Five Ways Cybersecurity Leaders Can Leverage GenAI | RSAC Virtual 2024

Hello, thanks for joining us today. My name is Tim Chase. I am a global field CISO at Lacework, and I wanna spend the next few minutes talking about five ways that cybersecurity leaders can leverage Gen AI in 2024.

And let's start out by just talking about some facts. 45 million. That number has not gotten any smaller in the amount of time that I have been doing security.

Uh, it seems like it's consistently going up and up and up. And in addition to that, we're seeing more and more breaches. Uh, the criminals are realizing that a good old ransomware attack a lot of times is successful.

And so, uh, the attacks are not stopping or slowing, and we're starting to see those continually, um, increase and they're getting more expensive. In addition to that, 39% of security professionals claim that the skill shortage has led to an inability to learn or use security technologies to their full potential. Like, in other words, they're too busy doing mundane tasks or doing the job of two people that they don't have time to learn.

Right? And with all this new technology that's coming out, whether it's cloud or gen ai or new ways to do application security, if they don't have time to learn it, you can't take advantage of the new technology. And this really even kind of goes into, um, job satisfaction.

If they're doing too much work, if they're doing the work of more than one person, then they're not gonna be happy at their job and they're gonna feel overworked. And so, uh, finally, the organizations that use AI and automation, they can bring down the breach cycle and they can help lower the data breach cost because that is, um, because that is less. And, um, on average, uh, if you companies that have used AI and automation to inside of their, um, when they have a breach to try and, and, and speed up the, the process of identifying where that breach is and finding out more data around it, they bring that, that time down to a 188 day, 108 days shorter than it would've been.

8 million lower in data breach costs. So those are both great things about using, um, an ai. But let's, let's spend a few amount, a few amounts of, uh, a few minutes talking about the, um, gen AI and how we can use it to maybe help some of these problems that we just talked about.

One, you can use Gen AI to augment your team. So when, when you think about it, uh, a lot of times we are being overworked, especially the cloud security industry as a whole. We've seen a negative unemployment rate for the last several years.

So people are overburdened and they're overworked, and they're stuck a lot of times in the mundane tasks. They're doing maybe the level one SOC analyst job. Um, and they're, uh, when they're actually a higher level analyst, or maybe they're sitting there looking through logs trying to correlate data.

Um, and so finding ways to augment, uh, your team is a great way that gen ai, uh, will start to be used, right? So being able to take a first pass at those, uh, at the alerts when they come in, being able to, um, ask questions about an alert, uh, so that the, um, the learning curve maybe comes down a little bit, right? So it's gen AI can be used to augment your team to, um, to, so that you're, the people that you do have their jobs can be easier.

Um, and in, in addition to that, by making their jobs easier, taking some of the load off of it, you can help make their job satisfaction even better, right? You know, I can tell you that, you know, sometimes some of the most frustrating parts, um, in my career have been when I've gotten into a rut, and a lot of my work has been this mundane stuff that I felt like I could find ways to automate. And so, by using Gen AI to do that, you can free up your team to do things that are more value add to the business.

'cause when you really get down to it, that's what the cybersecurity teams should be, um, is a, uh, a value add to the business, right? And so by freeing them up from a lot of this, maybe it's report writing or sorting through alerts, by freeing them up to do things that will better help the business, uh, you'll make their lives better. And also, uh, improve the lives, um, prove the business as well.

Um, anomaly detection. So this is an area where gen AI can really help. Um, and we've been seeing machine learning do this, uh, for a while now.

But with the addition of Gen ai, we're gonna, we're starting to see, um, some modern day sims be able to sort through a, a vast amount of data to be able to look for anomalies. Uh, a lot of times the trend that I'm seeing is that people are starting to use data lakes more where they want to take all of their security data, dump it into a, you know, a data lake, which is lower costs than a sim, and then find ways to report against it, or a, you know, find ways to get alerts based off of that data link. And so, when you have that amount of data, obviously the problem is how do I sort through it?

How do I make sense of all of that data? Well, that's where Gen ai, um, can really help. And we're starting to see that in some instances.

Um, companies that are building modern sims. Um, they have the ability to pull that data from the data lake and analyze that, that vast amount of data. And even a lot of, um, uh, outsource sims are starting to use genai to look at alerts across all of their customer bases, right?

Look for those anomalies that are a common attack pattern across, uh, multiple customer sites. And genai is in a really, a great place to do this because it can help, uh, it can help learn, it can help some, uh, take some of those, uh, tasks that are maybe difficult to correlate, or you have to write, you know, tens of, hundreds of rules for, and it can, it can do this, um, in a way that is efficient and fast and really, and really speed up the investigation time, because that's what you're after here, um, are ways to speed up the investigation time so that, uh, with all of your, uh, regulations and rules that you have to follow in a modern day security practice, the quicker that you can get to the bottom, um, of an alert, uh, the better. Right?

When you're doing an investigation and you're looking at anomaly detection, um, uh, the quicker that you can determine if something is material, the quicker that you can turn, uh, decide if something is relevant or not, the, the better that it is, right? Because a lot of these modern regulations, um, you have to report in within, you know, starting either within a day or within three days. So using anomaly detection and being able to do it quickly is a key way to use gen ai, um, and ask questions and find insights faster.

This goes back even to the first thing that we talked about, right? So sometimes when you have a cybersecurity, um, shortage and you're bringing in people that maybe don't have the level of experience that you wanted, uh, there's a level of training, right? You have to find a way to, to get them where they need to be fairly quickly.

Well, gene AI is being used to being able, uh, to enable companies to do this right? By being able to query, uh, against data. And you can kind of see here an example, um, of a, of a cloud security alert.

And when you look at something like this, you know, you need to be able to query and say, why does this alert matter? Uh, what risk does this alert provide to me? Like, how would I remediate this alert?

What steps can I take inside of my cloud provider to remediate this alert? So being able to query this will really help, especially with those, um, level one analysts that maybe are just starting, and they don't have to go to the cloud team, or they send alerts over to the cloud team for the, that the cloud team has to review. They can kind of do this initial triage themselves to get an understanding of, of do I care?

Why do I care? And, and how do I go about fixing this, right? And so this kind of goes back, like I said, to the first one that we talk about where, uh, this will help free up, um, um, in some of the, some of the resources that we have and, and enable us to maybe look outside of the normal security, uh, hires and find some of those people that wanna make an entry into the security space.

And the fourth one to talk about is, you know, we want to ensure, uh, privacy by design. And this, this comes in, in, in a couple of of different ways. So when you're building out your, um, your gen AI practice, it's important that, uh, you take privacy into consideration, uh, for, for several reasons.

Um, one is that, uh, there are regulations out there now that are shaping up that are gonna require it. The United States are a little bit, uh, behind here, we're talking about it, and we've, we've seen our, uh, the current administration take some steps to start talking about how to do ai, um, in, in, in an appropriate way. But the, the EU in, in Europe, they're a little bit ahead of us, and they already have a, an EU AI act that's getting ready to be enacted.

And this talks a lot about, hey, if you're gonna take in customer data and you're gonna use, um, gen AI or AI against the customer data, well, here are some steps you need to make sure and take. And the, uh, the steps are more rigorous depending on the type of data that you are analyzing. So when we're using the, uh, when we're using Gen ai, uh, and we're using it to analyze data, we, we've got to be sure that we understand the type of data that we're analyzing, um, and how we're, um, securing it.

If you think about it, a lot of times, um, uh, you know, when you're using it maybe against customer data to, to be able to query across your customer data set for some reason, well, you need to make sure that you understand, um, that if you give your gene AI engine access to all of these, um, all of the different customer sets, you have to make sure that you know, you what customer A, can't get ahold of customer B or C'S data due to the way that the, that the gene AI has been enacted. So when we're, when we are designing, uh, this, this system, and when we're looking at doing, uh, gen ai, we have to make sure that we've got privacy, uh, by design thought of, um, and lastly, recognize patterns, right? And this is one of the areas that I'm the most excited about, and I think we're just at the very beginning of how we can do this in security with, with gen ai.

Um, you know, we talked a little bit about, uh, being able to do anomaly detection inside of a data lake, but um, also this kind of takes it to a, a step further, right? How do we recognize patterns that would alert us to something that is going on? You know, and that could be across, uh, maybe all of our vulnerabilities.

It could be across our application security or, um, our security operations, whatever it may be. We have the ability to, to, to recognize patterns, uh, with gen AI and get those alerts sooner, right? And I think this is gonna be especially powerful as, um, I think more and more people are gonna continue to offload their security operations rather than doing it in-house, right?

Just from a, a practical matter of not having enough people to staff it. And so as that happens, we're gonna see more and more of these, um, these soc uh, managed SOC or MDR providers start to use Gene AI to recognize patterns across, uh, multiple customers, right? That's really gonna be the, um, a strong use case for gene ai.

And we're seeing a lot of investment in that already, because that is, uh, one of the advantages of using an outsource. So, and MDR is being able to, uh, they can take the, the intelligence that they leverage from customer A and use that to all, you know, their other hundreds or thousands of customers, right? And gene AI is really gonna empower them to do this.

They're gonna be able to say, look, you know, we're starting to, um, uh, 10% of our customers we're really starting to see this kind of activity. We're seeing an uptick in, uh, remote access attempts, or we're seeing an uptick of, um, uh, customers trying to log in from, you know, X country. And so, um, gen AI is gonna be good at being able to pick up those patterns and it's really gonna going to enable SOC teams, um, to succeed and, and, and be quicker.

Because, you know, from a incident response perspective, it's all about how quickly can we determine if something is an incident and how quickly can we obviously stop it. But just understanding the initial, um, do we have a problem, do we have an incident, is where gen AI is gonna help. And it can do that by, by recognizing, uh, the patterns.

So hopefully that was helpful. Those are just five ways that I've thought of, um, of how we can use, um, gen AI inside of, uh, cybersecurity. If you would like to learn more about Lacework or if you want to know more about, uh, gen AI and machine learning, or just anything in security in general, you know, please email me, look me up on, on LinkedIn and I'd be, I'd be happy to connect and answer any questions that you have.

Thank you.