Navigating AI’s Double-Edged Sword in Cybersecurity – Techstrong AI Podcast EP55

Hello, and welcome to the Techstrong AI Podcast. I'm Amanda Ani, and with me today is Braden Rogers. He is the Chief Customer Officer at Island.

How are you doing today? I'm doing great, Amanda. Thanks for having me today.

Happy to have you on our show. Can you share a little bit about Island? What services do you provide there?

Sure. Well, if you think about the world of applications that people access for their work every single day, uh, you know, the world has moved to a heavy use of web-based applications. And unfortunately, one of the downsides of that is that that brings the fact that we're using our browser for that.

And the downside of that is that we're using often the consumer grade browser and the consumer grade browser's a great piece of technology, but at the end of the day, it's built for consumers. It's not built for the enterprise. So what we did is we said, look, what could happen if we could change the world a bit and rethink the browser as something that's enterprise ready?

It's built for the enterprise. And we turned the browser into an actual application delivery platform. And that's what we did with IL We built the world's first enterprise browser and leveraged the browser as an actual enterprise application delivery platform.

Inherently securing the applications, keeping the user safe in the process, giving the user more productive experience, and, uh, obviously at the end of the day, empowering organizations to deliver services to their audiences. Uh, much like AI services in the process at the right time, and, you know, right at the user's fingertips. Wonderful.

Yes. And it seems to be all about AI these days and integrating multiple AI tools, and that's what we're talking about today is actually the double-edged sword, um, of AI when it comes to cybersecurity. So from your experience, what are some of the, the key risks and concerns that business leaders, uh, need to be aware of when it comes to integrating ai?

Sure. Well, let's, let's go back 10, 15 years ago. There was this, this, this consumerization of technologies.

Um, you should, sure you've heard the term shadow IT before. Um, you know, employees, uh, you know, people that are in the organizations, they felt this, um, this need to leverage services outside of the organization's purview to make their jobs easier. Think of things like, and the obvious ones were things like consumer storage situations, you know, things like Dropbox, et cetera.

And obviously the users trying to make themselves more effective at doing their job by bringing the service to the environment. The downside is, is they're, as they're leveraging corporate data and bringing that into the application such as consumer storage, et cetera, uh, they're putting corporate data at risk. Obviously now the corporate data is no longer, you know, or the corporate, the corporate environment is no longer the custodian of their own data is now being held by some third party provider we don't even have agreements with.

So, you know, this about 10, 15 years ago, shadow, it was a, a really big issue because people were bringing services to the table and the users were ahead of the IT organization. The IT organization worked to catch up. And then today we don't have nearly the shadow IT issue we once had, because the common tooling that the user will bring in the environment, we've given them corporate options in the environment.

And that's what the users are usually hungry for. They're looking for the corporate option. Look at, they, they, they're not trying to evade the, the, the corporate governance.

And they're not trying to be insiders, you know, insider threats. They're just trying to do their jobs effectively and they bring these things to the table. But when we give them effective options, it, it makes their world easier to do their job and they don't chase those things any longer.

Think of, of, of generative ai. The world of ai that's, that's arisen in the past, uh, two years now at this point as shadows within shadows, and there's a gold rush by the end users to want to use this. It's, it is the proverbial cheat code for doing your job.

And at the end of the day, you know, there's obviously the intellectual curiosity that we all have with it. Um, there's the things it can do to make us more effective at our jobs, but at the end of the day, many of these, these environments are outside of our corporate purview, very much like the shadow IT apps. Uh, but the difference here is that the users are rushing to them en mass.

And so that creates a bit of a challenge. It's a much faster challenge than we had before. And there's the, obviously there's AI tooling of all sorts.

There's, you know, command line resources to give us answers to things. There's things that create imagery for us, uh, in the environments. There's things that can create audio and video and things along those lines.

So, uh, you know, organizations are trying to find their way through these things. And obviously the organization's data, we're seeing stories, you know, several stories have come up over the past year or org's data is, you know, very sensitive. IP has found its way into places that the org didn't really maintain control over.

And obviously that creates all kinds of issues. Absolutely. Yeah.

That, that's a big concern because it's kind of hard to track or know what AI tools are being used by all the employees and they're all using them. And if they don't know, um, that they're putting sensitive data into that tool, um, that's very dangerous for the company. So what, uh, what solutions do you have?

Do you think there should be more training, company-wide training, um, for one, as far as safety and security goes? And then, um, how can business leaders get more of the company on board to using company tools and not using these, uh, other tools? Yeah, I, I look user awareness is always a great thing.

The downside of user awareness, as we've seen over the past several years, orgs have trained and trained and trained their users. They've done things like you leave USB drives in parking lots and tested users and have posters in the office. And, and what we generally find is that even in lieu of the training, users still fall victim to things that they inadvertently shouldn't fall victim to.

Uh, that's why phishing still exists as a problem in the, in the world today, you know, even basic phishing attacks. So at the end of the day, it's not to say we wouldn't train people, but we should put technological means in place to help shepherd the user to the appropriate place with a great experience. Many organizations today, the natural experience they wanna put in place or they have put in place is a block page.

Alright? So the user tries to go, let's just pick chat GBT, but it could be tooling of X, Y, Z. But they try to go to chat, GBT think it a big nasty block page that says you're not able to go here.

So in the world of shadow it, what was the user naturally gonna do in the old days? They start go hunting for the way to get through, find their option, you know, to scratch their itch. So what we have to do is, as an organ, as an organization, is empower our users in a way where we adopt services, we move at their pace, we adopt services that are sanctioned, and when the user goes to these destinations, we gracefully bounce them or shepherd them over to the appropriate place that's sanctioned.

And what we do in that process is the user doesn't have to know the destination. The user is guided by the technology to the appropriate place, and then they get their itch scratched, and as a result, they begin to use the corporate sanctioned environments in the process as well. Um, that's a much more elegant way to do it for the end users.

And obviously the orgs, you know, is picking a sanctioned environment, one that's under our contractual standards, one which one, one, which we understand how that, that that entity on the other end is protecting our data. Uh, again, we have contractual SLAs to protect those things, and as a result, everybody's in, in a better state. The users, you know, get their need met and the organization keeps this data protected.

That sounds like a really great idea. So if an employee needs to generate some special kind of graphic and they are going to their own AI tool or site, then they get redirected to exactly what they need to do that that's within the company tools. Indeed.

Yeah. Obviously user experience matters a lot and the ugliness sometimes of, and this is the downside of cyber, for many, many years we've, we've been the, we've been the no, no, no people for so long and, and a lot of per we get a negative, we get a little bit of a black eye for, for getting in the way of business. Um, that's not true.

Cyber, you know, cyber folks are trying to protect the organization, keep things safe. At the end of the day, sometimes the user experience suffers. And so if we can consider the user experience in that process, and then again shepherd them to the appropriate place, I think you find that, that everybody's happy in that process and you know, when the user's needs aren't met by that tooling, they may go chase something else.

So it's important that we as practitioners stay in front of what the user demand is, the things that they need to do their job and provide them effective tools in the process to be, to be effective. Um, and one thing that's really important, this not just applies to the end users, it applies to the executive ranks as well. You think about it, if you're an executive in an organization, you're running a line of business, you're feeling competitive pressure from your competitors who are adopting ai, they're bringing AI into their environments, and you're asking your teams, Hey, how do we do this?

How do we do this? How do we do this? And oftentimes the pressure can come at the sacrifice of many of those other things that we talked about before, the concern over cyber concern, over user experience, et cetera.

Again, the gold mind, the gold rush, I should say, doesn't, doesn't just exist in the user ranks, exist in the, in the business line of business as well. It's creating that same pressure in the same way, Way. And I feel like some people, so I have a question.

Some people might be very comfortable with their own personal tools that they're using and then they are redirected to these other tools. Um, is there some, um, training being offered, uh, level to level up their skillset so that they can use the company tools? Well, you know what's interesting about that, the, there are techniques where you, and again, this is the, again, back to the, the two-sided coin of cyber.

There's always been this say no approach to things, always say no to the per consumer stuff. There are vehicles today now where we can actually start saying yes to those consumer things without the risk of corporate data spilling over. In fact, that's one of the things we do in the core of the enterprise browser, is create boundaries where the user works in the sanction environments over here, they can freely move corporate data across the various places they need to move corporate data to, to the apps, but the user at the same time can use personal applications.

You can use things like chat GBT or tooling X, YZ grok or whatever it may be. And at the same time, the, the corporate environment is sanctioned or, or should say, cordoned off, and the data doesn't spill over the boundary into something personal. So the user can now use personal applications and personal tooling without the risk.

So that's, that's a freeing kind of optimistic point of view that cyber's often been lacking is how do we say yes to all these things We normally say no to, um, enterprise browser's. One great way to leverage that. There's other technology as well that exists, ability to do that.

But, you know, changing our point of view about how do we, how do we encourage and, and how do we open up and free up the, the need to, or the ability to say yes to certain things that we otherwise would've shut down. And that's very true of things like take generative AI outta the mix. Even simple stuff like personal Gmail, like a lot of organizations block personal email usage, personal chat and things like that.

What if we could open those things up and let the users have freedom to do that? Maybe you want the audit, maybe you need an audit record from a financial services standpoint. If you're a firm in the financial services world, great.

You could audit it, but at the same time, the user has the freedom to work in those things without corporate data spilling over. Yeah, That's wonderful. And it gives them the opportunity to do, to do their best work, um, with what they're most comfortable with.

So we know that AI has rapidly advanced over the last two years. Um, what's the next, um, what are some things that business leaders need to be concerned about as AI does evolve and, you know, even more tools are coming out? How do they stay ahead of these rapidly evolving tools?

Well, what's interesting is, is there's gonna be, there's a line, actually, it's not gonna be, it's happening now. There's a line that is disappearing between AI and the actual applications. The applications are AI in the process.

So I'll use a perfect example. Just, just take your basic Google search today. When you do a Google search, the first result that comes back is an, is a, is a generative AI result that comes back at the top of the screen.

So applications are now embedding AI into their experience. So at the end of the day there, there's a, there's a very big blurry area starting to appear. And, and it's, there's a reason because if you're an application provider, I mentioned competitive pressures earlier from the executive ranks, well, in the vendor ranks in the, in the supplier ranks and the technology, there's competitive pressure as well to build those capabilities into your core product to make your core product more flexible, make it more usable by the end users, make it more engaging.

And, uh, you know, you're kind of seeing that path across a variety of different applications where the back end is where the front end, I should say is a front end generative AI environment giving answers to the end users. In fact, many times, the, a lot of, a lot of folks are talking about how the business logic and applications really AI starts turning into the core business logic for the applications. Um, and at its core, all of our applications become AI enabled in some way or another.

So it's, it's important that we just understand our supply chain, those agreements we have, how they're using that data at the end of the day, because obviously it's one thing for the, for the vendor to use my data for my own benefit. It's another thing when they're using my data for the collective benefit, and now all of our data across the organizations is being used to train their models, et cetera. And, you know, there could be certainly be concerns, but I think it's important for practitioners to dive in on the, the relationships they have with their vendors, understand what their paths are, their roadmaps, and, uh, how that applies to the risk, uh, tolerance the organization has.

Yeah. And to make sure that that, that everyone is, um, complying with AI regulations and, and laws which, you know, are changing, um, quite rapidly as well. Yeah, look, th this is definitely an area, big gray area for a lot, a lot of parts of the many parts of the world, um, around that, how this will be governed and, and you know, how, how, how governments will step into it, but even how regulatory bodies that are maybe industry bodies, et cetera, uh, step into it.

So I think it's important to be watching and kind of being, being aware of how the world around you from a regulatory standpoint is adapting to these things and, uh, you know, how it's thinking about these things. And then obviously you'll have to think about these things in that way as well. If your financial services org you may have regulatory bodies that you're holding doing that way and they've got their own point of view that might be different than healthcare, uh, at the end of the day.

So I certainly think it's important to understand those things. Absolutely. Well, if there was one thing that you could leave our audience with today, what would that be?

Well, I think the most important thing is we don't have to be scared of these things. Uh, these things are, are of great advantages. We live really interesting times right now and it's a, it's a very unique, uh, time when technology such as this is so accessible to the average person.

If we think about generative AI as a, as a technology, uh, you know, that part of ai, um, it's really cool that you get to engage something in your natural language. You don't have to be a developer or someone that has deep skills technologically to engage these things. You just not need to know how to speak your local language.

Um, and that's really, really, you know, fascinating. It obviously comes with, its with, its uh, you know, you talked about the double-edged sword earlier. It comes with, with the other side of the, the sword that, that if the org doesn't have its hands around these challenges and isn't moving with the same pace of the technology, the users will run faster.

Uh, again, it goes back to that gold rush commentary I made earlier. So I don't think we have to be scared of these things. I think it's okay to embrace them.

It's also, uh, you know, important that you understand what's available in the industry that helps you effectively embrace these things so that you can obviously make your decisions for your own risk tolerance, but also, uh, help the organization to be competitive from a business standpoint. Alright, well thank you for sharing your insights with us today. Thank you, Amanda.

It's been honor to be with you. All right. And they can get to our audience.

Stay tuned. There's more.