Tracy Bannon, MITRE | RSA Conference

This is texturung TV. Hey everyone, Alan back here wrapping up our RSA coverage today. It's our last day of our I said we've got to end early because the police closes.

But that's okay. Hopefully you've got your full of RSA coverage from Tech strong this week. We've probably done I don't know.

50 60 70 interviews. So but we've got some other good ones for you. Our next guest is a friend of mine for a couple of years now and she also presented at our devops connective sick ops event this past Monday here at RSA conference.

And if you watching this you may not have been here in person to see it good news is June 1st. We replay it. We have the virtual devops connective sick ops event with all of the sessions from Monday along with some bonus sessions that will be any specifically for the virtual event.

com Security Boulevard Cloud native now Tech strong TV digital cxo, don't miss it. But anyway enough about that. Let me introduce you to chase man and Chase.

How are you? I am doing really well. It has been an energizing week.

It was nice compared to last year. It was still muted last year. I think it's a bit more vibrant quite a bit more people here.

We're not keeping our distance. So it's been nice to get some hands and hugs. You didn't help last year half of it but still got sick exactly exactly, you know, so there goes that routine out the window, but yes, that being said, it's been a great show.

I think we've had Some great. It's just been great for me to just see my people tell you to choose and and a reconnect. We've re-energize me for me.

It's been an odyssey because I came directly here from kubecon over in Amsterdam and came on over the Monday event. I thought was one of our best especially in terms of the content including you. So thank you.

Thank you. Chase people out here may not know who you are. Why don't we before we jump into what we want to talk about today?

Why don't we talk a little bit about you? Oh my well, let's see. I'll give you the the quick Spiel.

I've spent a couple of decades. I won't say how many decades but a couple of decades as a software architect and an engineer worked with global consultancies and then got invited to work with miter. Yeah, and you know a little bit about miter literally funded research and development Corporation created by Congress.

These were all created by Congress to help the government. So I get paid to be objective, which is kind of great right straight talk the entire time. So and I I do a lot of community outreach Community involvement in our devops communities getting into our generative AI communities getting into our diversity, you know, and trying to bring more diversity thought diversity into Computing.

Yeah a little bit about me absolutely and look you've been doing your podcasting for 505. I am I am And you well, you you get around I don't need it in a bad way. I don't know if I mean that I didn't mean it a bad way, but you're out there right?

You're out there whether we're looking on podcasts or LinkedIn. You're an interest. I follow Chase on LinkedIn, you know friends with our and interesting life is too short to not try and help other people and that's why I get out there.

That's why I'm that's why I'm getting around absolutely good for you. Um, so what we want to talk today, so look every year. There's always a theme at RSA last year was zero chance.

Everything was Zero check. This year and it's it's not even just RSA. It consumes.

The tech world is generative AI. And we have heard everything from this is you know, the the second coming. To the Devil Himself.

Mm-hmm. Truth is somewhere in between it always somewhere you always a lot of folks don't even know what generative AI is so that her chat GPT is this brain out there thinking for them? No generative AI is generative meaning it produces new content.

So how does it do it? It's a math model. large language models you feed it a lot of text you feed a lot of sentences and it figures out the the probability that words are going to Be together again.

That's all that it is. Right. So people kind of take a step back and think about it from that perspective.

Well then, how can I leverage it to statistically produce code or copy that would be helpful. Where's it at right now? It's it's in its infancy.

Absolutely and it's infancy. I did a lot of experiments and I'm continuing to do a lot of work with it around the stlc. Can it actually help?

Eventually, it's not ready for prime time. It's not ready for Prime Time on. A lot of different fronts right let alone sldc kind of stuff or sdlc kind of stuff.

But I think that's okay. And again, this is you know, we live in these hype Cycles worlds where it's when something gets so high. We don't give it a chance to grow up exactly right because it doesn't grow up fast enough.

Right? Right. Well, we if this is no different than saying Cloud a few years ago and then then agile and and devops and all of these things are going to make you, you know, six inches taller and 50 pounds lighter and it takes 10 years.

It does it does now, I will say that we've been using generative AI to help us create software and to help us monitor operations for years. However, now we've exposed the concept to the masses and a lot of people are coming up with a lot of really good Innovations and it's early like if you think about co-pilot from Microsoft pilot off, right that's actually one of the nicest ones I've seen here and as a Friday they're acceptance rate on generated code was about 26% That's it. So it's not like it's going to take away all of our job.

Hi, that's pretty good. That is pretty good. They give you a Live different options it regenerates twenty six percent.

But you know getting back to where is it at it's in its infancy. So people need to realize that they're going to have to work with it and be aware of what some of the security concerns are and this is RSA. So we're talking about security.

The models themselves who owns the model, where are they getting the data from and if I Supply my code for for GPT or any other tools to evaluate are they keeping it? Like that's a real thing. I know you think keeping it.

But are they? Using with other people exactly and that's yeah most smaller companies don't have the funds to create and train their own models right now. So they're going with the bigs.

Did you see earlier this week? One of the smartest things that has happened with generative is actually the chat GPT is created a business business class service your information your model is unique to you you're gonna pay for it, but they had to get there quickly because businesses are no but that was that was a real robot. I mean look, full confession here I've been paying the 20 bucks a month for the commercial version.

Why and I will gladly play for the business version because I would like to upload the entire text strong library and and let people have at it via chat GPT. Oh absolutely absolutely and you're gonna see a lot of folks that are doing that in the government space where I spend a lot of time somebody very good friend Nick Salon. He was the chief software officer for the Air Force.

He saw an opportunity immediately to help the government. So he created A generative AI he calls it asks Sage this not a product plug but it's yes over 700 government clients now because they saw that they couldn't simply go and use what was being shared commercially heck some of those models are being trained by non-us folks that matters to the government. I can't simply Outsource it to a village in a country where you know, they're not us Nationals.

There's a couple of issues within I want to come back to but I want to touch on something first. No, you mentioned it's no different than devops or cloud or agile or stuff. So I've been in technology for 30 plus years and I see I seen a lot of innovation and I kind of bucketize my Innovation into two big buckets one are things that are gonna absolutely change my technology world.

I'm a technology person security is my subspecialty and things that are really gonna change it Cloud was a big change devops was an earthquake. but then I always give it my sister-in-law test, right Bonnie my wife Bonnie has She had three sisters. What would my sister-in-law's think about it?

You know what devops? Other than they wonder what the hell it is that Alan makes a living with it. Didn't really move their world wowed.

They saw the commercials everything's in the cloud. But to them everything's on their phone. They don't even realize it's on the cloud.

Agile, that's halfway developers the internet. That made a difference in their world. Yes.

Yes Cloud GPT. They see it. They think it's magic logging in and they're getting a free account and I can tell you that the first thing that my husband did this is a joke, but it's real I logged in we created a free account.

I said, what do you want to do? He said well I think I want to get some better dad jokes, like seriously. So he said, you know as a witty day create 10 chicken jokes.

Yeah honest. Oh gosh. She did that.

So people are seeing it. You know, that's the appeal of it everybody. It's accessible to everybody but you know it it appears to speak with credibility and that's where we have to be careful because I've been able to have chant GPT and perplexity and some of the other AI engines I've been able to make them say some things that are just not true.

Well beyond that well only 26% of the codes accepted. It's about the same level of exactly and so in this brings up the other thing which is sort of the the not to the propensity, but the possibility or the more than a possibility You know the downside of this fake news bias and unintentional bias. built in yeah, right and and what we can do do to avoid this and Gosh, that's a we'd have to get a cup of coffee.

Yeah. No, it's only if you but the fact of the matter is even if the open API the OpenAI people would chat GPT somehow, you know, put some guardrails in place so that you know, we don't have unintentioned or we try to minimize the unintentional bias. We try to weed out kind of fake.

News or you know part of the large language model is make sure it's very, you know verified. That's not the only generative AI in town you you just said it, you know, you know and we're just talking about us and Western ones. What about Chinese?

What straight right so we're talking about large language models. There was a recent snippet that I did for 505 was on some additional generators that are out there and there is NVIDIA has eye contact so I don't have to look at the camera. I can be looking all over but it will appear that I'm looking at I The Deep fake stuff there's a I think I think it's called Val e v a l l Dashie.

They did took 6,000 us speakers. I think my numbers are right did 70,000 hours worth of recording and now I can take five seconds of Alan Shimel and have Alan say anything and I'd say you're Alan is gonna read a bedtime story. I'll tell you something on this on that front.

If you're on LinkedIn, my friend Laurie mcveady from F5 Networks. We could to go published a graphic of all of the different AIS and what they do. And there's I mean there's dozens of them right and more every day.

So yeah that and that's the scary part right? It's it's the wild west right now. Now look I'm not gonna sit here and say the government has to come in.

I'm not a big believer in that nor am I a big believer and saying we need a six months moratorium because that's unrealistic is it is unrealistic, but I think what has to happen is the natural way of things. And it's going to take time. It's out right your point.

We need to get the message out that this is not a brain. It's a model and it's a model that's regulating. It is only as smart as the information that we're pushing into it and people need to be practical realize evaluate what you're saying one of the better versions that I've seen it is not as eloquent but is perplexity.

Yeah for the average person to type it in. It will give the little footnotes. It'll tell me where it got that piece of information that to me is fantastic.

So I think if we're gonna train folks we need to be able to provide them with that kind of information John our friend John Willis is a big family. Yeah, actually that's right about it. Really?

Yeah John uses for a lot of his research and it was Deming stuff. Oh, yeah, and he uses it for a lot of that but they'll be more they'll be more look this is gonna be and you know, the road is never smooth. Straight it's always a little bit of a Cha-Cha two steps forward one step back one step to the side turned around do the hokey pokey.

So that's what this Chachi VT or this generator of AI. I think this is what we got ahead of us. And I think we we are at that moment where this is so impactful of the entire population as you that's right.

It's a civilization not a tech thing. I think we're gonna I jokingly said this the other day and I'll say it again. I believe that in a couple of years.

We're gonna turn around each other and say, where were you when chance first you exactly where were you because people are excited. I had a wonderful husbands apprentices come in the house to visit 19 years old and he was just going to town and all the different things that he'd been able to do with art with coffee with sex with telling stories with poetry with music. Yeah, but it goes back to what you said in the beginning.

We're at the beginning of the Benny beginning here. Not even the To the beginning. I think the killer app for generative AI isn't even here yet.

Oh, no not just scratch here in the embryonic, right? That's how early we agree Chase. I hope you enjoyed RSA.

I did it's all we will see you always great great time follow her on 505. We're here live at RSA. We're gonna take a break.

We're gonna be right back.