Volledige transcriptie van Own Your AI Risk!

interesting because we had a CEO, a board member, a CFO, and a CIO, sorry, and a CISO in the room. 00:02:55.360 --> 00:03:01.439 So again, between all those C-level executives, the questions are still there. 00:03:01.759 --> 00:03:07.840 I understand if in many cases people can't precisely answer that one. 00:03:08.159 --> 00:03:09.520 However, we can try. 00:03:09.599 --> 00:03:14.240 And my take on that is you have to try, you have to start somewhere. 00:03:14.400 --> 00:03:16.159 Don't strive for perfection. 00:03:16.319 --> 00:03:18.479 Perfection is the biggest enemy of good. 00:03:18.879 --> 00:03:20.800 Why is it such a problem? 00:03:21.280 --> 00:03:24.319 And how can leaders get better at this? 00:03:24.639 --> 00:03:24.879 Sure. 00:03:24.960 --> 00:03:26.080 I guess it's novelty. 00:03:26.159 --> 00:03:29.840 I guess it's the fact that things are changing almost overnight. 00:03:30.000 --> 00:03:35.199 The last six months have fundamentally changed everything around us. 00:03:35.360 --> 00:03:38.719 And even before that, obviously, AI is not something new. 00:03:38.879 --> 00:03:42.800 But we need to start thinking what's behind the scenes. 00:03:42.879 --> 00:03:51.360 We need to start thinking about those things that were there, you know, always, like your data, your users, who's doing what, how, and why. 00:03:51.599 --> 00:03:55.919 Those are some fundamental questions that we still need to answer. 00:03:56.080 --> 00:04:02.080 Those are fundamental questions that were there 10 years ago, 15 years ago, 20 years ago. 00:04:02.240 --> 00:04:14.960 Our biggest challenge is, I guess, that we are still trying to find the next big enemy, something that's, you know, um, well, not very tangible to put it like that. 00:04:15.120 --> 00:04:22.560 And sometimes I think we're trying to hide behind that rather than answer the simple things that are in front of our noses. 00:04:23.120 --> 00:04:27.439 But AI definitely has changed the territory quite a bit. 00:04:27.680 --> 00:04:31.120 I mean, and it's rapidly evolving so quickly. 00:04:31.439 --> 00:04:40.639 So, how can business leaders stay on top of the increase, rapidly increasing risks from AI? 00:04:41.439 --> 00:04:42.879 Another fantastic question. 00:04:43.040 --> 00:04:48.959 Look, uh, the challenge there is that first and foremost, the speed of everything has changed so greatly. 00:04:49.120 --> 00:04:56.959 In the past, I think we were able to hide behind the fact that it was relatively expensive to find new exploits and whatnot. 00:04:57.199 --> 00:04:59.279 Unfortunately, we lost that control. 00:04:59.759 --> 00:05:06.959 Also, uh, we have something new that's happening that is genuinely one of those rare new new things, I would say. 00:05:07.040 --> 00:05:11.040 And that is on the back of a couple of incidents, we we recently saw. 00:05:11.199 --> 00:05:23.839 You know, it's very interesting when you can say there was no human attacker, there was no human intention, there was no one waking up in the morning saying, you know what, I'm gonna go after that company and I'm gonna hack them. 00:05:24.000 --> 00:05:29.360 We saw cases where AI sort of made that decision on its own. 00:05:29.680 --> 00:05:32.399 That is definitely something different. 00:05:32.639 --> 00:05:44.240 Um, however, at the end of the day, when we think about how those things happen, when we think about why those things happen, the fundamentals, the the base for everything is still the same. 00:05:44.480 --> 00:05:47.680 We have problems we haven't fixed for a very long time. 00:05:47.920 --> 00:06:01.680 We have maybe a huge amount of technical debt, we have some legacy problems, and in many cases, we are still trying to combat all of this using legacy processes that are unfortunately not fit for purpose anymore. 00:06:01.839 --> 00:06:11.759 So the biggest change, what people should do like tomorrow, is to start figuring out how to get rid of all those legacy processes. 00:06:11.920 --> 00:06:13.439 That's where the bottleneck is. 00:06:13.680 --> 00:06:14.720 Yes, absolutely. 00:06:14.879 --> 00:06:23.680 I want to go back to so when AI makes all these decisions by itself, but really that's from the input of everyone else and how it's been trained. 00:06:23.839 --> 00:06:30.240 So I think how can business leaders address their use with AI so this doesn't happen. 00:06:30.560 --> 00:06:36.079 Indeed, look, I guess the simple answer to that one is when it happened the first time. 00:06:36.240 --> 00:06:40.000 I looked at it and I was almost happy. 00:06:40.160 --> 00:06:44.800 I know that's wrong to put it like that, but let me explain myself. 00:06:44.959 --> 00:06:55.519 When you deal with junior cyber stuff, one of the first things we tell them, one of the first things we want to teach them is to think outside the box. 00:06:55.839 --> 00:06:58.000 That's exactly what happened. 00:06:58.319 --> 00:07:01.680 It started doing something well outside the box. 00:07:01.920 --> 00:07:16.319 But again, going back to basics, even in that case, yes, it depends whether you are talking about something that's happened within your environment, so what we like to refer to as a rogue agent, or something that's external to you. 00:07:16.480 --> 00:07:22.959 If it's external, again, it cannot do something new, it cannot do something that you're protected from. 00:07:23.279 --> 00:07:26.000 Therefore, again, it's back to basics. 00:07:26.319 --> 00:07:43.040 Sort out the problems you already have, change your processes, make sure that you don't suffer because you're too slow to respond to certain things, and because effectively you have things unresolved in your environment that are maybe years old. 00:07:43.199 --> 00:07:45.680 If that's the case, the probably somewhere else. 00:07:45.920 --> 00:07:51.600 If that's the case, you know what any threat actor can and will exploit that. 00:07:51.680 --> 00:07:56.720 I like to say that bad guys are running businesses,

they really take care of ROI. 00:07:56.879 --> 00:08:04.319 If they can open a bottom drawer and reach for something that's been there, I don't know, the last 10 years and you still haven't fixed it. 00:08:04.639 --> 00:08:06.079 That's what they're gonna go for. 00:08:06.240 --> 00:08:09.439 They're not going to throw money at a problem they don't have to. 00:08:09.600 --> 00:08:16.079 Again, if it's something that's inside, it's gen, you know, if it is genuinely AI as a problem. 00:08:16.639 --> 00:08:29.600 What I say uh advise people to do is look at what you've got, make sure that all the agents that are running across your environment obey the same rules that your users have to obey. 00:08:29.759 --> 00:08:40.559 Make sure that the identities behind those agents are controlled, make sure that you expire them and rotate them, make sure that you understand what is a good behavior. 00:08:40.720 --> 00:08:45.759 So, effectively, what I'm saying here is baseline the good stuff. 00:08:46.080 --> 00:08:48.720 There's probably still more time now to do that. 00:08:49.039 --> 00:08:59.120 Make sure that before things really get out of control, you understand what's going on, and you have the, I guess, as a benchmark, as a gauge. 00:08:59.360 --> 00:09:06.960 Because once you achieve that, you will then, I guess, easily spot what's extraordinary and you can go after it. 00:09:07.279 --> 00:09:08.240 Fantastic. 00:09:08.399 --> 00:09:13.519 Well, tomorrow you have another session, and it's called wrist yoga. 00:09:13.759 --> 00:09:14.159 Indeed. 00:09:14.399 --> 00:09:16.799 So share a little bit about that concept. 00:09:17.200 --> 00:09:19.840 Sure, a mind that is not throne. 00:09:19.919 --> 00:09:23.200 Uh, it's a fantastic concept we get from yoga. 00:09:23.360 --> 00:09:31.200 Uh, it's one of those things that when people think about yoga, you know, most of people think about postures and they think about it as an exercise. 00:09:31.360 --> 00:09:39.600 But the way to think about it is it's a system, it's a system that has to be practiced, and every element of that practice is important. 00:09:39.679 --> 00:09:50.080 And ultimately, where that leads you to, when we're talking about the eight limbs of yoga, effectively it calms the mind, it prepares you for what comes next. 00:09:50.320 --> 00:09:58.960 You don't get easily overexcited with good news, you don't effectively get into some state of despair with bad news. 00:09:59.200 --> 00:10:02.559 You're able to handle those things whatever they are. 00:10:02.720 --> 00:10:05.440 And that's exactly what this session is all about. 00:10:05.759 --> 00:10:22.000 It is effectively advocating for good risk management practices, it is advocating for if you prepare for all those things, if you practice the whole range of things that you should use, will not put you in a funny shape. 00:10:22.320 --> 00:10:26.399 Good news, well, paint them as a win and look towards the next thing. 00:10:26.720 --> 00:10:30.240 So thinking proactively and then being readily adaptable. 00:10:30.559 --> 00:10:59.200 Absolutely, and making sure that you think in advance about all of those scenarios, making sure that at the end of the day, what we advocate for in Qualis, which is risk operation center, you apply those principles so that you understand where the dangers might come from, and you actually put the right controls in place to be able to control as much of it in a risk, sorry, in a money-optimal way. 00:10:59.519 --> 00:11:07.440 Do you think in studying where the risk may come from, and this might be far out in the future, but we're hearing now more about quantum as well. 00:11:07.600 --> 00:11:07.919 Indeed. 00:11:08.240 --> 00:11:10.559 Does that add anything into the fold? 00:11:10.960 --> 00:11:12.320 It absolutely does. 00:11:12.480 --> 00:11:16.960 Um, when I talk about those things, I like to mention tree lenses. 00:11:17.279 --> 00:11:24.559 If you think about it, um, you know, we need to sort of have a view on what's really beyond the horizon. 00:11:24.720 --> 00:11:27.360 So maybe you need a telescope for that one. 00:11:27.519 --> 00:11:30.320 What's just around the corner, you need a periscope. 00:11:30.480 --> 00:11:31.840 What's in front of your nose? 00:11:32.000 --> 00:11:37.200 Well, you might need glasses or a magnifying glass, depending on how bad or good things are. 00:11:37.440 --> 00:11:41.440 That's exactly how you need to think about some of those things. 00:11:41.600 --> 00:11:50.799 And definitely quantum is one of those that at the moment it's somewhere far on the horizon, but it will be with us well, pretty much tomorrow. 00:11:51.039 --> 00:11:54.480 Uh, I guess the bad news is that we don't have the exact date. 00:11:54.639 --> 00:12:04.159 There are some dates when it comes to legislation, when it comes to the expiry date for certain protocols and algorithms and whatnot. 00:12:04.399 --> 00:12:16.720 But the bad news is really nobody knows exactly when the world's going to reach that stage where effectively everything that we know about simply becomes non-valid. 00:12:17.279 --> 00:12:22.879 Therefore, the biggest thing people can do now is understand what they have out there. 00:12:23.039 --> 00:12:24.159 Again, that's nothing new. 00:12:24.399 --> 00:12:33.519 Understand where those potential problems are, understand and put plans in place with some firm dates and names against them. 00:12:33.679 --> 00:12:36.960 Say, you know, this has to go by then, whatever. 00:12:37.120 --> 00:12:40.799 Understand where your data is, understand what you're using. 00:12:40.960 --> 00:12:45.360 This is just good old cyber hygiene, nothing new about that. 00:12:45.600 --> 00:12:53.279 But again, that is the very first step towards us preparing for the quantum event, if you want. 00:12:53.519 --> 00:13:01.440 And again, uh in COLIS, we do have something exciting coming when it comes to um the whole thing. 00:13:01.600 --> 00:13:23.360

And we will be helping our clients to understand again all of those things that I mentioned, make sure that you know they have a good visibility of what's out there, make sure that they understand why some of those things won't work anymore when that happens, and ultimately hopefully help them structure the whole programs around it so that they don't suffer tomorrow. 00:13:23.679 --> 00:13:30.720 Yeah, and one of the things seems to be a common thread that it's not just all on Qualest, that partnerships are important. 00:13:31.039 --> 00:13:35.279 Um, and can you share why it's so important to collaborate and partner with these other companies? 00:13:35.600 --> 00:13:36.320 Oh, absolutely. 00:13:36.480 --> 00:13:41.919 Look, we don't claim that we cover absolutely the entire cyber ecosystem. 00:13:42.159 --> 00:13:45.679 I don't think there's a single company out there that does. 00:13:46.000 --> 00:13:54.080 What is important, and it's also important from a perspective that client environments normally very complex environments. 00:13:54.240 --> 00:13:57.679 Uh, you have a variety of vendors, variety of products. 00:13:58.000 --> 00:14:03.919 Um, therefore, as I say, it's very important somehow to bring all of this stuff together. 00:14:04.080 --> 00:14:09.840 And as the industry, we need to become better at helping our clients achieve that. 00:14:10.240 --> 00:14:16.480 If all vendors worked in complete isolation, that would be at the end of the day a nightmare for our clients. 00:14:16.720 --> 00:14:22.879 That could be a nightmare for the entire industry, that would be a nightmare for everybody involved. 00:14:23.120 --> 00:14:24.559 Honestly, not good. 00:14:24.960 --> 00:14:46.879 Whereas if we again work together within the industry and if we provide some uh ready solutions to our clients, and if they have that additional level of confidence by knowing that our products integrate well, that our products work together to protect them, I guess that's a win-win. 00:14:47.440 --> 00:14:48.320 Absolutely. 00:14:48.480 --> 00:14:53.679 Well, if there was one key takeaway you could leave our audience today with, what would that mean? 00:14:55.120 --> 00:14:57.759 I guess this is the toughest question of them all. 00:14:57.919 --> 00:15:02.399 Trying to choose just one single nugget, I guess. 00:15:02.639 --> 00:15:14.879 Look, um, I'm gonna try to put it like this try and figure out what you have out there, try and figure out who's responsible for it, try to understand what's there around the corner. 00:15:15.679 --> 00:15:20.080 Yes, those are three things, but nonetheless, I think they are very important. 00:15:20.559 --> 00:15:30.639 Uh, if you want to succeed, if you want to stay afloat, if you want to be a successful business, I definitely try to uh think about all three. 00:15:30.960 --> 00:15:31.360 All right. 00:15:31.519 --> 00:15:33.759 Thank you so much for sticking with me today. 00:15:34.080 --> 00:15:34.799 Thank you. 00:15:35.039 --> 00:15:36.399 And thank you to our audience. 00:15:36.559 --> 00:15:40.720 If you have any questions or comments, leave them below, and I will try to respond back as soon as possible. 00:15:40.879 --> 00:15:41.440 Have a great