WEBVTT
00:00:00.080 --> 00:00:07.599
You know, what's interesting is when they designed the pyramids, it was also based around security because it was such a sacred path to immortality.
00:00:07.759 --> 00:00:16.879
So it's always humbling to know that security as a concept predominantly on top of humanity's mind, and we are now the digital warrior, so as to speak, uh extending that agenda.
00:00:17.039 --> 00:00:27.359
I think that there's a lot of unknown when it comes to AI agents, and when you talk about autonomous agents, essentially probabilistic models taking over what used to be a deterministic system.
00:00:27.519 --> 00:00:33.200
I think that it's it's a gray area, but I'm excited to uh tackle the security issues related to it.
00:00:42.399 --> 00:00:47.280
You're listening to the Black Hat Files, your backstage past to cybersecurity's global stage.
00:00:47.439 --> 00:00:49.039
I'm your host, Philip Wiley.
00:00:49.119 --> 00:00:53.039
Every month we bring you an exclusive interview recorded live at Black Hat MEA.
00:00:53.119 --> 00:00:55.359
From the heart of the industry, these stories are worth telling.
00:00:55.520 --> 00:01:01.039
Let's crack open today's file, Protecting Performance Data in the Age of AI Coaching.
00:01:01.200 --> 00:01:06.239
Our guest is Shri Manda, Chief Security and Trust Officer at Peloton Interactive.
00:01:06.400 --> 00:01:07.120
Welcome, Shri.
00:01:07.439 --> 00:01:08.879
Hey Philip, it's great to be here.
00:01:09.120 --> 00:01:11.359
Yeah, it's great to be here and great to meet you.
00:01:11.439 --> 00:01:13.359
So uh how is your conference going?
00:01:13.599 --> 00:01:14.079
It's great.
00:01:14.159 --> 00:01:18.079
I flew in from New York and uh I think we were speaking before this session.
00:01:18.159 --> 00:01:21.040
I actually flew into Cairo, explored the pyramids.
00:01:21.359 --> 00:01:24.959
That set me up in the right mindset to talk about cybersecurity here.
00:01:25.359 --> 00:01:25.680
Very cool.
00:01:25.760 --> 00:01:28.959
I imagine that was an interesting, interesting opportunity and experience.
00:01:29.280 --> 00:01:29.680
It is.
00:01:29.840 --> 00:01:38.879
You know, what's interesting is when they designed the pyramids, it was also based around security because it was such a sacred path to immortality.
00:01:39.040 --> 00:01:49.519
Uh the pyramids were essentially designed that they wouldn't be tomb raiders and thieves who would steal all these precious gems and artifacts that would help them get to the afterlife.
00:01:49.680 --> 00:01:56.719
So it's always humbling to know that security as a concept has always been uh predominantly on top of humanity's mind.
00:01:56.879 --> 00:02:00.959
And we are now the digital warrior, so as to speak, uh extending that agenda.
00:02:01.359 --> 00:02:06.239
Yeah, and speaking of the pyramids, just think that was cutting edge technology back then, cutting edge architecture.
00:02:06.560 --> 00:02:07.439
Cutting edge technology.
00:02:07.519 --> 00:02:08.960
That's a great segue to AI, Philip.
00:02:09.199 --> 00:02:09.520
Yeah.
00:02:10.000 --> 00:02:11.759
So what was your presentation on?
00:02:12.080 --> 00:02:16.080
The panel was really on uh, you know, uh autonomous AI agents.
00:02:16.400 --> 00:02:20.400
I think that there's a lot of unknown when it comes to AI agents.
00:02:20.479 --> 00:02:27.759
And when you talk about autonomous agents, essentially probabilistic models taking over what used to be a deterministic system.
00:02:27.919 --> 00:02:33.599
Uh, I think that it's it's a gray area, but I'm excited to uh tackle the security issues related to it.
00:02:33.919 --> 00:02:38.319
You know, working in your area, so what are some of the issues you see with like AI coaching?
00:02:38.719 --> 00:02:47.840
I think that AI coaching and uh performance data, the intersection of it, uh really results in a lot of legal, technical, ethical challenges.
00:02:48.159 --> 00:02:50.960
Fundamentally, I think about in three ways, right?
00:02:51.039 --> 00:03:06.000
So if you think about the data that essentially people allow to collect or get harvested in in terms of steps you take, the challenge, Philip, is that it's not just limited to the number of steps.
00:03:06.159 --> 00:03:18.719
A lot of variables, there's a lot of tech, which essentially tracks your breathing rate, your heart rate, your pulse rate, and all this data essentially compounds to kind of build a map, a fingerprint about your health.
00:03:18.879 --> 00:03:23.680
And then it gives you advice on changing your workout, changing your behaviors.
00:03:23.840 --> 00:03:28.000
And I think that's the that's the first risk area that I would like to call out.
00:03:28.159 --> 00:03:30.000
The second, LLM models.
00:03:30.240 --> 00:03:33.680
LLM models essentially are now being used as virtual coaches.
00:03:33.840 --> 00:03:41.599
You can literally tell the coach to build a workout program for you based on custom parameters that only you would share with that model.
00:03:41.919 --> 00:03:46.479
That again raises interesting questions around can you really trust that LLM coach?
00:03:46.560 --> 00:03:47.280
It's a model.
00:03:47.439 --> 00:03:49.199
What kind of bias exists there?
00:03:49.439 --> 00:03:56.479
I think the last one, and this is the most critical one, we've all heard about people relying on AI as companions.
00:03:56.719 --> 00:04:00.400
And imagine AI taking the place of health coaches.
00:04:00.479 --> 00:04:20.160
Now, all of a sudden, you're sharing confidential, extremely confidential health data, mental health data, and all of this uh to a model uh that is not bound uh by by the laws that govern data privacy, consent, and all these attributes that protect us as a civilized society.
00:04:20.240 --> 00:04:25.040
So I think those are the flavors, Philip, that that really keep us thinking about this intersection.
00:04:25.360 --> 00:04:33.680
Yeah, it's kind of an interesting area because you figure some of the some of the data that people share personally is not as in-depth as you mentioned the health metrics and all that.
00:04:33.759 --> 00:04:49.439
These are things that you know people want to make sure remains private, you know, because you see some industries using AI, it's intellectual property, it's still sensitive data, but when it comes down to your personal data, you know, it really affects us more than like corporate data would typically affect someone.
00:04:49.759 --> 00:04:57.040
You bring up an interesting point, which is performance data falls in that gray area of GDPR and HIPAA.
00:04:57.519 --> 00:05:02.160
And I think it's a it's a nascent field, uh, it's a gray area for sure.
00:05:02.319 --> 00:05:06.319
And I think everybody's trying to figure out uh what the future is.
00:05:06.560 --> 00:05:20.959
But uh, along with that challenge comes a realization that the onus of safeguarding behavioral data, performance data really rests on the vendor and also the user to be more aware of the risks.
00:05:21.279 --> 00:05:33.920
Yeah, it's very interesting to see because it had all the adoption of all these fitness trackers and then the different exercise equipment that has the AI coaching, it's amazing how that's spread, but it's just so useful.
00:05:34.000 --> 00:05:39.439
The people are willing to put their information into it because the output, as you mentioned, using AI as a coach.
00:05:39.600 --> 00:05:45.439
And what's kind of interesting is uh recently I was using Chat GPT because I'm a former powerlifter.
00:05:45.680 --> 00:05:49.199
I used to compete in powerlifting, and I wanted a new routine designed.
00:05:49.279 --> 00:05:53.360
And the information that you give it, it's amazing what the output you can get.
00:05:53.519 --> 00:06:03.759
But it's really dependent on how much information you put in there because I put my age, I'm this year old male, I have these health issues, these are my goals, this is my current fitness level, all this.
00:06:03.920 --> 00:06:05.839
I want to improve my VOT max.
00:06:05.920 --> 00:06:09.120
And it was able to print out a pretty comprehensive workout for me.
00:06:09.360 --> 00:06:10.000
That's amazing.
00:06:10.160 --> 00:06:13.920
You know, what's interesting, I know Philip, you come from a pen testing background.
00:06:14.160 --> 00:06:30.800
What's interesting is when you look at a risk surface of wearables and fitness gear, you'd always think about what operating system are they using, what hardware, firmware exists, and how do you essentially manage vulnerabilities, how do you manage connectivity to secure networks?
00:06:30.959 --> 00:06:43.279
And your worst nightmare would be somebody taking a USB, plugging it into your wearable or uh, you know, uh a treadmill or or a or a bike and essentially injecting malware.
00:06:43.600 --> 00:07:02.879
But what's fascinating is that is something that you would wish for in the age of AI, because now you have AI features that are actually collecting data, giving you feedback, your virtual coaches that can look at your gate and provide suggestions based on computer vision on how to correct it uh real time.
00:07:03.040 --> 00:07:17.040
Uh so I think as technology evolves through AI, I feel like the risk surface around variables, around treadmills, around fitness uh in general, and how performance data influences those decisions is an interesting evolution.
00:07:17.360 --> 00:07:30.079
One of the things I'm kind of curious about when you brought up these devices, do you know, because I know one of the things that I think is a recent requirement is that FDA is requiring that different medical devices be pen tested.
00:07:30.160 --> 00:07:37.759
Because you know, at one time people there, you know, back in probably about 2014 or so, someone figured out how to hack a pacemaker.
00:07:37.920 --> 00:07:51.519
I don't think it was a malicious actor, I think it was just a security researcher found that because you know, with innovations in technology, for many years people didn't think about security, they only thought about the functionality making a good product.
00:07:51.759 --> 00:07:56.800
And people that are creators, you know, they really didn't come from the area where they had to learn security.
00:07:56.959 --> 00:08:02.480
So it's interesting how like FDAs require medical devices to be secure, I mean, be uh assessed.
00:08:02.639 --> 00:08:06.560
What about different types of uh exercise equipment and wearables?
00:08:06.800 --> 00:08:10.800
Are those type of items do you know, or they go through any kind of security assessments?
00:08:11.120 --> 00:08:21.519
So there are electronic, it they come under electronic equipment and there are some guardrails around how those equipment can be resilient to cyber risks, especially in Europe.
00:08:21.600 --> 00:08:27.759
Uh, the US has its own version of hardware testing, but nowhere as thorough or systematic as for a medical device.
00:08:27.920 --> 00:08:36.559
You know, what's interesting is for viewers and listeners who uh who haven't come across Peloton, uh, Peloton pioneered the connected fitness experience.
00:08:36.720 --> 00:08:45.440
So think about a treadmill or a bike uh in the comfort of your home network, and all of a sudden you're opening it up for social interactivity.
00:08:45.600 --> 00:09:04.480
Essentially, it's streaming content, it's the social experience where you can connect and engage other participants, and that changed the paradigm of a static physical device in your home network to a hyper-connected, hyper-personalized experience that these modern devices are now capable of delivering.
00:09:04.799 --> 00:09:30.240
So I'm sure there's a due to that factor, there's a lot of concerns with privacy that you have to really make sure that everything's secure because that you mentioned the social aspect, now all of a sudden someone else is your home is not just the trainer, you're connecting with other people, and the way sometimes malicious actors act, they leverage things like social media to try to gain information on people, stalk them, and and other uh things worse.
00:09:30.639 --> 00:09:31.039
For sure.
00:09:31.200 --> 00:09:34.559
I think that the challenges exist, they just amplify.
00:09:34.720 --> 00:09:36.559
It's really around data provenance.
00:09:36.720 --> 00:09:45.200
You need to understand uh that there may be legal issues with the data that you are using to train those AI models and enhance your workout experience.
00:09:45.440 --> 00:10:02.720
So uh, you know, it's things like origin, things around traceability, lineage, things around identifying timestamps, and understanding how those LLMs have been customized to perform in a in an environment that essentially is processing performance data.
00:10:02.879 --> 00:10:15.919
And the second is around data quality, and and that's really interesting because at the end of the day, any type of a virtual coach is a predictive model and it has to learn on training data, and there are biases in data.
00:10:16.000 --> 00:10:33.679
Uh, you know, there are sampling techniques, and especially in the realm of synthetic data, uh, it's always interesting to have guardrails around uh, you know, how do you know that the model isn't biased and it's not influenced by a certain segment, especially in an environment, as you mentioned, is more social and more connected.
00:10:34.000 --> 00:10:47.440
Yeah, it's it's really interesting how how that's that's evolved, and and just seeing all the way that cybersecurity's evolved so much, just this week speaking to uh Daniel Meachum from Legendary Uh Media.
00:10:47.519 --> 00:10:58.159
They're a company that's a movie production company, and then talking to folks that from iHeartRadio, and you see all these different touch points and all these areas of security, they really wasn't there.
00:10:58.320 --> 00:11:08.399
You figure, like looking at the iHeartRadio example back when it's just broadcast radio, there wasn't all the privacy issues or security issues that have come about.
00:11:08.559 --> 00:11:13.600
The film industry used to traditional film, there wasn't much data security.
00:11:13.679 --> 00:11:17.120
That that's physical security that you lock up your films.
00:11:17.279 --> 00:11:27.519
But it's interesting, like in your industry that you have AI and the social piece, that at one time exercise equipment didn't have that functionality, that wasn't really an issue.
00:11:27.600 --> 00:11:29.200
You didn't have to worry about the security.
00:11:29.360 --> 00:11:31.919
So it's really interesting how that's all evolved.
00:11:32.000 --> 00:11:42.480
And and you just look at just the past 10 years alone, how you know smartphone functionality, wearable devices, AI, and high-speed internet has made all this stuff possible.
00:11:42.799 --> 00:11:43.120
Totally.
00:11:43.279 --> 00:12:02.879
And I think that fitness and well-being is a personal topic, especially in today's day and age, people are much more aware of their lifestyle, and um the role that connected fitness devices, wearables, the role that they play in influencing your mental health, behavioral health is immense.
00:12:03.039 --> 00:12:09.360
And I think that as the usage quadruples explodes, it is going to be an area of challenge.
00:12:09.519 --> 00:12:15.440
I think it's not just about AI to enhance your experience with the device, Philip.
00:12:15.519 --> 00:12:20.639
It's also about how value is being created on these devices through AI.
00:12:20.799 --> 00:12:32.879
So, for example, uh for dubbing, uh for voiceovers, for content, for translating that content into different languages, the use of AI agents, uh, for example, to uh to record stuff.
00:12:33.120 --> 00:12:35.759
I just think that the potential is endless.
00:12:35.919 --> 00:12:39.200
And I think that the risk surface definitely is a cause of concern.
00:12:39.440 --> 00:12:49.759
Yeah, I just have to say though, is for it comes to wearables and fitness and AI, all that I'm a big fan because one of the things I think about it is that it's bringing some of these features that are affordable.
00:12:49.840 --> 00:12:51.679
Not everyone can afford a personal trainer.
00:12:51.840 --> 00:13:01.440
You know, personal trainers, you know, in the States, you're spending it could be$50 an hour if you get a cheap trainer up to over$100 an hour, and not everyone can afford that.
00:13:01.600 --> 00:13:06.480
And sometimes people look at some of these devices, these bikes such as Peloton, and think it's expensive.
00:13:06.559 --> 00:13:09.759
But when you really look at the value of what you're getting, it's really a good value.
00:13:09.840 --> 00:13:20.240
It's not it's able to bring you something you may not be able to afford to go to a gym and pay for a personal trainer and to be able to have the accessibility to them anytime that you need is pretty valuable.
00:13:20.320 --> 00:13:24.559
And just the the way you can improve your health, all the metrics you get from some of these devices.
00:13:24.639 --> 00:13:25.759
I'm a fan myself.
00:13:26.000 --> 00:13:29.039
I have one of the rings that track your health.
00:13:29.120 --> 00:13:32.799
I've got a watch that tracks as well, and these metrics are very important.
00:13:32.879 --> 00:13:36.559
I find valuable because it helps me adjust when I travel.
00:13:36.799 --> 00:13:45.759
This ring lets me know, based on heart rate variability and body temperature, whether I'm starting to get sick, I need to sleep a little bit more and I'm able to adjust.
00:13:45.919 --> 00:13:58.159
So, you know, not even so much from a security aspect, these different devices are very, very helpful in people's health and and helps kind of push them to achieve their goals and stay on track.
00:13:58.480 --> 00:13:58.879
Absolutely.
00:13:58.960 --> 00:14:01.759
And and the regulatory issue with that is it's a gray area.
00:14:01.919 --> 00:14:10.799
Uh, you I think the argument is to be made if I had access to your pulse rate, your breathing rate, your heart rate, does it uniquely identify you with that data?
00:14:11.039 --> 00:14:20.639
And that's that's debatable, and that's why it's that gray area uh because traditional data is defined by social security numbers, your your birth dates, so on and so forth.
00:14:20.720 --> 00:14:22.320
Uh, and that that's what makes it unique.
00:14:22.480 --> 00:14:23.840
Philip, I had a question for you.
00:14:24.080 --> 00:14:28.879
You started your career in cybersecurity uh through pen testing.
00:14:29.039 --> 00:14:38.159
And when you look at uh the AI system, which is really an open-ended system in these days, how would you how would you structure your pen test strategy?
00:14:38.480 --> 00:14:38.720
Sure.
00:14:39.120 --> 00:14:54.960
One of the things you have to take in consideration is now you have AI added to the mix, so you need to make sure you're pen testing your AI solution that you're using, the different LLMs you're using, whether it's an open source public product or it's internal, you need to be testing those.
00:14:55.039 --> 00:14:59.519
But I think also people need to pen test the connection points.
00:14:59.600 --> 00:15:02.240
So maybe you've got a chat bot on your website.
00:15:02.480 --> 00:15:08.399
You need to think of that when you're doing the web application pen test, you need to also make sure that you're pen testing the AI as well.
00:15:08.639 --> 00:15:13.279
I think uh that's fascinating because it's really about multiple form factors.
00:15:13.360 --> 00:15:18.480
You have content, you have the operating system, the traditional systems-related vulnerabilities.
00:15:18.639 --> 00:15:22.559
Uh, you're you also have uh the network connectivity, the social aspect of it.
00:15:22.639 --> 00:15:28.080
So it's almost like uh you're pen testing uh, you know, I don't know, like uh like a phone or something like that.
00:15:28.320 --> 00:15:35.679
Yeah, it's interesting how that's evolved because when I first started pen testing was in 2012, and things have become so much more complex.
00:15:36.000 --> 00:15:38.639
IoT was just kind of getting started.
00:15:38.799 --> 00:15:41.279
Uh, you know, so a lot of people weren't pen testing that yet.
00:15:41.440 --> 00:15:47.120
One of the consulting companies I work for, they want to get us trained on IoT so we could test those those devices.
00:15:47.279 --> 00:16:00.480
But just looking at the whole, you even mentioned content, and that's one of the things that you have to you know protect your content because I'm sure you've got workouts and things that you don't want leaked that someone, a competitor could get and and take that information.
00:16:00.559 --> 00:16:13.120
So it's pretty interesting how that's all expanded into content, which content before was just files, it was data, it really wasn't unless you had some IVR system that you're recording phone calls or something like that.
00:16:13.360 --> 00:16:15.279
There really wasn't so much on the media side.
00:16:15.600 --> 00:16:16.000
For sure.
00:16:16.159 --> 00:16:23.279
And and Philip, I I'm not sure about you, but I'm getting ready for a world where virtual reality is a thing.
00:16:23.440 --> 00:16:28.320
Think about your VR glasses and you decide your fitness experience.
00:16:28.480 --> 00:16:30.320
Uh, that's the next form of being connected.
00:16:30.559 --> 00:16:39.519
Yeah, it's kind of interesting because you seeing some of the the video games out there, like the Wii used to have some of those, so it's really interesting to think of what's going to be possible.
00:16:39.679 --> 00:17:00.000
You know, you take a company like yours, it's experts and fitness to be able to come up with different devices to be able to enhance the experience because you know a lot of times people have bikes or treadmills, but if you bring in that VR experience, you're able to take that dull, boring uh walk or run on the treadmill, make it interesting, kind of create whatever reality you want.
00:17:00.080 --> 00:17:05.359
And that's kind of helpful because for me, uh cardio is not always the most fun part of a workout.
00:17:05.440 --> 00:17:13.279
I used to do cardio and I would do cardio for an hour, and I had to have a good television show on to keep my interest, otherwise I'd get bored and be done with it.
00:17:13.359 --> 00:17:15.759
But it's interesting that you bring up the VR.
00:17:15.839 --> 00:17:23.920
I could just imagine what possibilities it's gonna open up because you see some of the VR video games and stuff at the arcades along with the home VR setup.
00:17:24.079 --> 00:17:29.680
Yeah, I'm I'm I I I don't know about you, Philip, but I'm hooked on to uh the meta glasses, the Ray Band glasses.
00:17:29.759 --> 00:17:46.400
I think that's a fascinating form factor to really collect data uh as as it's seen real time and process that data uh to integrate with APIs from maps, from other functionalities, and create that real-time image for the user to make educated decisions.
00:17:46.559 --> 00:17:57.519
I mean, that that is really uh, again, a great example of multiple modalities, content, the social aspect, data coming together in the form of a system to deliver that experience.
00:17:57.759 --> 00:17:58.799
Yeah, those are very impressive.
00:17:58.880 --> 00:18:07.359
And one of the things I was thinking about recently with the like the meta classes, wouldn't it be cool if they had a feature that would you could plug into to like LinkedIn?
00:18:07.680 --> 00:18:13.200
So if you're out at a conference and you're meeting a customer or you see someone, you're able to recognize them.
00:18:13.279 --> 00:18:14.480
Maybe you go to a lot of conferences.
00:18:14.559 --> 00:18:16.559
I run into this a lot, uh, even before recording.
00:18:17.039 --> 00:18:18.160
That's your next startup idea.
00:18:18.319 --> 00:18:21.440
Yeah, so that you can integrate that with uh with the CRM.
00:18:21.599 --> 00:18:37.920
You got in the LinkedIn, so you can take the profile pictures and and be able to let the salesperson or whoever has those glasses built identify people and you know different things about them because traditionally salespeople had to remember, you know, their wife, kids, birth dates, anniversaries, and all that stuff.
00:18:38.000 --> 00:18:42.559
So if you had this accessible through uh VR, I love that, Philip.
00:18:42.640 --> 00:18:53.440
Essentially, use the sensor as a means to collect data and then agents, autonomous agents in the background, process that data, make integrations, and curate what the experience that you need.
00:18:53.599 --> 00:18:54.400
Uh, I love it.
00:18:54.720 --> 00:19:04.000
And and one of the things I think is a good a big help too is you take someone that was, say, you know, as people get older, they start getting memory issues, and you're able to help them remember.
00:19:04.319 --> 00:19:16.160
Yeah, I just want to segue to what you mentioned, which is uh, you know, we we keep talking about risk, but it's also important to understand the impact uh this evolving technology has on human life.
00:19:16.319 --> 00:19:22.319
Uh it's not just about looking good and feeling good or uh you know feeling great mentally.
00:19:22.640 --> 00:19:34.400
Uh we do have uh our society does have people uh who who have handicaps, uh people who are constrained to their beds, uh people who have limited mobility.
00:19:34.640 --> 00:19:44.799
And I think that variable tech, especially in the health sector, uh I was just listening to a talk where uh they were able to create this device, Philip.
00:19:44.880 --> 00:19:49.359
It essentially it was a glass that would uh wrap around the person's eyes.
00:19:49.519 --> 00:19:54.160
The person was completely paralyzed, all they could do was move their uh you know their eyelids.
00:19:54.799 --> 00:20:05.119
And um, you know, based on the flutter of their eyelid uh and their retina, the glass would automatically uh translate that in into instructions and make things happen.
00:20:05.279 --> 00:20:08.400
So for the first time in their life, that person could actually paint.
00:20:08.720 --> 00:20:10.559
That was profound for me.
00:20:10.640 --> 00:20:18.319
Uh, and that actually makes it worth to solve the risk and the cybersecurity problems associated with this evolving uh domain.
00:20:18.480 --> 00:20:20.400
Uh, because at the end of the day, you are helping people.
00:20:20.640 --> 00:20:30.799
Yeah, and and on that same note, it was kind of interesting, like the Neuralink and some of those other devices that are coming out the brain transplants or implants that you're able to think and and do commands.
00:20:30.880 --> 00:20:40.400
So it's pretty amazing, you know, it'd be venture to guess for the next 10 or 20 years, a lot of these disabilities will be overcome by technology.
00:20:40.799 --> 00:20:46.880
And you know, uh you have to you have to bring up quantum computing uh when you talk about Neuralink.
00:20:47.039 --> 00:20:58.799
Essentially it's about faster processing, autonomous processing, and the ability to connect connect ideas and thoughts uh faster than the human brain.
00:20:58.880 --> 00:21:05.119
Uh, and I think that's going to be an era that that really uh you know hopefully we see it in our in our lifetime.
00:21:05.440 --> 00:21:19.599
Yeah, it's pretty pretty amazing the things they come up with, and you see some of these devices that are like an exoskeleton that can help someone walk, you know, using you know merging robotics, AI, and these different technologies to help give someone the ability to walk, it's pretty amazing.
00:21:19.920 --> 00:21:23.920
So when you think about security, we always try to ground security in in reality.
00:21:24.079 --> 00:21:38.960
So, for example, um, you know, when you talk about performance data, it is data, it is really the uh the whole process of cleansing that data and readying it for models that can extract value from that data and and create that customer experience.
00:21:39.200 --> 00:21:59.839
When you think about traditional threat vectors, do you ever wonder if the way vulnerabilities were exploited, which is through malware injection, through an operating system that wasn't upgraded, um, do you do you wonder if there are new avenues of threats uh that that people need to not think about, especially especially as cyber.
00:22:00.240 --> 00:22:01.200
Security professionals.
00:22:01.519 --> 00:22:07.759
Yeah, I think one of the best things I think to stay ahead of that is to keep up with the latest trends like AI and stuff.
00:22:07.839 --> 00:22:12.000
Because one of the things I kind of noticed back with cloud, some people were kind of slow to adopt.
00:22:12.079 --> 00:22:34.400
I think staying uh up to date with that stuff, uh going to conferences like this, doing research, I mean, have a research team, uh, security researchers, because sometimes the pen test team may be tied up doing pen test assessments, but if you allow them to have some research time or even have a dedicated research team that they can actually be proactive, more proactive in the security area.
00:22:34.640 --> 00:22:36.079
I think that that's a great observation.
00:22:36.319 --> 00:22:40.880
So, what what has been uh some of your favorite presentations that you've seen while you've been here?
00:22:41.039 --> 00:22:47.599
Oh, I saw a presentation by Rick Beige who's essentially talking about the state of security as seen through the lens of the CIA.
00:22:47.680 --> 00:22:50.720
Uh, and I'm sure you've been through some of those presentations.
00:22:50.880 --> 00:23:03.119
Uh, I think when people who are government insiders start talking about how they view security, it all of a sudden crystallizes your view on risk uh through a different lens.
00:23:03.200 --> 00:23:04.480
Uh, and that was fascinating.
00:23:04.640 --> 00:23:19.039
Essentially, they're talking about quantum computing, uh, nation-state actors, uh, the prevalence of drones in frontline battlefields, and how uh they're thinking about hardening it through uh traditional cybersecurity measures.
00:23:19.119 --> 00:23:20.400
I think that was a fascinating topic.
00:23:20.720 --> 00:23:41.039
Yeah, that's that's very interesting, and it's always good when someone like that one of those agencies shares some of their insights because you know, people working in corporate America, some of the things we don't see doesn't mean that we're not gonna see it because nation states are coming after our infrastructure, trying to get our data, and so that's becoming more and more of a threat.
00:23:41.200 --> 00:23:48.720
And actually, one of the speakers here is Born Watna, and Bjorn works for Interpol, so he's gonna be one of the guests on this podcast.
00:23:48.799 --> 00:24:05.839
So it'd be interesting to see what he's seen from that side, because like you mentioned, like CIA, but it's kind of interesting to take some of it, he has an interesting career path because he was in corporate America doing cybersecurity and to go into like law and for international law enforcement is kind of interesting because people usually do it the other way.
00:24:05.920 --> 00:24:19.599
Because then, like in the US, you'll see people that get out of the military, they'll spend X amount of years in the FBI, and then from that experience they're able to go somewhere else and do really well and lead and kind of give some insight that typical cybersecurity folks may not have.
00:24:19.839 --> 00:24:20.799
You have a pack schedule.
00:24:21.039 --> 00:24:23.200
It looks like the theme of the season is AI.
00:24:23.279 --> 00:24:29.519
Uh, is there any topic that you think um, you know, um that that you're particularly uh keen on digging in?
00:24:29.759 --> 00:24:38.880
Yeah, some of the things that interest me most is you know, there's products out there that use AI, uh, but what I'm really probably most interested in is people learning how to scale what they're doing.
00:24:39.039 --> 00:24:48.319
Maybe there's not a product out there to do what they're doing, or some there's a need, or someone's gonna pull out money into doing just minor pieces of what they do, but learning to automate.
00:24:48.480 --> 00:25:00.960
Because I've uh have a friend, Jeff Foley, that created the AWASP AMASS project, which is a an open source external attack surface management and reconnaissance tool, a free tool.
00:25:01.119 --> 00:25:08.400
But how he came about doing that as a network administrator, he would create scripts and stuff to automate what he's doing.
00:25:08.559 --> 00:25:16.559
So I think with using AI, people leveraging learning how to automate what they're doing, because so many people are worried about losing their jobs to AI.
00:25:16.720 --> 00:25:23.440
But if you're able to scale and do more, I think you're gonna make yourself a little more resistant to to uh job reduction.
00:25:23.680 --> 00:25:24.319
That's great insight.
00:25:24.400 --> 00:25:33.039
And I know we're running out of time, but I think you know, the one thing that I do want to mention uh to segue off of your statement is it's also the supply chain.
00:25:33.119 --> 00:25:41.119
You know, when you talk about you know network surveillance, uh look at all the infrastructure that's needed to keep this connected fitnesses, uh, fitness equipment going.
00:25:41.200 --> 00:25:49.680
It's the CDN, it's your network underlay, all these vendors and all their systems that are powering this experience for the consumer.
00:25:49.920 --> 00:26:03.440
What's always fascinating to me is also the basic uh prescription models, uh, the recommender models, all of them working in the back end uh to really create that experience for uh a health conscious consumer.
00:26:03.599 --> 00:26:09.200
Uh, but what's the the point I wanted to make is there's also specialized architecture now.
00:26:09.440 --> 00:26:31.680
You have uh TPUs and GPUs drawing a lot of power, you have memory that's really sophisticated to ensure that the GPUs aren't starved of data, and then LLMs are spread across multiple microprocessors and the fabric that connects it uh that has to be reliable and has to be uh low latency driven to create that experience.
00:26:31.920 --> 00:26:48.319
Uh, the point I'm trying to make is uh as we think about organizations and domains that are being disrupted by AI, uh I feel that the underlying architecture and the technology that's powering these experiences is also going through a tectonic change.
00:26:48.400 --> 00:26:52.000
And that's uh that's another uh that's probably a topic for another day.
00:26:52.319 --> 00:27:00.799
Yeah, especially since you mentioned that, some of the outages with CDNs and different cloud providers and stuff, that's a big thing to take in consideration.
00:27:00.880 --> 00:27:21.920
So it's amazing why we really need to look at these products we're using, and it's good that these companies are learning from their mistakes because you know, before being without internet, you know, wasn't a life or death, and now we've we're so reliant on connectivity, the CDNs and uh cloud computing, network connectivity, all that.
00:27:22.000 --> 00:27:31.039
So I think it was what the AWS breach that the AWS not breach, the AWS outage that literally uh handicapped all the major companies.
00:27:31.359 --> 00:27:34.880
Yeah, back to the CIA triad, the availability piece.
00:27:34.960 --> 00:27:38.160
Sometimes we forget about that until we're affected by it.
00:27:38.400 --> 00:27:38.880
Love it.
00:27:39.039 --> 00:27:40.240
So that that's a wrap.
00:27:40.319 --> 00:27:42.559
A big thank you to our guest, Shri Manda.
00:27:42.799 --> 00:27:45.359
Let's close this file until the next chapter.
00:27:45.440 --> 00:27:47.680
This is Philip Wiley signing off.
00:00:00.080 --> 00:00:07.599
You know, what's interesting is when they designed the pyramids, it was also based around security because it was such a sacred path to immortality.
00:00:07.759 --> 00:00:16.879
So it's always humbling to know that security as a concept predominantly on top of humanity's mind, and we are now the digital warrior, so as to speak, uh extending that agenda.
00:00:17.039 --> 00:00:27.359
I think that there's a lot of unknown when it comes to AI agents, and when you talk about autonomous agents, essentially probabilistic models taking over what used to be a deterministic system.
00:00:27.519 --> 00:00:33.200
I think that it's it's a gray area, but I'm excited to uh tackle the security issues related to it.
00:00:42.399 --> 00:00:47.280
You're listening to the Black Hat Files, your backstage past to cybersecurity's global stage.
00:00:47.439 --> 00:00:49.039
I'm your host, Philip Wiley.
00:00:49.119 --> 00:00:53.039
Every month we bring you an exclusive interview recorded live at Black Hat MEA.
00:00:53.119 --> 00:00:55.359
From the heart of the industry, these stories are worth telling.
00:00:55.520 --> 00:01:01.039
Let's crack open today's file, Protecting Performance Data in the Age of AI Coaching.
00:01:01.200 --> 00:01:06.239
Our guest is Shri Manda, Chief Security and Trust Officer at Peloton Interactive.
00:01:06.400 --> 00:01:07.120
Welcome, Shri.
00:01:07.439 --> 00:01:08.879
Hey Philip, it's great to be here.
00:01:09.120 --> 00:01:11.359
Yeah, it's great to be here and great to meet you.
00:01:11.439 --> 00:01:13.359
So uh how is your conference going?
00:01:13.599 --> 00:01:14.079
It's great.
00:01:14.159 --> 00:01:18.079
I flew in from New York and uh I think we were speaking before this session.
00:01:18.159 --> 00:01:21.040
I actually flew into Cairo, explored the pyramids.
00:01:21.359 --> 00:01:24.959
That set me up in the right mindset to talk about cybersecurity here.
00:01:25.359 --> 00:01:25.680
Very cool.
00:01:25.760 --> 00:01:28.959
I imagine that was an interesting, interesting opportunity and experience.
00:01:29.280 --> 00:01:29.680
It is.
00:01:29.840 --> 00:01:38.879
You know, what's interesting is when they designed the pyramids, it was also based around security because it was such a sacred path to immortality.
00:01:39.040 --> 00:01:49.519
Uh the pyramids were essentially designed that they wouldn't be tomb raiders and thieves who would steal all these precious gems and artifacts that would help them get to the afterlife.
00:01:49.680 --> 00:01:56.719
So it's always humbling to know that security as a concept has always been uh predominantly on top of humanity's mind.
00:01:56.879 --> 00:02:00.959
And we are now the digital warrior, so as to speak, uh extending that agenda.
00:02:01.359 --> 00:02:06.239
Yeah, and speaking of the pyramids, just think that was cutting edge technology back then, cutting edge architecture.
00:02:06.560 --> 00:02:07.439
Cutting edge technology.
00:02:07.519 --> 00:02:08.960
That's a great segue to AI, Philip.
00:02:09.199 --> 00:02:09.520
Yeah.
00:02:10.000 --> 00:02:11.759
So what was your presentation on?
00:02:12.080 --> 00:02:16.080
The panel was really on uh, you know, uh autonomous AI agents.
00:02:16.400 --> 00:02:20.400
I think that there's a lot of unknown when it comes to AI agents.
00:02:20.479 --> 00:02:27.759
And when you talk about autonomous agents, essentially probabilistic models taking over what used to be a deterministic system.
00:02:27.919 --> 00:02:33.599
Uh, I think that it's it's a gray area, but I'm excited to uh tackle the security issues related to it.
00:02:33.919 --> 00:02:38.319
You know, working in your area, so what are some of the issues you see with like AI coaching?
00:02:38.719 --> 00:02:47.840
I think that AI coaching and uh performance data, the intersection of it, uh really results in a lot of legal, technical, ethical challenges.
00:02:48.159 --> 00:02:50.960
Fundamentally, I think about in three ways, right?
00:02:51.039 --> 00:03:06.000
So if you think about the data that essentially people allow to collect or get harvested in in terms of steps you take, the challenge, Philip, is that it's not just limited to the number of steps.
00:03:06.159 --> 00:03:18.719
A lot of variables, there's a lot of tech, which essentially tracks your breathing rate, your heart rate, your pulse rate, and all this data essentially compounds to kind of build a map, a fingerprint about your health.
00:03:18.879 --> 00:03:23.680
And then it gives you advice on changing your workout, changing your behaviors.
00:03:23.840 --> 00:03:28.000
And I think that's the that's the first risk area that I would like to call out.
00:03:28.159 --> 00:03:30.000
The second, LLM models.
00:03:30.240 --> 00:03:33.680
LLM models essentially are now being used as virtual coaches.
00:03:33.840 --> 00:03:41.599
You can literally tell the coach to build a workout program for you based on custom parameters that only you would share with that model.
00:03:41.919 --> 00:03:46.479
That again raises interesting questions around can you really trust that LLM coach?
00:03:46.560 --> 00:03:47.280
It's a model.
00:03:47.439 --> 00:03:49.199
What kind of bias exists there?
00:03:49.439 --> 00:03:56.479
I think the last one, and this is the most critical one, we've all heard about people relying on AI as companions.
00:03:56.719 --> 00:04:00.400
And imagine AI taking the place of health coaches.
00:04:00.479 --> 00:04:20.160
Now, all of a sudden, you're sharing confidential, extremely confidential health data, mental health data, and all of this uh to a model uh that is not bound uh by by the laws that govern data privacy, consent, and all these attributes that protect us as a civilized society.
00:04:20.240 --> 00:04:25.040
So I think those are the flavors, Philip, that that really keep us thinking about this intersection.
00:04:25.360 --> 00:04:33.680
Yeah, it's kind of an interesting area because you figure some of the some of the data that people share personally is not as in-depth as you mentioned the health metrics and all that.
00:04:33.759 --> 00:04:49.439
These are things that you know people want to make sure remains private, you know, because you see some industries using AI, it's intellectual property, it's still sensitive data, but when it comes down to your personal data, you know, it really affects us more than like corporate data would typically affect someone.
00:04:49.759 --> 00:04:57.040
You bring up an interesting point, which is performance data falls in that gray area of GDPR and HIPAA.
00:04:57.519 --> 00:05:02.160
And I think it's a it's a nascent field, uh, it's a gray area for sure.
00:05:02.319 --> 00:05:06.319
And I think everybody's trying to figure out uh what the future is.
00:05:06.560 --> 00:05:20.959
But uh, along with that challenge comes a realization that the onus of safeguarding behavioral data, performance data really rests on the vendor and also the user to be more aware of the risks.
00:05:21.279 --> 00:05:33.920
Yeah, it's very interesting to see because it had all the adoption of all these fitness trackers and then the different exercise equipment that has the AI coaching, it's amazing how that's spread, but it's just so useful.
00:05:34.000 --> 00:05:39.439
The people are willing to put their information into it because the output, as you mentioned, using AI as a coach.
00:05:39.600 --> 00:05:45.439
And what's kind of interesting is uh recently I was using Chat GPT because I'm a former powerlifter.
00:05:45.680 --> 00:05:49.199
I used to compete in powerlifting, and I wanted a new routine designed.
00:05:49.279 --> 00:05:53.360
And the information that you give it, it's amazing what the output you can get.
00:05:53.519 --> 00:06:03.759
But it's really dependent on how much information you put in there because I put my age, I'm this year old male, I have these health issues, these are my goals, this is my current fitness level, all this.
00:06:03.920 --> 00:06:05.839
I want to improve my VOT max.
00:06:05.920 --> 00:06:09.120
And it was able to print out a pretty comprehensive workout for me.
00:06:09.360 --> 00:06:10.000
That's amazing.
00:06:10.160 --> 00:06:13.920
You know, what's interesting, I know Philip, you come from a pen testing background.
00:06:14.160 --> 00:06:30.800
What's interesting is when you look at a risk surface of wearables and fitness gear, you'd always think about what operating system are they using, what hardware, firmware exists, and how do you essentially manage vulnerabilities, how do you manage connectivity to secure networks?
00:06:30.959 --> 00:06:43.279
And your worst nightmare would be somebody taking a USB, plugging it into your wearable or uh, you know, uh a treadmill or or a or a bike and essentially injecting malware.
00:06:43.600 --> 00:07:02.879
But what's fascinating is that is something that you would wish for in the age of AI, because now you have AI features that are actually collecting data, giving you feedback, your virtual coaches that can look at your gate and provide suggestions based on computer vision on how to correct it uh real time.
00:07:03.040 --> 00:07:17.040
Uh so I think as technology evolves through AI, I feel like the risk surface around variables, around treadmills, around fitness uh in general, and how performance data influences those decisions is an interesting evolution.
00:07:17.360 --> 00:07:30.079
One of the things I'm kind of curious about when you brought up these devices, do you know, because I know one of the things that I think is a recent requirement is that FDA is requiring that different medical devices be pen tested.
00:07:30.160 --> 00:07:37.759
Because you know, at one time people there, you know, back in probably about 2014 or so, someone figured out how to hack a pacemaker.
00:07:37.920 --> 00:07:51.519
I don't think it was a malicious actor, I think it was just a security researcher found that because you know, with innovations in technology, for many years people didn't think about security, they only thought about the functionality making a good product.
00:07:51.759 --> 00:07:56.800
And people that are creators, you know, they really didn't come from the area where they had to learn security.
00:07:56.959 --> 00:08:02.480
So it's interesting how like FDAs require medical devices to be secure, I mean, be uh assessed.
00:08:02.639 --> 00:08:06.560
What about different types of uh exercise equipment and wearables?
00:08:06.800 --> 00:08:10.800
Are those type of items do you know, or they go through any kind of security assessments?
00:08:11.120 --> 00:08:21.519
So there are electronic, it they come under electronic equipment and there are some guardrails around how those equipment can be resilient to cyber risks, especially in Europe.
00:08:21.600 --> 00:08:27.759
Uh, the US has its own version of hardware testing, but nowhere as thorough or systematic as for a medical device.
00:08:27.920 --> 00:08:36.559
You know, what's interesting is for viewers and listeners who uh who haven't come across Peloton, uh, Peloton pioneered the connected fitness experience.
00:08:36.720 --> 00:08:45.440
So think about a treadmill or a bike uh in the comfort of your home network, and all of a sudden you're opening it up for social interactivity.
00:08:45.600 --> 00:09:04.480
Essentially, it's streaming content, it's the social experience where you can connect and engage other participants, and that changed the paradigm of a static physical device in your home network to a hyper-connected, hyper-personalized experience that these modern devices are now capable of delivering.
00:09:04.799 --> 00:09:30.240
So I'm sure there's a due to that factor, there's a lot of concerns with privacy that you have to really make sure that everything's secure because that you mentioned the social aspect, now all of a sudden someone else is your home is not just the trainer, you're connecting with other people, and the way sometimes malicious actors act, they leverage things like social media to try to gain information on people, stalk them, and and other uh things worse.
00:09:30.639 --> 00:09:31.039
For sure.
00:09:31.200 --> 00:09:34.559
I think that the challenges exist, they just amplify.
00:09:34.720 --> 00:09:36.559
It's really around data provenance.
00:09:36.720 --> 00:09:45.200
You need to understand uh that there may be legal issues with the data that you are using to train those AI models and enhance your workout experience.
00:09:45.440 --> 00:10:02.720
So uh, you know, it's things like origin, things around traceability, lineage, things around identifying timestamps, and understanding how those LLMs have been customized to perform in a in an environment that essentially is processing performance data.
00:10:02.879 --> 00:10:15.919
And the second is around data quality, and and that's really interesting because at the end of the day, any type of a virtual coach is a predictive model and it has to learn on training data, and there are biases in data.
00:10:16.000 --> 00:10:33.679
Uh, you know, there are sampling techniques, and especially in the realm of synthetic data, uh, it's always interesting to have guardrails around uh, you know, how do you know that the model isn't biased and it's not influenced by a certain segment, especially in an environment, as you mentioned, is more social and more connected.
00:10:34.000 --> 00:10:47.440
Yeah, it's it's really interesting how how that's that's evolved, and and just seeing all the way that cybersecurity's evolved so much, just this week speaking to uh Daniel Meachum from Legendary Uh Media.
00:10:47.519 --> 00:10:58.159
They're a company that's a movie production company, and then talking to folks that from iHeartRadio, and you see all these different touch points and all these areas of security, they really wasn't there.
00:10:58.320 --> 00:11:08.399
You figure, like looking at the iHeartRadio example back when it's just broadcast radio, there wasn't all the privacy issues or security issues that have come about.
00:11:08.559 --> 00:11:13.600
The film industry used to traditional film, there wasn't much data security.
00:11:13.679 --> 00:11:17.120
That that's physical security that you lock up your films.
00:11:17.279 --> 00:11:27.519
But it's interesting, like in your industry that you have AI and the social piece, that at one time exercise equipment didn't have that functionality, that wasn't really an issue.
00:11:27.600 --> 00:11:29.200
You didn't have to worry about the security.
00:11:29.360 --> 00:11:31.919
So it's really interesting how that's all evolved.
00:11:32.000 --> 00:11:42.480
And and you just look at just the past 10 years alone, how you know smartphone functionality, wearable devices, AI, and high-speed internet has made all this stuff possible.
00:11:42.799 --> 00:11:43.120
Totally.
00:11:43.279 --> 00:12:02.879
And I think that fitness and well-being is a personal topic, especially in today's day and age, people are much more aware of their lifestyle, and um the role that connected fitness devices, wearables, the role that they play in influencing your mental health, behavioral health is immense.
00:12:03.039 --> 00:12:09.360
And I think that as the usage quadruples explodes, it is going to be an area of challenge.
00:12:09.519 --> 00:12:15.440
I think it's not just about AI to enhance your experience with the device, Philip.
00:12:15.519 --> 00:12:20.639
It's also about how value is being created on these devices through AI.
00:12:20.799 --> 00:12:32.879
So, for example, uh for dubbing, uh for voiceovers, for content, for translating that content into different languages, the use of AI agents, uh, for example, to uh to record stuff.
00:12:33.120 --> 00:12:35.759
I just think that the potential is endless.
00:12:35.919 --> 00:12:39.200
And I think that the risk surface definitely is a cause of concern.
00:12:39.440 --> 00:12:49.759
Yeah, I just have to say though, is for it comes to wearables and fitness and AI, all that I'm a big fan because one of the things I think about it is that it's bringing some of these features that are affordable.
00:12:49.840 --> 00:12:51.679
Not everyone can afford a personal trainer.
00:12:51.840 --> 00:13:01.440
You know, personal trainers, you know, in the States, you're spending it could be$50 an hour if you get a cheap trainer up to over$100 an hour, and not everyone can afford that.
00:13:01.600 --> 00:13:06.480
And sometimes people look at some of these devices, these bikes such as Peloton, and think it's expensive.
00:13:06.559 --> 00:13:09.759
But when you really look at the value of what you're getting, it's really a good value.
00:13:09.840 --> 00:13:20.240
It's not it's able to bring you something you may not be able to afford to go to a gym and pay for a personal trainer and to be able to have the accessibility to them anytime that you need is pretty valuable.
00:13:20.320 --> 00:13:24.559
And just the the way you can improve your health, all the metrics you get from some of these devices.
00:13:24.639 --> 00:13:25.759
I'm a fan myself.
00:13:26.000 --> 00:13:29.039
I have one of the rings that track your health.
00:13:29.120 --> 00:13:32.799
I've got a watch that tracks as well, and these metrics are very important.
00:13:32.879 --> 00:13:36.559
I find valuable because it helps me adjust when I travel.
00:13:36.799 --> 00:13:45.759
This ring lets me know, based on heart rate variability and body temperature, whether I'm starting to get sick, I need to sleep a little bit more and I'm able to adjust.
00:13:45.919 --> 00:13:58.159
So, you know, not even so much from a security aspect, these different devices are very, very helpful in people's health and and helps kind of push them to achieve their goals and stay on track.
00:13:58.480 --> 00:13:58.879
Absolutely.
00:13:58.960 --> 00:14:01.759
And and the regulatory issue with that is it's a gray area.
00:14:01.919 --> 00:14:10.799
Uh, you I think the argument is to be made if I had access to your pulse rate, your breathing rate, your heart rate, does it uniquely identify you with that data?
00:14:11.039 --> 00:14:20.639
And that's that's debatable, and that's why it's that gray area uh because traditional data is defined by social security numbers, your your birth dates, so on and so forth.
00:14:20.720 --> 00:14:22.320
Uh, and that that's what makes it unique.
00:14:22.480 --> 00:14:23.840
Philip, I had a question for you.
00:14:24.080 --> 00:14:28.879
You started your career in cybersecurity uh through pen testing.
00:14:29.039 --> 00:14:38.159
And when you look at uh the AI system, which is really an open-ended system in these days, how would you how would you structure your pen test strategy?
00:14:38.480 --> 00:14:38.720
Sure.
00:14:39.120 --> 00:14:54.960
One of the things you have to take in consideration is now you have AI added to the mix, so you need to make sure you're pen testing your AI solution that you're using, the different LLMs you're using, whether it's an open source public product or it's internal, you need to be testing those.
00:14:55.039 --> 00:14:59.519
But I think also people need to pen test the connection points.
00:14:59.600 --> 00:15:02.240
So maybe you've got a chat bot on your website.
00:15:02.480 --> 00:15:08.399
You need to think of that when you're doing the web application pen test, you need to also make sure that you're pen testing the AI as well.
00:15:08.639 --> 00:15:13.279
I think uh that's fascinating because it's really about multiple form factors.
00:15:13.360 --> 00:15:18.480
You have content, you have the operating system, the traditional systems-related vulnerabilities.
00:15:18.639 --> 00:15:22.559
Uh, you're you also have uh the network connectivity, the social aspect of it.
00:15:22.639 --> 00:15:28.080
So it's almost like uh you're pen testing uh, you know, I don't know, like uh like a phone or something like that.
00:15:28.320 --> 00:15:35.679
Yeah, it's interesting how that's evolved because when I first started pen testing was in 2012, and things have become so much more complex.
00:15:36.000 --> 00:15:38.639
IoT was just kind of getting started.
00:15:38.799 --> 00:15:41.279
Uh, you know, so a lot of people weren't pen testing that yet.
00:15:41.440 --> 00:15:47.120
One of the consulting companies I work for, they want to get us trained on IoT so we could test those those devices.
00:15:47.279 --> 00:16:00.480
But just looking at the whole, you even mentioned content, and that's one of the things that you have to you know protect your content because I'm sure you've got workouts and things that you don't want leaked that someone, a competitor could get and and take that information.
00:16:00.559 --> 00:16:13.120
So it's pretty interesting how that's all expanded into content, which content before was just files, it was data, it really wasn't unless you had some IVR system that you're recording phone calls or something like that.
00:16:13.360 --> 00:16:15.279
There really wasn't so much on the media side.
00:16:15.600 --> 00:16:16.000
For sure.
00:16:16.159 --> 00:16:23.279
And and Philip, I I'm not sure about you, but I'm getting ready for a world where virtual reality is a thing.
00:16:23.440 --> 00:16:28.320
Think about your VR glasses and you decide your fitness experience.
00:16:28.480 --> 00:16:30.320
Uh, that's the next form of being connected.
00:16:30.559 --> 00:16:39.519
Yeah, it's kind of interesting because you seeing some of the the video games out there, like the Wii used to have some of those, so it's really interesting to think of what's going to be possible.
00:16:39.679 --> 00:17:00.000
You know, you take a company like yours, it's experts and fitness to be able to come up with different devices to be able to enhance the experience because you know a lot of times people have bikes or treadmills, but if you bring in that VR experience, you're able to take that dull, boring uh walk or run on the treadmill, make it interesting, kind of create whatever reality you want.
00:17:00.080 --> 00:17:05.359
And that's kind of helpful because for me, uh cardio is not always the most fun part of a workout.
00:17:05.440 --> 00:17:13.279
I used to do cardio and I would do cardio for an hour, and I had to have a good television show on to keep my interest, otherwise I'd get bored and be done with it.
00:17:13.359 --> 00:17:15.759
But it's interesting that you bring up the VR.
00:17:15.839 --> 00:17:23.920
I could just imagine what possibilities it's gonna open up because you see some of the VR video games and stuff at the arcades along with the home VR setup.
00:17:24.079 --> 00:17:29.680
Yeah, I'm I'm I I I don't know about you, Philip, but I'm hooked on to uh the meta glasses, the Ray Band glasses.
00:17:29.759 --> 00:17:46.400
I think that's a fascinating form factor to really collect data uh as as it's seen real time and process that data uh to integrate with APIs from maps, from other functionalities, and create that real-time image for the user to make educated decisions.
00:17:46.559 --> 00:17:57.519
I mean, that that is really uh, again, a great example of multiple modalities, content, the social aspect, data coming together in the form of a system to deliver that experience.
00:17:57.759 --> 00:17:58.799
Yeah, those are very impressive.
00:17:58.880 --> 00:18:07.359
And one of the things I was thinking about recently with the like the meta classes, wouldn't it be cool if they had a feature that would you could plug into to like LinkedIn?
00:18:07.680 --> 00:18:13.200
So if you're out at a conference and you're meeting a customer or you see someone, you're able to recognize them.
00:18:13.279 --> 00:18:14.480
Maybe you go to a lot of conferences.
00:18:14.559 --> 00:18:16.559
I run into this a lot, uh, even before recording.
00:18:17.039 --> 00:18:18.160
That's your next startup idea.
00:18:18.319 --> 00:18:21.440
Yeah, so that you can integrate that with uh with the CRM.
00:18:21.599 --> 00:18:37.920
You got in the LinkedIn, so you can take the profile pictures and and be able to let the salesperson or whoever has those glasses built identify people and you know different things about them because traditionally salespeople had to remember, you know, their wife, kids, birth dates, anniversaries, and all that stuff.
00:18:38.000 --> 00:18:42.559
So if you had this accessible through uh VR, I love that, Philip.
00:18:42.640 --> 00:18:53.440
Essentially, use the sensor as a means to collect data and then agents, autonomous agents in the background, process that data, make integrations, and curate what the experience that you need.
00:18:53.599 --> 00:18:54.400
Uh, I love it.
00:18:54.720 --> 00:19:04.000
And and one of the things I think is a good a big help too is you take someone that was, say, you know, as people get older, they start getting memory issues, and you're able to help them remember.
00:19:04.319 --> 00:19:16.160
Yeah, I just want to segue to what you mentioned, which is uh, you know, we we keep talking about risk, but it's also important to understand the impact uh this evolving technology has on human life.
00:19:16.319 --> 00:19:22.319
Uh it's not just about looking good and feeling good or uh you know feeling great mentally.
00:19:22.640 --> 00:19:34.400
Uh we do have uh our society does have people uh who who have handicaps, uh people who are constrained to their beds, uh people who have limited mobility.
00:19:34.640 --> 00:19:44.799
And I think that variable tech, especially in the health sector, uh I was just listening to a talk where uh they were able to create this device, Philip.
00:19:44.880 --> 00:19:49.359
It essentially it was a glass that would uh wrap around the person's eyes.
00:19:49.519 --> 00:19:54.160
The person was completely paralyzed, all they could do was move their uh you know their eyelids.
00:19:54.799 --> 00:20:05.119
And um, you know, based on the flutter of their eyelid uh and their retina, the glass would automatically uh translate that in into instructions and make things happen.
00:20:05.279 --> 00:20:08.400
So for the first time in their life, that person could actually paint.
00:20:08.720 --> 00:20:10.559
That was profound for me.
00:20:10.640 --> 00:20:18.319
Uh, and that actually makes it worth to solve the risk and the cybersecurity problems associated with this evolving uh domain.
00:20:18.480 --> 00:20:20.400
Uh, because at the end of the day, you are helping people.
00:20:20.640 --> 00:20:30.799
Yeah, and and on that same note, it was kind of interesting, like the Neuralink and some of those other devices that are coming out the brain transplants or implants that you're able to think and and do commands.
00:20:30.880 --> 00:20:40.400
So it's pretty amazing, you know, it'd be venture to guess for the next 10 or 20 years, a lot of these disabilities will be overcome by technology.
00:20:40.799 --> 00:20:46.880
And you know, uh you have to you have to bring up quantum computing uh when you talk about Neuralink.
00:20:47.039 --> 00:20:58.799
Essentially it's about faster processing, autonomous processing, and the ability to connect connect ideas and thoughts uh faster than the human brain.
00:20:58.880 --> 00:21:05.119
Uh, and I think that's going to be an era that that really uh you know hopefully we see it in our in our lifetime.
00:21:05.440 --> 00:21:19.599
Yeah, it's pretty pretty amazing the things they come up with, and you see some of these devices that are like an exoskeleton that can help someone walk, you know, using you know merging robotics, AI, and these different technologies to help give someone the ability to walk, it's pretty amazing.
00:21:19.920 --> 00:21:23.920
So when you think about security, we always try to ground security in in reality.
00:21:24.079 --> 00:21:38.960
So, for example, um, you know, when you talk about performance data, it is data, it is really the uh the whole process of cleansing that data and readying it for models that can extract value from that data and and create that customer experience.
00:21:39.200 --> 00:21:59.839
When you think about traditional threat vectors, do you ever wonder if the way vulnerabilities were exploited, which is through malware injection, through an operating system that wasn't upgraded, um, do you do you wonder if there are new avenues of threats uh that that people need to not think about, especially especially as cyber.
00:22:00.240 --> 00:22:01.200
Security professionals.
00:22:01.519 --> 00:22:07.759
Yeah, I think one of the best things I think to stay ahead of that is to keep up with the latest trends like AI and stuff.
00:22:07.839 --> 00:22:12.000
Because one of the things I kind of noticed back with cloud, some people were kind of slow to adopt.
00:22:12.079 --> 00:22:34.400
I think staying uh up to date with that stuff, uh going to conferences like this, doing research, I mean, have a research team, uh, security researchers, because sometimes the pen test team may be tied up doing pen test assessments, but if you allow them to have some research time or even have a dedicated research team that they can actually be proactive, more proactive in the security area.
00:22:34.640 --> 00:22:36.079
I think that that's a great observation.
00:22:36.319 --> 00:22:40.880
So, what what has been uh some of your favorite presentations that you've seen while you've been here?
00:22:41.039 --> 00:22:47.599
Oh, I saw a presentation by Rick Beige who's essentially talking about the state of security as seen through the lens of the CIA.
00:22:47.680 --> 00:22:50.720
Uh, and I'm sure you've been through some of those presentations.
00:22:50.880 --> 00:23:03.119
Uh, I think when people who are government insiders start talking about how they view security, it all of a sudden crystallizes your view on risk uh through a different lens.
00:23:03.200 --> 00:23:04.480
Uh, and that was fascinating.
00:23:04.640 --> 00:23:19.039
Essentially, they're talking about quantum computing, uh, nation-state actors, uh, the prevalence of drones in frontline battlefields, and how uh they're thinking about hardening it through uh traditional cybersecurity measures.
00:23:19.119 --> 00:23:20.400
I think that was a fascinating topic.
00:23:20.720 --> 00:23:41.039
Yeah, that's that's very interesting, and it's always good when someone like that one of those agencies shares some of their insights because you know, people working in corporate America, some of the things we don't see doesn't mean that we're not gonna see it because nation states are coming after our infrastructure, trying to get our data, and so that's becoming more and more of a threat.
00:23:41.200 --> 00:23:48.720
And actually, one of the speakers here is Born Watna, and Bjorn works for Interpol, so he's gonna be one of the guests on this podcast.
00:23:48.799 --> 00:24:05.839
So it'd be interesting to see what he's seen from that side, because like you mentioned, like CIA, but it's kind of interesting to take some of it, he has an interesting career path because he was in corporate America doing cybersecurity and to go into like law and for international law enforcement is kind of interesting because people usually do it the other way.
00:24:05.920 --> 00:24:19.599
Because then, like in the US, you'll see people that get out of the military, they'll spend X amount of years in the FBI, and then from that experience they're able to go somewhere else and do really well and lead and kind of give some insight that typical cybersecurity folks may not have.
00:24:19.839 --> 00:24:20.799
You have a pack schedule.
00:24:21.039 --> 00:24:23.200
It looks like the theme of the season is AI.
00:24:23.279 --> 00:24:29.519
Uh, is there any topic that you think um, you know, um that that you're particularly uh keen on digging in?
00:24:29.759 --> 00:24:38.880
Yeah, some of the things that interest me most is you know, there's products out there that use AI, uh, but what I'm really probably most interested in is people learning how to scale what they're doing.
00:24:39.039 --> 00:24:48.319
Maybe there's not a product out there to do what they're doing, or some there's a need, or someone's gonna pull out money into doing just minor pieces of what they do, but learning to automate.
00:24:48.480 --> 00:25:00.960
Because I've uh have a friend, Jeff Foley, that created the AWASP AMASS project, which is a an open source external attack surface management and reconnaissance tool, a free tool.
00:25:01.119 --> 00:25:08.400
But how he came about doing that as a network administrator, he would create scripts and stuff to automate what he's doing.
00:25:08.559 --> 00:25:16.559
So I think with using AI, people leveraging learning how to automate what they're doing, because so many people are worried about losing their jobs to AI.
00:25:16.720 --> 00:25:23.440
But if you're able to scale and do more, I think you're gonna make yourself a little more resistant to to uh job reduction.
00:25:23.680 --> 00:25:24.319
That's great insight.
00:25:24.400 --> 00:25:33.039
And I know we're running out of time, but I think you know, the one thing that I do want to mention uh to segue off of your statement is it's also the supply chain.
00:25:33.119 --> 00:25:41.119
You know, when you talk about you know network surveillance, uh look at all the infrastructure that's needed to keep this connected fitnesses, uh, fitness equipment going.
00:25:41.200 --> 00:25:49.680
It's the CDN, it's your network underlay, all these vendors and all their systems that are powering this experience for the consumer.
00:25:49.920 --> 00:26:03.440
What's always fascinating to me is also the basic uh prescription models, uh, the recommender models, all of them working in the back end uh to really create that experience for uh a health conscious consumer.
00:26:03.599 --> 00:26:09.200
Uh, but what's the the point I wanted to make is there's also specialized architecture now.
00:26:09.440 --> 00:26:31.680
You have uh TPUs and GPUs drawing a lot of power, you have memory that's really sophisticated to ensure that the GPUs aren't starved of data, and then LLMs are spread across multiple microprocessors and the fabric that connects it uh that has to be reliable and has to be uh low latency driven to create that experience.
00:26:31.920 --> 00:26:48.319
Uh, the point I'm trying to make is uh as we think about organizations and domains that are being disrupted by AI, uh I feel that the underlying architecture and the technology that's powering these experiences is also going through a tectonic change.
00:26:48.400 --> 00:26:52.000
And that's uh that's another uh that's probably a topic for another day.
00:26:52.319 --> 00:27:00.799
Yeah, especially since you mentioned that, some of the outages with CDNs and different cloud providers and stuff, that's a big thing to take in consideration.
00:27:00.880 --> 00:27:21.920
So it's amazing why we really need to look at these products we're using, and it's good that these companies are learning from their mistakes because you know, before being without internet, you know, wasn't a life or death, and now we've we're so reliant on connectivity, the CDNs and uh cloud computing, network connectivity, all that.
00:27:22.000 --> 00:27:31.039
So I think it was what the AWS breach that the AWS not breach, the AWS outage that literally uh handicapped all the major companies.
00:27:31.359 --> 00:27:34.880
Yeah, back to the CIA triad, the availability piece.
00:27:34.960 --> 00:27:38.160
Sometimes we forget about that until we're affected by it.
00:27:38.400 --> 00:27:38.880
Love it.
00:27:39.039 --> 00:27:40.240
So that that's a wrap.
00:27:40.319 --> 00:27:42.559
A big thank you to our guest, Shri Manda.
00:27:42.799 --> 00:27:45.359
Let's close this file until the next chapter.
00:27:45.440 --> 00:27:47.680
This is Philip Wiley signing off.
