Zero Trust for AI Demands a New Data Playbook with Stephen Manley

Hey guys, thanks for the throw. We're here with Steven Manley's, the CTO for dva, and we're talking about Zero Trust in the age of ai. Steven, welcome the show.

Ah, it's great to be here. Thanks for having me. We've been talking about Zero Trust for a while now, and we've implemented with, you know, mixed success.

It's a work in progress as they say, but do you think that the rise of AI and maybe AI agents specifically, is gonna really force the issue? I do. Uh, but I also think, you know, one nice thing is on the Zero Trust initiatives, we've always had this challenge that we're kind of retrofitting, uh, systems and architectures that weren't built for a zero trust world.

Whereas the nice thing is as we go into ai and especially agent ai, it's pretty new, so we've actually got a chance to get it right this time. Um, but, but it's really important, uh, that, that we think it through before we start. Because if you think about it, you know, we're gonna end up with hundreds, thousands, tens of thousands of agents, and they're going to be accessing data and, you know, looking at your information in, in ways that even individuals couldn't do in the past.

And so if, if you aren't going in with a plan right at the beginning, it's gonna be really hard to, again, retroactively come in and, and, and bring zero trust in afterwards. There could be, I don't know, thousands, millions of these AI agents are trying to do that retroactively would be damn near impossible. Absolutely.

And, and, and, and, and, and you're right, right? I mean, that, that's the cr the both the cool and the crazy thing about agents is as we've been playing with AgTech ai, you know, each time you think, okay, there'll be a handful of agents here, by the time you're done with the implementation, you're up into the dozens. And that's just for early sort of small starter apps.

So imagine as this thing matures, uh, it it's gonna be like, you know, serverless code or, or containers or microservices. You're gonna have so many more than you expected. And, and yeah, there's, there's just gonna be no way to, to sort of bring those cat herd those cats in unless you have that plan to begin with.

If we think about that whole process, then, um, can't, aren't these richer targets, essentially. I mean, I'm not just hacking into something and stealing some data. I can be taken over an entire process that this AI agent has been trained to execute, and it may as well be integrated with other processes.

And the next thing you know, I'm like running the whole company. Yeah. You know, it's interesting for, for me, because you've like, like microservices, there's gonna be a lot of agents that if we're gonna be honest, if you compromise them, it won't be that big a deal, right?

Imagine you've got an agent whose entire job might be, I don't know, rendering some small thing in the ui, that'll be annoying, but it wouldn't necessarily compromise you. But there are going to be agents and, and again, I think specifically the agents that access data, those are the ones that we're really gonna have to secure. 'cause, 'cause think about it, this can go two ways, you know, one is obviously if you compromise that agent and it has access to the data, and especially say your master data things in your, your CRM like Salesforce or, or some of your critical ip, well, it could just exfiltrate that and you'd never know.

Or if it wants to be even more nefarious the way you're talking about, I could simply modify or generate that data so that the rest of the agents start to act as if, well frankly, the data you fed them is correct. How would they know otherwise? And at that point, you could make an entire large agent ecosystem go, go completely rogue because you're feeding it the data you want to feed it.

So, so to me, again, not all agents are gonna be equal in terms of, of the level of security and zero trust you're gonna need to apply. But those that are closest to your data, those are gonna be the most powerful ones. Those are the ones that you're gonna have to really keep an eye on.

Have we seen a set of best practices yet for zero trust for AI agents? Are people talking about that and what might it look like? Y yeah, so, so some of the, some of the early days on this, um, you know, not, not surprisingly mirror some of what we've been doing in terms of humans or in terms of non-human actors.

So things like, you know, constantly authenticating that, that, that becomes important. That's one of the, the, the, the key zero trust principles is you should be constantly validating that this thing is who, who we think it is. Uh, the next one that, that we should be doing is, is also, again, very similar to if you live in the cloud IAM roles or access permissions, if you're in a data center and you should be creating these agents trying to minimize, you know, each of them, the, the access that they have.

And so, so that's another zero trust principle that we've already started to pull in. And, and so you can see this in, in some of the, some of the tooling that people are creating. Um, so for example, going back to those data agents, uh, ensuring that I don't have an agent that has effectively root access, they can simply look at all the data that agent should authenticate the, you know, very similar to how a person should, they, it only has access to this particular set of data or these records.

And so even if it got compromised, it wouldn't be able to to expand beyond that. And then I think, uh, in, in, in terms of then the interaction with one another, we're seeing more and more in, you know, this, this, this notion that your agent has to constantly validate who it is. And then we're also seeing higher level systems being built to say, I, I'm monitoring your behavior to detect if, if the agent is acting in any anomalous sort of way.

So a lot of what we've learned in terms of humans, uh, and also in terms of the non-human, uh, actors working with APIs, we're already pulling those into best practices around how to manage your, your agenda to ai. Do you think that as we go along here, um, am I gonna have to, I mean, are they passwordless solutions or are they, I don't know, do they have passwords or are there different kinds of ways of thinking about authenticating AI agents as a non-human identity that might be different than human identity? And will we have different authentication kind of schemes for each?

That's a, that's a really good question. And, and it's one that, uh, I know we've talked about inside of, of Druva quite a bit, right? Because, uh, again, as we're adopting Agen AI to help our customers and we protect their data, right?

We protect them from cyber attacks, we protect them from, from, from all the worst things that could possibly happen. So security is first and foremost for us. And so a lot of what we talk about is absolutely you need some sort of password or token or, or you need some sort of authentication and authorization that's not gonna go away even for agents.

But, you know, starting to create a, a, you know, a signature, uh, and, and again, this is, this gets back to that anomalous behavior. My agent should have a certain behavior signature, and each agent as we develop it, does have a certain, you know, sort of behavior pattern that we expect from it that we associate with it. A storage access agent is going to have a different behavior pattern than say, a historical memory or context agent, which is gonna have a different pattern than let's say a UI generat UI generating agent.

And so if you can create that profile now, I'm also then monitoring and making sure is this agent, does it look like it's going rogue? Because even if it can authenticate and it looks like it's going rogue, I still wanna step in and stop it. And so to your point, it's almost, it's almost like having biometrics for your agent, except it's defined by, its, its, its behavior patterns as opposed to by say, fingerprints or, or, or, or irises or those sorts of things.

So a hundred percent with you, it's gonna have to be more than just our traditional sort of token password, uh, authentication and authorization. Do you also think that, you know, we've been talking about the notion of agents being hacked, but won't the bad guys think use of AI to create what amounts to fake agents that will look and act like the agents that you think that you're working with? And how would you know the difference?

Yeah, so this is, this is, this is really to, to me, the, the, the unseen scary threat that I think a lot of organizations are just starting to wake up to now, uh, is, you know, so many software engineers today, uh, still pull code from somewhere else. And, and so, uh, in a lot of cases, this used to be fears about open source pac. 'cause there's, uh, which is why, you know, companies like DVA are constantly validating to make sure that any open source package we use is clean, is good.

Uh, we, we check it more, more thoroughly than even our own code. We're gonna have to do the same with these agents. Um, because, you know, the bad guys are going to be publishing agents and it's gonna be very tempting for engineers to say, Ooh, that agent does what I want.

Let me pull it down. For example, that agent has great interfaces into my Salesforce or my Workday or my ServiceNow, instead of having to write my own, I can just pull that in. Well, okay, that could be infected.

Uh, that could be, that could be malware. And so it's gonna be really critical that, that people have the appropriate, you know, sort of secure lifecycle development processes because if you don't have that, you'll end up infecting yourself. The bad guys won't even have to get in.

They won't have to compromise you, uh, through social engineering. You're gonna be pulling it in yourself. And so, so you're right, the bad guys are off making these ages.

And so this is, this is where again, we, we really remind people and validate anything you're putting into your environment and trust no one going back to the zero trust, uh, kind of principles as we pull all that together though, um, all these AI agents, they're software and aren't they built using the same components that we use for every other piece of software? And as such, won't they have the same vulnerabilities and dependencies that we don't understand? And so the issues that we have today securing our software supply chains will be just exponentially increased.

Is that fair? I, I, I think, yeah, I think, I think what you'll find is the, the level of, of complexity in this will continue to grow, right? So, so the challenge is all of us have with thousands of open source packages now become, like you said, exponentially greater as I get tens to thousands to hundreds of thousands of agents.

Uh, and how am I gonna be able to monitor that? Now at the same time, there will be tools that are built that are gonna help try to at least maintain that, that, that, that's supply chain and, and monitor what's going on, help generate, uh, software bills and materials so that we can track everything that's in an environment. And, and it, it's gonna, that escalating arms race is going to continue between the bad guys and the good guys.

Mm-hmm. But the thing that we always remind people, uh, here at Druva is, and at some point, as awful as it's going to be, something will go wrong. Whether that's something going wrong once upon a time was, uh, a piece of hardware breaking, or it was one of your users getting socially engineered and getting phished, or now getting some bad software in your environment, it doesn't matter.

Uh, it, the bad thing is gonna happen. And so you do everything you can to try to prevent it because you don't want to be an open door. But when that bad thing happens, you have to be ready to then recover.

And if you don't have a plan for how you're going to rebuild your environment, how you're going to make sure your data's safe, how you're gonna be able to get your business up and running again if you don't have that recovery plan, well, you know, trying to come up with it after the bad thing has happened is way harder than trying to come up with it before. So you're right. You know, the, the, the challenges are just gonna continue escalating.

You always need that safety net in place. You always need, you know, sort of a, a, a cyber resilience, a protection and recovery plan for, for when, when the walls get breached. The other thing that I was thinking about is what's your best advice to the security people who once again, kind of find themselves, you know, going be wary, be safe at a time when everybody and his brother is like, yay Asian software, and then running it everywhere, and it's like, you're like the only one in the room who's kind like going, we should be careful.

Yeah, yeah. So, so, so I, I, I, uh, I give, I give security teams three pieces of advice. Um, so, so the first one is, uh, frankly, you get friendly with your IT teams.

Um, because, you know, in cloud and agent ai especially, these are two areas that when I meet CISOs, one of the, one of the wild things they, they ask me is, oh, drew, you're protecting all our data, especially in the cloud. Could you tell me what we're running in the cloud? Because those, those, those, those, those business people who are moving a million miles an hour are pulling in agent AI and running stuff in the cloud, they don't want to tell us about it because they know we're going to say, slow down, let's think this through.

And so teaming up with the IT team, specifically the backup team, just so you can get a sense of what's running, is really, really useful because it's really hard to secure what you don't know about. So that's one is we've gotta break these silos, we've gotta team up if we're really gonna keep these environments safe. The second piece of advice I give them is, is always, you know, you're all great.

You're fabulous at working on the perimeter. You have fantastic tools, processes, people. But again, think about what are you gonna do when the bad thing happens?

Because it is just statistically it's going to happen. How are you gonna recover? Make yourself part of that process.

Make sure you know what you're gonna do when the bad thing happens. And then the third piece of advice we give them is, pick your battles, right? Uh, you know, like I said, not all the agent threats are gonna be the same.

Not all data accesses are gonna be the same. If you try to fight everything equally, then the organization will tune you out. So there are times where you have to say, okay, look, you know, e everybody that, that, that's using AI with their OneDrive or their, their Google Drive, all right, here's some standardized tools, whether it's Microsoft, copilot, Google, Gemini, have at it, you know, u use these standardized tools and focus your energy again on a lot of that master data, whether it's your CRM data, your, your, your sensitive ip.

Pick your battles because you're not gonna be able to fight everywhere every time. And if you do that, people will understand, oh, well they're, they're, they're really focusing here for a reason, and that reason is this matters a little bit more. And they're not just being, you know, sort of the sky is falling, the sky is falling.

So, so those are my three is one, work with your IT team. Uh, two, think about how you're gonna recover when the bad thing happens. And then three, pick your battles.

Focus on the things that matter most, which is usually your master data management systems folks, the AI agents are coming, but once again, we need a little adult supervision. Hey Steven, thanks for being on the show. I appreciate it.

Thanks for the time, everybody. Be safe out there. All right.

And back to you guys in the studio.