SANS Brings AI Into Cybersecurity Training

Hey, everyone. Welcome to Techstrong TV. We're recording today's episode on Friday, but by the time you see it, my next guest and I will both be out in Vegas for Hacker Summer Camp, as we call it.

We've got Black Hat, there's Security B-Sides, there's DEF CON, of course. And it's a great place if you don't mind 115-degree heat. It's a great place to go meet all your friends in cyber.

Speaking of friends in cyber, let me introduce you to Ed Skoudis. Ed is the president of the SANS Institute. Is it the SANS Institute or just SANS Institute, Ed?

So, it's the SANS Technology Institute that I'm the president of. So- Got it Yes. There you go.

Yeah. The SANS Technology Institute. Look, everyone I know just calls it SANS, so- Right.

We'll go with SANS. Hey, Ed, welcome. It's been way too long since you've been on Techstrong TV.

I'm so happy to have you back here. I'm delighted to talk with you again, Alan. It has been too long.

Let's do it more often, okay? Look, I'm here every day. Just tell me when you're coming okay?

All right. Awesome. Ed, we were talking off-camera about old friends.

We mentioned Steven Northcutt, and of course, Alan Paller. When you think of SANS, you think of Alan. But you've been president now for a while.

SANS has been growing and changing and evolving- Yeah ... these crazy times we live in. Give people a sense of what SANS is today.

So, SANS has been around for over 30-plus years. In fact, I think we're at 36 or 37 years now, but it's changed so much. I've been with SANS 27 years, and SANS primarily is a training organization.

But our training is being revamped with all the AI. We're introducing AI into our classes because that's how the job is being done these days, right? So, classes on penetration testing or incident handling or digital forensics or even cyber leadership, those classes have been infused with leveraging AI for the job.

And then also we have AI-centric classes, classes that are about securing AI and such. And then, of course, we have our certifications in the GIAC business that are tied into that. We have the SANS College, that grants master's degrees and bachelor's degrees and also certificates.

So SANS is on the move. You might know James Line. He was promoted to our CEO three months ago.

Really? So we're very excited about it. It's the first technical CEO that SANS has had since Steven Northcutt served that role.

So I'm super excited. Just had a wonderful conversation with James this morning. He has reinvigorated certainly me and all of SANS to go out and do great work, embrace the community.

And I think a lot of your viewers know who James Line is and how wonderful news this is for his promotion. That is. That's good to hear, man.

Yeah. I'll be really honest with you, Ed. I think of SANS, I don't think of my time, and I'm doing Techstrong now since 2014, so 12 going on 13 years.

I don't think of it. I think of SANS from my Still Secure days- Mm ... when SANS was our primary partner, our primary go-to where the people found out about us.

And I went to all of the in-person events, and we used to blow up those big bouncy balls that people could sit on instead of chairs. Yeah. We were the company with the big balls in the classroom and- Yeah ...

just the people I met, the times I had, the things I learned, and it was such a great time in security back then because security was becoming a thing, right? Yeah. We didn't call it cyber necessarily then, but it was coming into its own.

Now, as you say, it's changed a lot. The whole world's changed. AI, everything that goes with it.

Whether you're a pro-AI, anti-AI, neutral AI, nevertheless, it's an agent of change. That's right. And, of course, why wouldn't it change SANS, and how SANS is teaching and how SANS is operating?

That's right. But you know, Ed, I mentioned you're going to be out in Vegas. I'm going to be out in Vegas.

One of the stories there is that we get so focused on the technology, so focused on what AI can do, can't do, shouldn't do, should do, what it's escaping, who it's attacking- Yeah ... and every day is a new story now. We sometimes forget the human element of not just security, but the human element of life, the human element of business, why we do all this stuff, right?

Mm-hmm. Yep. And I know you're a big advocate of human dignity and these kinds of things.

Yes. Talk to me, and look, this is not a negative knock on AI, but talk to me about how we need to balance these things- Yeah ... and not lose our dignity.

That is so important. I've been thinking about it a lot for the last couple of years. SANS just released about three months ago, a workforce report.

" And it's a survey of hundreds of organizations and how AI is changing their own workflows, changing the team composition, and so forth. And while all this is underway, and it's documented in that workforce report that's freely available from SANS, people can go and just download it- I have really been emphasizing in my talks, my interaction with people, this concept of human dignity and maintaining and uplifting human dignity in an age of pervasive AI. And I feel super passionately about this.

I think there's things that leaders need to do, there's things that practitioners need to do to not lose sight of our common humanity. And look, there's people, sometimes I even see them, they almost get into despair over this. " And I say, "It's going to be all right.

It's going to be all right. " When I talk to some of the people on my pen test team, I've got a team that does pen tests, I showed one guy on my team, he's maybe our age, let's say, and we showed him some of the AI stuff that we're doing to help with pen tests. " He said, "It's amazing, but why couldn't this happen seven years later?

I've got a perfectly good pen test career going here. " I have another guy on my team. He's young, he's 32.

I consider 32 young. " He's like, "This is awesome. " So these are opposite ends of the spectrum, but both high anxiety over the changes here and such.

I have promised my team, look, I think we have to leverage AI in what we do. It's just the way business is done these days. But I am not trying to push out the humanity.

I want to uplift the humanity, and I'm not trying to create a pen test in a box. There's other people that are doing that. No, I think the best penetration tests are done by humans working with AI, back and forth, each playing to their own strengths.

And I try to maintain my own human touch. I did a presentation for a bank a couple of weeks ago. They had 800 people at the talk, but it was about this human dignity thing.

And I say, "Look, write a letter to somebody once a week the old-fashioned way. You could type it in an email and send it via email, but type it in. Don't have the AI do it.

At least one a week. That's all I'm asking. Look, ideally more.

Write a card for somebody, for people that you really love. Every once in a while, buy somebody flowers. Don't make it weird or creepy, but significant other, something like that, buy them flowers.

" And I'm all for leveraging automation and AI to make things more efficient. But when you do so, grow your business as opposed to becoming more efficient so you can lay people off, because that's just not a winning strategy. Yeah, but I think that's a shortsighted strategy.

I agree. Have your people do more of what the people are best at, which is relationships and big picture and coming up with new strategies, thought leadership. That's how we do best here.

There's this thing, it's something people talk about in the industry a lot, the concept of an AI centaur. Centaur, like from Greek mythology. It's got the head and chest of a human- And the horse.

Yeah, the horse legs. So if you go back to 1997, Garry Kasparov, chess grandmaster, was beaten by the IBM Deep Blue. Yep.

And that was the end of humans being the best chess players in the world. And it was the start of something new. It was the start of the AI chess centaurs.

So any AI in 19-- Well, the AIs after 1997 could beat the best human. The best AIs could beat the best human. But the best human AI centaurs working together, human and AI as a team, could beat any human and could beat any AI for 20 years.

By around 2017, the AIs got so good that the AIs could beat any human, and the AIs could beat any human-AI combination, which is really sad because that means the human's slowing down the AI in the centaur's place. But right now, from a cybersecurity perspective, we live in the age of the best penetration testers, the best digital forensics people, the best threat hunters. They are centaurs.

That's humans with AI. And I don't know how long that era will last. It might be 20 years, like it was for chess.

It might be 10 years. But it's here now, and we need to accept it and make the most of it while emphasizing the best of our humanity. That's what it's all about.

Another thing, James Lyne, the new CEO of SANS, he really emphasizes this point. In an age of pervasive AI, attackers have AI, defenders have AI, and they're going to keep facing off against each other. " It'll be the people who make the difference more so than ever, because we're going to have this AI arms race where they face off constantly.

But if you have better people than the other side has, if they're more capable, more insightful, more cared for, you will prevail. And so I think always bet on people. It's just such a great tagline.

It is. In an age of pervasive AI, bet on people. I tell you, Ed, I'm listening to you.

I have a lot of thoughts running through my mind. First of all, you know what? I've been around a long time.

Graduated law school, I guess it was 1984. Mm. Took the bar, started practicing law.

If I would've told you that a job ... is going to be a web designer, they would've thought it was someone who was working with spiders. That's right.

Yeah. Back then. Yeah.

Right. Well, we do work with spiders, but not those kind of spiders. That's a different...

Yeah. Yeah. Change is constant.

Change is constant. I got into computers because my passion was computers- Mm-hmm ... and technology, my curiosity.

I lived through the whole dot com thing up and down. Yeah. I rode it up, I rode it down.

Went through the next waves, the cloud and cloud native and everything we've seen. And I've been on the security side of this. Change is constant.

Is change happening faster now? Yeah, I think so. I agree.

Is change more profound now? Yeah. I think this is more akin to the dot com era or even to the electrification of America or something like that, of the world.

But here's the thing. I told you we're part of this Futurum Group now, right? Techstrong.

Yeah. Totally. Daniel Newman, our CEO, released something a couple of weeks ago.

He calls Futurum Forward. It's an amalgamation of the Palantir forward-deployed engineer- Mm-hmm ... and the Bloomberg Information Spine together in an AI world.

So you look at the role of, let's say, an analyst. Yeah. Sure.

What analyst isn't using AI today? You'd be stupid not to. Yep.

And in this world, AI can go gather data, and if you give it the data, it can do an amazing analysis. But it's not your trusted advisor, it's not your decision helper. Mm-hmm.

It's analysis. The role of the forward analysis going forward is to take that AI output and convert it into helping humans make decisions. Yes.

That's right. Right? The machines aren't running the companies yet.

The machines are doing the analysis, the machines are doing the number crunching. But it's still humans who have the spark. That's correct.

And also humans have to have the knowledge base necessary to know when the AI has gone wrong, whether it's got bad data sources, it's hallucinating, or it's just making bad recommendations based on your knowledge and gut instincts, right? Yep. So I don't call that human in the loop.

I call that human at the helm. Yes. Like- Oh my goodness, we're so much on the same...

I hate the phrase human in the loop. I think I'm losing the battle. Yep.

But human in the loop almost sounds like the human is a mere afterthought. Oh, they're in the loop. The human should- A gatekeeper.

Yeah. The human should be controlling the loop at the helm. I like what you say, human at the helm.

But human in the loop- The captain of the ship sits at the helm. That's right. Right?

That's right. But human in the loop sounds weak, and it sounds almost like- Yeah ... ah, just it's like a token assignment.

And it doesn't scale is the other thing. Yeah. Ed, I want to turn this to Black Hat because we're going to run out of time and not discuss it.

Okay. One of the things I read you saying is that you're looking for the human element among all the AI news and products- Yes ... and bells and whistles we're going to see at Black Hat.

That's what I'm looking for. Yeah. How do you think it reveals itself?

I think in corner conversations. There'll be some talks, and I expect the talks will be technical and that's great. I want to see those.

But even what I really want to learn is there'll be some discoveries that will be revealed there, because AI made the discoveries. But I want to see the people who leveraged the AI to make those discoveries and understand how they think and what their workflows are. Not just, this AI did this amazing thing.

No, this human used the AI in certain ways that I want to learn to do this great thing. Right? Let's not just say the AI did this.

No, the human triggered it. Now, sometimes the human triggers it in very simple or even silly ways. That's still fine.

I want to learn that. So I want to go to these talks, see the amazing stuff that these people have done, and then to see what the people's involvement in getting that amazing thing to happen. You see what I'm saying?

Yeah, I get it. Yeah. I get it.

That's what I'm looking for. Very cool. Does SANS have a booth out on the Black Hat floor or?

I think we will. I don't remember. Oh, you do?

I'm not 100% sure. I know there was a lot of talk about it. And I know that we are in partnership with a couple of organizations.

We're going to be running one of our NetWars events there. Oh, very cool. So we will have a presence there.

I don't know if it's going to be a formal booth. I think it's going to be us with a partner, running a cyber range there. Yeah.

Excellent. Yeah. What a great place to run- I'll be there walking around.

I'll be at DEF CON as well, so that'll be nice and really look forward to it. Absolutely. This will be my 30th DEF CON.

Really? God bless you. 30th.

Yeah. What are we up to, DEF CON 33? 30- Oh, I think it's 35.

I should know that. I'm sorry. Maybe 36.

It's 35 or 36. So I got to ask Rich Mogull and see how many years he's been going, but you might be the granddaddy of all the people I've spoken to. Well, I'm telling you, I just did my 30th RSA, and now I'm doing my 30th DEF CON.

You got me beat by, yeah, you got me beat by about five years. My first RSA was 2002. Wow.

Yep. 2002. That's amazing.

Yeah. Time flies. Seems like yesterday.

Oh, God. Yeah. Anyway.

Hey, man, we're over time, but Ed, it's so great seeing you. Like we said in the beginning, don't be a stranger. We do this every day, Monday to Friday.

That's awesome. We do like three hours of this. Great.

So anytime you got something to talk about or you just want to talk, we do this thing called Techstrong Gang where we just pontificate and punditize- Awesome ... for about 45 minutes a day. You're more than welcome to pop in.

Thank you. In the meantime, though- Thank you ... thank you.

Hey, keep doing what you're doing. Congratulations to the SANS Institute on the new CEO. And SANS is an industry pearl.

Wow. Right? A gem that we need to cherish and make sure it keeps doing what it's doing.

I'm thankful for the opportunity to work alongside such great people and to talk with you, Alan. This was wonderful. Thanks.

A pleasure, man. Ed Skoudis, president, SANS Institute. Actually, SANS Technology Institute- Yep.

Technology ... if we're going to be precise. Look for him at Black Hat.

Look for me at Black Hat. But we're going to take a break and be back in a minute.