember those? Yeah. Aaron Mog: Yeah, all the spinners. yeah, like big copier. Like it was a nightmare. So for all the kids that are getting into cyber, like you do have to pay your dues. Nobody gets to do it overnight. Randy Rose (CIS): That's right. Aaron Mog: but yeah, I I think you know, the other thing I would love to see is a better, you know, veteran pipeline. you know, you see it like Randy Rose (CIS): for sure. Yeah. Aaron Mog: even with the Israelis, like they sort of come out of the A two hundred and they kind of get absorbed by that community. Like we need more of that here too, more pipeline from military. I've hired a a large number of of people from like Air Force JSAC and stuff. They've all been incredible. Every single one of them I've hired. And they've a lot of them gone on to be sort of very important in security, way more important than me. so I a hundred percent agree with that. I think that's great advice. I would say, you know, as far as the the multi state ISEC part of it, you know, I'm sure you guys are are looking for content help. Like, you know, I know you you're kind of changing the way you do business. like, is there a way to people get involved in that? Like maybe vendors or somebody to help out? Randy Rose (CIS): Yeah. yeah. I mean we're always looking so we do have, you know, CIS as a nonprofit. We have we exist in a really unique space with the environment. and we can convene, you know, vendors that would normally be in competition with each other. We can get them in the same room and working together. And we've had some great relationships with Everyone from you know Google and Microsoft to Akamise is just a phenomenal partner that we work with. We work with a great threat and tell vendor called Analyst One. so we have some great partnerships. we're always interested in more. we're you know, at the end of the day, we're trying to provide as many services as possible to municipal governments and and local governments, so state and local governments. So any vendors, you know, commercial partners that are interested in. in providing services or supporting that mission. we're always happy to work with on the best practices side of the house, we work very closely with all the major cloud providers, but also the experts from all of the benchmarks that come in, right? So if you have like a Red Hat Linux benchmark, well we worked with folks from Red Hat to help develop that, you know, the those those security benchmarks. So all of those vendors are all the you know, we partner closely with them. And then for other organizations, if you're interested in sharing threat information with us, you know, we'd love to have it. Help boost the threat the data sets that that we send out to to the municipal governments. if you are a municipal government and you're not a member, you can always reach out to us. it's just info at INFO at CI security dot org. So CI is in the center for internet security dot org. And you could always ask for more information. Aaron Mog: Awesome. Well, and people could find you on LinkedIn. you Randy Rose (CIS): On the LinkedIns, yeah. Aaron Mog: put out great content. Everybody should should give you a follow. it's it's great to to get a chance to talk to you again and and I always love hearing your perspectives and you know I think you're Randy Rose (CIS): Yeah. Aaron Mog: yeah you're to the ground guy that I love to sort of to hear from. So thank you so much. Randy Rose (CIS): I try. Yeah, I try. I'm I'm Aaron Mog: no, I know you do. I'm I know it's a big part of of what you do every day. So it's great to see. Randy Rose (CIS): I'm not yeah, and I'm I'm not as probably not as active on on LinkedIn or really any social media as I should be. but I do try to to share some stuff out there. But CIS also has some interesting content and then I've been doing a lot of we've been posting a lot of stuff on our website that doesn't always make it to LinkedIn. but so Aaron Mog: Mm-hmm. Randy Rose (CIS): CIS has a blog so and we post a lot of our white papers there, stuff that's available for free. So we're doing a lot of research in, you know, AI threats and did some cool stuff related to physical threats. you know, threat actors that are using AI to help plan, potentially help plan attacks against like large events, for example. So Aaron Mog: Okay. Randy Rose (CIS): some really interesting research. It's available on the CIS website if if folks are interested. Aaron Mog: Awesome. well, Randy, thank you so much for taking the time. I appreciate you, man. and I'm sure I'll talk Randy Rose (CIS): Yeah, my pleasure. Aaron Mog: to you soon. All right. Cheers. Randy Rose (CIS): Take care.