The CISO Field Guide: Becoming Operator, Strategist, Storyteller with Mark Lynd bölümünün tam dökümü

customers, it's a great way to get in there thinking about this co-pilot layer to make your people more effective, more efficient, um, and start to augment them because that's really what we're talking about, right? 00:02:37.840 --> 00:02:44.960 It's kind of the it's kind of the uh the piece you see with Jensen, uh the CEO for um uh NVIDIA. 00:02:45.280 --> 00:02:50.400 He says, you're not gonna be replaced by AI, you're gonna be replaced by somebody who's really good at AI. 00:02:50.719 --> 00:02:59.280 Um, so so you know, you think about that from a copilot layer, you can make your employees better at what they're doing, make them more effective, more efficient. 00:02:59.360 --> 00:03:04.719 And that's a good, solid early wins, doesn't require huge investments and all that. 00:03:04.879 --> 00:03:10.240 And then, you know, one of the things also is you've got to think about putting in a framework, right? 00:03:10.400 --> 00:03:11.919 How are we gonna do this? 00:03:12.000 --> 00:03:15.360 Um, so we can make better decisions, better buying decisions, right? 00:03:15.439 --> 00:03:19.199 But this isn't about better controls like a lot of the previous products are. 00:03:19.280 --> 00:03:27.520 This is about better decisions because this augments and enhances your decision for your employees, for you, for you know, your peers, et cetera. 00:03:27.680 --> 00:03:29.759 And it has great benefit to your customers. 00:03:29.919 --> 00:03:36.560 So maybe an example, Joe, of that would be is uh hypothesis-driven threat hunting. 00:03:36.719 --> 00:03:41.680 So in the past, threat hunting, you had to dig through the details, right? 00:03:41.840 --> 00:03:46.479 And they you may have a product that bubbles it up, uh, a couple. 00:03:46.639 --> 00:03:51.120 Maybe they look at a hundred thousand and they bubble up 10 or 15 for you to look at. 00:03:51.360 --> 00:03:56.639 But wouldn't it where we're going to is you'll be able to ask questions. 00:03:56.879 --> 00:04:00.719 Which one is the most you know, problematic for us? 00:04:01.039 --> 00:04:11.120 Which one uh might skirt around our security controls, um, things like that, and then let it automaterialize using these queries and levers. 00:04:11.520 --> 00:04:14.800 So you move from alert chasing to question asking. 00:04:14.960 --> 00:04:22.160 And I I and we talk about this with our customers all the time because we sell a lot of security and do a lot of security uh for a lot of customers. 00:04:22.399 --> 00:04:42.319 So if you truly believe, uh and I do, um, that LLMs and you know, generative AI and this predictive part of the AI is that piece, then that move from alert chasing to question asking is a really wonderful example on how this uh can really benefit, right? 00:04:42.399 --> 00:04:45.759 Because if you're more secure, that means your customers' data is more secure. 00:04:45.920 --> 00:04:51.439 If your people are able to work on other projects because you made them more efficient and effective, you know, you're getting that. 00:04:51.680 --> 00:04:53.439 So those are some really good ones. 00:04:53.600 --> 00:05:04.000 And you also then the last element of that um is measure time to decision, not tool count, which directly goes against what you asked me, right? 00:05:04.160 --> 00:05:08.800 Before it was like, well, you know, nobody ever got fired for buying Cisco, right? 00:05:09.040 --> 00:05:15.199 Or, you know, we have 17 security products and da-da-da-da, and five integrations, etc. 00:05:15.519 --> 00:05:18.000 No, measure time to decision, right? 00:05:18.240 --> 00:05:30.959 Because a lot of times going and having to look at six or seven consoles, trying to figure out where what information is where, and then trying to make those align with each other so that you can make a good informed decision. 00:05:31.040 --> 00:05:32.160 It's so difficult. 00:05:32.399 --> 00:05:45.040 But with LLMs, you can look at a wide variety of data sets in a data lake or even even outside of that by loading it or using and using uh you know a rag, you can do that. 00:05:45.199 --> 00:05:52.399 Um, and so now you can measure your time to decision, not how many tools I had to go to to collect all this information and get all this. 00:05:52.720 --> 00:06:01.600 Even though there is a verification element of that that some may appreciate, if you do it right in the LM, you can get that as well. 00:06:02.000 --> 00:06:04.720 I love that answer because it was so layered. 00:06:04.800 --> 00:06:15.439 And one of the things I heard you say is you know, we need to teach our newer security folks to ask better questions. 00:06:16.319 --> 00:06:27.920 Yeah, we have to teach them to ask better questions because we're gonna, you know, somebody, some CISO somewhere is buying some fancy tool and it expects you to ask it questions. 00:06:28.399 --> 00:06:29.199 Well, it's funny. 00:06:29.279 --> 00:06:31.920 The um uh I do an AI tabletop, right? 00:06:32.000 --> 00:06:34.480 And we do that for the the C-suite. 00:06:34.879 --> 00:06:39.120 Um, you have to put it in very uh measurable or simple terms, right? 00:06:39.199 --> 00:06:44.319 Um, so I say stop buying blinky boxes, start buying better questions. 00:06:44.560 --> 00:06:49.680 And that is an actual sound bite from our quote from from the AI tabletop. 00:06:50.160 --> 00:06:51.199 That's so good. 00:06:51.439 --> 00:06:53.279 That is that is so good, right? 00:06:53.360 --> 00:06:56.720 Is and I, you know, but it's a different way of thinking. 00:06:58.319 --> 00:07:07.360 It is like part of the different way of thinking is you know, you're an ex-military guy, cybersecurity is very rule-bound, right? 00:07:07.839 --> 00:07:09.600 If this, then that, right? 00:07:10.079 --> 00:07:11.839 AI doesn't behave that way. 00:07:12.399 --> 00:07:12.959 No, it doesn't. 00:07:13.199 --> 00:07:19.600 So it's a different way to look at, you know, um he's rolling crazy ball in some instances, right? 00:07:19.680

--> 00:07:24.639 And you have to think differently to lock down those attack vectors. 00:07:25.199 --> 00:07:29.439 Um so you know, to that point, you think about this. 00:07:29.839 --> 00:07:36.879 One of the ways to augment that and to do that and think that different way is like if you're thinking about purple teams, right? 00:07:37.040 --> 00:07:41.839 Yeah, so purple team loops, how about AI AI augmented purple team loops? 00:07:42.000 --> 00:07:46.879 So if you use LLM agents and agent, genic AI is the big rage right now, right? 00:07:47.040 --> 00:07:56.959 But if you're able to do that, to script you know, adversary behaviors like phishing lures, uh prompt injection strings, you know, data poisoning, et cetera, et cetera. 00:07:57.120 --> 00:08:01.439 So that every every exercise hardens both systems and staff, right? 00:08:01.519 --> 00:08:08.879 And then maybe you I don't know, maybe you anchor that to uh MITRE Atlas tactics to model how attackers target AI. 00:08:09.040 --> 00:08:21.040 That's a that's a really great way, you know, how you and I are talking about using questions and and using it in a different taking a different approach to an age-old problem. 00:08:22.720 --> 00:08:26.160 Um are you listening, venture capital people? 00:08:26.240 --> 00:08:29.759 You need to call this man because he's got a great idea here. 00:08:30.000 --> 00:08:31.519 Just call him. 00:08:33.120 --> 00:08:34.879 Remember, purple team loose. 00:08:36.559 --> 00:08:37.200 I love it. 00:08:37.279 --> 00:08:42.320 That it's such a good idea though, because you're using AI to outsmart itself. 00:08:42.639 --> 00:08:46.559 Yeah, I mean, you think about it, you and I both spend a lot of time with customers. 00:08:46.720 --> 00:08:52.080 And one of the ones that we always hear is we need to do more with less, right? 00:08:52.879 --> 00:08:58.320 I may not have the exact budget, I may not have the headcount, I may not be able to get great people, enough of them, right? 00:08:58.559 --> 00:09:03.039 And and you're always in this struggle where you're trying to make get get one or the other. 00:09:03.360 --> 00:09:10.159 So a way to do that is to truly take what the LLM provides you, this augmentation, right? 00:09:10.480 --> 00:09:13.440 And then, you know, apply it to given problems. 00:09:13.519 --> 00:09:16.080 And that purple team loop, I've heard that issue. 00:09:16.159 --> 00:09:19.039 They didn't call it a loop, but I've heard it sounds like a circle to me. 00:09:19.200 --> 00:09:20.399 I hear it all the time. 00:09:20.559 --> 00:09:36.399 When you get down there with engineers, with their leadership, and you start to talk about maybe it's an instant response tabletop, maybe you're talking about um, you know, purchasing a new product or tool or whatever it may be, and these questions come up. 00:09:36.639 --> 00:09:39.440 And I've heard the purple team one a bunch of times. 00:09:39.600 --> 00:09:41.440 I've still not seen anybody solve it. 00:09:42.000 --> 00:09:42.799 That's a great one. 00:09:42.960 --> 00:09:43.759 It really is. 00:09:44.000 --> 00:09:56.320 And speaking about, you know, sort of balancing things, how can organizations embed security and privacy controls into AI model development without slowing down innovation? 00:09:57.840 --> 00:10:04.559 Yeah, you know, um, I love this one too, because I have to kind of take a weird angle on this one. 00:10:04.799 --> 00:10:14.639 I always think, you know, having been the CIO and CISO several times, and you know, it was me on the line and my my team. 00:10:15.519 --> 00:10:19.519 I like to give teams a fast paved road with guardrails. 00:10:19.919 --> 00:10:21.200 That's my angle, right? 00:10:21.279 --> 00:10:24.960 And what I mean by that is, you know, governance that ships. 00:10:25.120 --> 00:10:28.960 Maybe it's so so don't go out and try to create some governance on your own. 00:10:29.120 --> 00:10:30.559 There's so much out there, right? 00:10:30.639 --> 00:10:37.519 You got uh NIST, um, you have ISO, uh, Microsoft has their own, Google has their own. 00:10:37.600 --> 00:10:38.879 I mean, just go down the list. 00:10:38.960 --> 00:10:41.919 I think there's 11 or 12 the last time I heard. 00:10:42.159 --> 00:10:43.039 Wow, okay. 00:10:43.279 --> 00:10:43.840 Yeah. 00:10:44.000 --> 00:10:54.720 Um, and you know, if you're if you're just purely Microsoft, and there's a lot of shops out there that do a lot of Microsoft or lean heavy on Microsoft, and maybe you want to get the early wins with O365 and their co-pilot. 00:10:54.879 --> 00:10:57.360 That's a reasonable strategy, right? 00:10:57.600 --> 00:11:05.039 Um, then you may want to adopt theirs and then maybe uh, you know, position yourself towards NIST further down the path, right? 00:11:05.120 --> 00:11:11.360 As you start to expand and broaden your horizons around um, you know, generative AI, et cetera. 00:11:11.519 --> 00:11:15.759 And then, you know, security by default, it'd be we're back to that. 00:11:16.080 --> 00:11:19.600 Security baked in is always better than bolted on. 00:11:19.759 --> 00:11:21.840 And we've been saying that for years, right? 00:11:22.000 --> 00:11:27.120 Well, security by default, to may think of it as a golden path with this LLM, right? 00:11:27.279 --> 00:11:29.039 You need to look at the model. 00:11:29.360 --> 00:11:32.720 Um, you need to understand the data sets, the data lake. 00:11:32.799 --> 00:11:37.279 Uh, you and I have talked about DLP in the past, uh, injections. 00:11:37.440 --> 00:11:39.519 You know, there's a lot of pieces to this. 00:11:39.600 --> 00:11:44.240 It isn't just simply, and that's why people are so fearful of shadow AI. 00:11:44.399 --> 00:11:53.279 It's not just simple bring something up and start loading PDFs and asking questions and giving access to data that may or may not be sensitive. 00:11:53.360 --> 00:11:55.440 It there, there's a lot of effort to that. 00:11:55.600 --> 00:11:59.519 So, you know, in

my mind, it's gonna have to be done early. 00:11:59.679 --> 00:12:08.240 You're gonna have to have a good AI strategy, you're gonna have to ensure that you're it's based on some kind of governance and model that pre-exists. 00:12:08.320 --> 00:12:09.360 Don't try to build your own. 00:12:09.440 --> 00:12:19.519 I've seen too many customers go down that that that lane and it it just it's fraught with with uh you know all kinds of potholes and and and damaging issues. 00:12:19.600 --> 00:12:34.000 And you know, do that, and then last but not least, make sure that for your environment, when you give it access to your information, your data, and that you let your the employees know and share with them, right? 00:12:34.080 --> 00:12:43.279 But bring them along for the ride that you know, sensitive information going in there will be trained on and will become public information more than likely. 00:12:43.600 --> 00:12:44.000 Right. 00:12:44.159 --> 00:12:53.679 And and we all have heard the horror stories about people not locking stuff down and the crowd jewels getting into the public domain, and it's sad. 00:12:54.159 --> 00:13:07.440 Um, so last question how should the CISO be thinking about AI adoption in terms of its use to both secure emerging threats and then from an organizational governance perspective? 00:13:07.919 --> 00:13:15.600 Yeah, um, this is one that I, you know, I I think about this in kind of a uh an interesting way. 00:13:15.919 --> 00:13:20.639 It's really, I gotta give all the credit to the customer, and it's a variation of what we just talked about. 00:13:20.720 --> 00:13:24.639 It's move fast on a paved, well-lit road, right? 00:13:24.799 --> 00:13:40.240 Uh, if you're if you're gonna look at some kind of um analogy to think about this, is don't go off on your own trying to figure this out, you know, to really think about what you're trying to do, bring others in. 00:13:40.320 --> 00:13:44.879 You might want to bring third parties in that have done this for others to help them with that. 00:13:45.039 --> 00:13:53.679 And you and some of the things you can think about, you know, from a CISO perspective, uh, stock augmentation, that's a big win, a really big win, right? 00:13:53.759 --> 00:14:02.000 Use LLMs to summarize alerts, uh, enrich your ICOs, generate IR drafts, uh, you know, but keep the human in the loop. 00:14:02.080 --> 00:14:02.960 That's the big thing now. 00:14:03.279 --> 00:14:09.840 You're we're hearing that from a lot of uh big, even the even the AI manufacturers themselves are saying keep the human in the loop. 00:14:10.000 --> 00:14:11.679 We're hearing that over and over and over again. 00:14:11.840 --> 00:14:14.639 And then, you know, another good one is AI threat modeling. 00:14:14.720 --> 00:14:23.440 Um, we kind of touched on that, you know, it kind of aligns with with MITRE Atlas, with NIST AI 100-2, um, some of those. 00:14:23.600 --> 00:14:30.720 Um, and then uh as we move into the future, think about it as deep fakes and fraud uh resilience, right? 00:14:30.799 --> 00:14:31.840 Is eat resilience. 00:14:31.919 --> 00:14:37.279 You've got to create a way to battle what AI is gonna be bringing at you. 00:14:37.440 --> 00:14:50.159 Um, I've I don't know what you're hearing from your customers, but I'm hearing a lot of fear um in certain customers about because they're starting to see this these AI-driven and powered attacks uh happen. 00:14:50.320 --> 00:14:59.840 And they don't have the personnel, they don't have the cadence, um, and they don't have the determination and capabilities to offset that right now. 00:15:00.080 --> 00:15:08.320 So they're they're leaning on some of their manufacturers, they're leaning on their partners, and and uh it's really, you know, you're gonna have to make investments. 00:15:08.399 --> 00:15:24.399 You're gonna have to invest in your team, you're gonna have to invest in your organization, you're gonna have to invest in yourself, and you've really got to come up with kind of this um a way to treat AI as both a control surface and a risk surface, right? 00:15:25.279 --> 00:15:25.440 Good. 00:15:25.519 --> 00:15:29.919 I love that way of thinking, control service and a risk service because it is. 00:15:30.320 --> 00:15:30.879 It is. 00:15:31.360 --> 00:15:40.559 It is the only difference, the only difference is the blast radius could be infinitely larger, nuclear, potentially. 00:15:40.639 --> 00:15:48.559 I mean, it is uh it's like you know, um uh in my new book that I have, I I that's what I covered. 00:15:48.639 --> 00:15:55.039 It's I I use they it's AI, it's AI-powered cyber threats, and that's that's what people truly fear. 00:15:55.200 --> 00:16:00.240 And there's a reason to fear it, um, but it's not, you know, it's not uncapped. 00:16:00.559 --> 00:16:02.639 It's just you're gonna have to make those investments. 00:16:02.799 --> 00:16:12.799 You're gonna have to learn how to augment yourself, your team, your organization with AI, um, and use it to manage both that control surface and that risk surface. 00:16:13.200 --> 00:16:13.600 Love that. 00:16:13.759 --> 00:16:16.879 And what is the name of your new book and where can people find it? 00:16:17.120 --> 00:16:17.759 Oh, I'm sorry. 00:16:17.840 --> 00:16:23.200 Yeah, uh, it's it's called Cyber, it's called Cyber War, um, one scenario. 00:16:23.440 --> 00:16:31.759 And it's kind of a mix of uh Annie Jacobson, uh, who's a very famous author who I love, uh, who did Nuclear War and Area 51. 00:16:31.840 --> 00:16:38.480 Um, and she does narrative uh nonfiction and fiction um in the form of Tom Clancy. 00:16:38.639 --> 00:16:59.440 So if you if you smash those two together, and some of the early reviews have even commented on that, um uh it's a narrative fiction and it's about a um cyber attack that's AI powered, um, that leads towards uh uh impacting our critical infrastructure both here and abroad, and then turns and uh starts hitting everybody. 00:16:59.519 --> 00:17:03.440 And uh they soon they have to join together to uh do that. 00:17:03.600 --> 00:17:07.359 And um it's uh it was fun writing it. 00:17:07.440 --> 00:17:08.720 Um it's a long read. 00:17:08.799 --> 00:17:15.599 Uh fairly it's like 307 pages, but a lot of research went into it um and a lot of good customer information went into it. 00:17:15.920 --> 00:17:16.960 Wow, that sounds cool. 00:17:17.039 --> 00:17:18.319 I'm gonna need to check that out. 00:17:18.400 --> 00:17:24.960 So you'll have to send me the link so I can add it in the podcast notes when we send uh when we post the podcast. 00:17:25.119 --> 00:17:30.319 Yeah, it's on Amazon, Barnes and Noble, uh Kodo, uh Apple Books. 00:17:30.400 --> 00:17:33.119 Uh I think it's on like 93 platforms. 00:17:33.519 --> 00:17:34.240 93. 00:17:34.640 --> 00:17:37.759 Yeah, there's believe it or not, there's over 300 platforms. 00:17:40.559 --> 00:17:42.079 There's so many things I don't know. 00:17:42.160 --> 00:17:43.279 Just so many. 00:17:43.519 --> 00:17:45.279 Um, it's just a lot. 00:17:45.519 --> 00:17:47.599 Well, it was a pleasure seeing your face. 00:17:47.759 --> 00:17:49.599 It was a pleasure hearing your thoughts. 00:17:49.759 --> 00:17:52.559 Thank you so much for making time out of your day to visit. 00:17:52.640 --> 00:17:54.400 And thank you guys all for joining. 00:17:54.480 --> 00:17:55.839 And we'll see you next time. 00:17:56.079 --> 00:17:57.039 Thank you, Jeff.