Black Hat 2023 Edition – Techstrong Research Review EP30

This is Textron tv. Hi everybody. Mike Rothman here with a special Textron Research Review live from Black Hat.

Well, okay. Not exactly live. It's live because Mitch and I are actually in the same, we're Live.

We're live. We're on. How you doing to see you Last, last time I checked we were alive.

How about That? I think we're still alive. We are here in Vegas at the Black Hat Conference.

I've been in Vegas for almost a week at this point. I'm about to collapse, but all I have to do is make it through this recording and then I'm pretty much done. Done.

So this is, this is the home stretch of, uh, black Hat Mitchell. How are you? I'm doing well.

My black hat is, is is not your black hat. You have, you come here early doing all your I do, I do do your classes and workshops. So We, we, we teach a little bit of classes over the weekend and then Monday and Tuesday, and it's a grind.

But you know what's great? I get to you again. Expose a whole mess of folks to cloud security, you know, run through some labs, you know, kind of teach people, see a lot of old friends.

So it, it is fun. I do value this time, but man, a week in Vegas is a long period of Time. That's hard.

Usually it's hard to endure. But you've been so busy. Probably don't feel like you're in Vegas.

Yeah. But then, you know, listen, when I, when I get on the plane early tomorrow morning, I'll be just like, don't talk to me. Even if I know you don't talk to me, I'll call you on Monday and it will be great.

You just put your hoodie on, tighten it up, put my hoodie on, cocoon, put mys My AirPods in, and I'm, I'm like done. Done to the world. So, black hat.

What, what are your early impressions? I mean, I know you've just kind of been here doing mostly interviews and seeing some folks, so what do you think? Yeah, Well, you know, just since I haven't been down to the floor or anything, don't see that big.

Oh my God, there's a ton of people here. And the elevators are busier than ever, than as much as any other big conference that's been here that I've seen. You know, there's a lot of discussion about application security, a lot of discussion about cloud security, a lot of discussion about ai.

Yeah. Everybody wants to talk about ai. And someone this morning, uh, had had a good saying, it's your c e o or board will come to you if they haven't already, and say, well, not, what should we do?

What are we doing? That's right. And I think everybody's just been so kind of captured Yep.

By surprise of how big, uh, generative AI took over so fast. Yeah. Dialogue.

Yeah. What, what's interesting to me, so I have been down on the show floor a little bit, it felt, again, a lot like r s a not at the same scale, but mm-hmm. A lot of blinky lights and very big boots, and you, you know, you kind of sit there and go, I'm pretty sure that's not that big of a company, and that's a pretty big booth.

And then I start doing the math in my head going, eh, are we in a little bit of a slowdown here? So, you know, I can't say that everything, you know, kind of makes sense from that standpoint. Yeah.

And I do think I'm hearing about more and more companies really scrutinizing their Oh, absolutely. Event spend and the like. But what's interesting is that so many companies here this week announced generative AI capabilities.

They did. Yeah. Right.

But between, you know, again, whole mess of companies not gonna go through the list. Um, but that's interesting to me, right? Because yes, we've been talking about generative AI for a long time.

It's not like it's brand new technology, but it really hit the common mass market mindset mm-hmm. Seven, eight months ago. Mm-hmm.

Right. And now folks have things rolling off of the assembly line, y you know, that, that utilize this technology. I think that's very interesting.

Um, and I also question as to whether it really works or not. Right. You know, how much of this is just general, it's really marketing stuff Would sort of show, you know.

Exactly. You know, it, it's, I think one of the things that might be representing is because of the advancements made generative with large language models. I'm not saying it's easy, but it's not that hard to get started and start adopting and adding some basic capability to your, whether it's just the natural language interface to what your data or whatever it might be.

But, um, you know, that that's not usually true. It's like zero trust. How are we gonna do that?

That's a much grander, bigger strategy. Of course. And it's, uh, interesting that the technology hits this fast, but also shows up in marketing.

Yes. And, and then you start to see kind of rules of the road, right. Rules of engagement.

So every company pretty much is a software company in some way, shape, or form. Mm-hmm. So one of the software companies that I work with, um, recently sent out to all of the employees a basically a, a, a policy for ai mm-hmm.

Which was surprising. Right. And, but I guess I shouldn't be surprised ultimately, but to actually see it in my inbox, it was kind of surprising and it was really focused on, you know, here are dos, here are don'ts.

Right. You know, obviously don't send proprietary data, don't send, you know, don't put, you know, kind of our code up there and, and, you know, other things don't have, um, a premium subscription unless you use your corporate email address. Mm.

Right. So things like that just to provide some trackability from that standpoint. Mm-hmm.

But again, I do think that a lot of organizations are gonna need to start thinking about how do we define how we use this stuff as well if they haven't already. And I suspect a lot of organizations have already, You know, and everybody's wondering, you know, thinking about what are, what's gonna change in terms of the attackers, the threat actors, how are they gonna Yeah. If they aren't already, what new things might they do?

I think the, the sort of low hanging fruit, the obvious one is, is phishing. If you can, I mean, they're already very good. It's hard to tell a lot of phishing emails today.

Imagining a phishing attempt when they've read all your public documents. They've plowed that into a, a, a, a domain specific general model model, lar large language model. And now writing emails as you, I think that's kind of the next impersonation in text.

Well, we really haven't had something like that. Well, We haven't, and I can tell you most of the phishing emails that I get of late anyway are horrible. Yeah.

Right. So they can't, there's a lot can a lot worse. So a lot more bad.

Yeah. Yeah. Right.

So, you know, and again, whether it's the fact that you don't have natural, uh, you know, English speakers, obviously I'm getting a lot about Just grammar would help, but Right. Grammar, you know, grammar will help. You know, no typos.

I mean, you, you know, things like that where you look like, oh man, this is crap. Right. You, you know, and, and it's, it's easy to see it will get better, right.

From their perspective. Right. Worse from the, you know, kind of detection standpoint.

Mm-hmm. But it really is about trying to understand how it impacts everything. So you, you know, you mentioned Z T N A as an, as an architecture, right?

Mm-hmm. Zero trust network access as it leads into ssss e Right. You know, how are you gonna start to use, again, models to figure out who should be able to get to what, right.

You, you know, we were talking to one, one company, they haven't really launched yet, so I can't say specifically who it is, but they can analyze just a swath of telemetry about what's happening on the network and derive micro-segmentation rules. Mm-hmm. Right.

Based upon, you know, again, the training of a model that they've built. So we we're, we're gonna see a wide ranging impact to this technology over the next, uh, you know, 18 months to, to two years. I can't even tell you where it's gonna go and how it's gonna end up because we are in uncharted territory.

But it's gonna be fun. But again, you're gonna come to some of these shows like Black Hat and it's going to be very blinky and there's going to be a lot of flashing things at you. Mm-hmm.

Uh, and you really have to determine what's real and what's not real, because doing this stuff at scale is much different than seeing a demo or, or, or watching a PowerPoint Stuff, writing an email or whatever. Yeah. It's, it's, it was interesting, the, the the example that you gave that, you know, we can't talk about yet.

Um, a world where AI is helping us adapt to the changing world seems like a very exciting prospect for us. So imagine yes, it can now create your micro-segmentation today, but it also can do it six months from now. That's right.

And two years from now is your infrastructure, your cloud, your apps, all of partners, all of it changes. Right. At Some point you kind of continue to manage and monitor the tele, the telemetry that comes in and recommend changes in line, right.

Or in flow. Exactly. Or at some point While you're going Make those changes, right.

To the degree that you get comfortable. So that's a productivity game. I mean, that, that's a game changer, right?

Well, but it's also, you know, productivity, but it's also efficiency in terms of how the network works, that you don't have these inefficient configurations because things are changing. Yeah. So it'll, it'll be interesting.

And again, now that everything's programmable and, you know, we can really start to make a lot of those changes within the environment, um, it, it, it's gonna be exciting. I mean, it really is gonna be exciting, but as always, being a security person, you gotta make sure that you understand how these things work, what your guardrails are, um, make sure you have the ability to roll back and, and recover your environment if anything does go wrong. Mm-hmm.

You know, data protection's still an even greater issue with ai, right? There's the whole copyright kind of issues, but I think everyone's worried of, you know, analyst business, you know, M b a person give, comes and uploads your customer database into some model somewhere, and poof, now you've lost it all. And in a way it's kind of taking ransomware away from, you know, the, the data lost from The right and just giving it the threat Actors.

But I think exactly now how to get it back. I think that's still a major concern. People are like, I can't lose my data.

We've gotta protect that. Right? So, so you're gonna see, and, and when you look at what AI's strategy is for ex, I mean, uh, a w Ss, sorry, AWS's strategy is for ai, it's not necessarily to roll out a consumer oriented offering, but it's to give customers the tools to build their own models in a w s, right?

Mm-hmm. Using Amazon Bedrock or SageMaker or something along those lines, right? You have folks like Databricks that are publishing, you know, kind of how they build their models and the toolkits to do that within their environment for that very reason, which is, yes, we want to use this technology, we can't risk putting it out there within one of the public services.

So we're going to use one of these platforms to basically bootstrap the ability to build our own l l m model and, and kind of leverage the internal resources that we have. Um, so yeah. So you, you know, many years ago folks asked me what, you know, what should I focus on?

And at first I said, do networking, right? And then I said, do security, and then I said, do application security, because that's where things are going. Now, if you can become AI and not just a prompt engineer, but you, you know, if you're technical, you know, learning how to train those models and learning how to, you know, really optimize the environment, uh, I think you would have a bright future ahead of you.

There's a lot of resources to do that. I mean, everybody's kind of in the sharing mode right now. Like yeah, I'm doing my first taking my art data.

It may not last, but yes, It may not last, but there's a lot of, you know, really easy to, you know, set a pineapple, you know, there's your vector database and poof. That's right. You're o off and running and what model do you use from, you know, hugging face and all that, those kind of resources.

That's right. So interesting. Mostly about AI as always.

So it seems like we talk about that we Can't avoid it every, Every third or second episode on that front. What will be interesting, you know, is we move forward to see at R S A and then at Black Hat again next year, is the degree that, um, folks like Informa, who's the organizer of Black Hat, start to really kind of realize that this isn't the before Covid. Mm-hmm.

It felt crowded because the elevators were crowded. If you're on the floor, I don't think it's anywhere near where we used to be. Right.

You know, so will they get, bring the prices down to a realistic, you know, kind of area. I mean, obviously, and if you, and you've read any of Alan's, you know, kind of screeds on social media and Informa did not give any of us Yeah. Um, credentials, right?

I had credentials because I'm a trainer, but they wouldn't give any press or analyst credentials. And we are analysts and we are press, so they're really kind of closing ranks. What's Wrong with, what's wrong with this pitch?

Well, I mean, again, they're closing ranks and, and, and you just gotta wonder to what degree that's gonna impact people's ability to want to come here to announce news, uh, at a show like this. So, you know, we're in a transition, right? With how folks do marketing in general, how a lot of these shows and big large scale events, you know, play out.

So it will be interesting to see over time, whether you know, Mr. Or Ms. Market prevails, and you'll start to see the prices, you know, come back into mm-hmm.

Alignment with where perceived value. Is it an experiment or is it a bold step? You know, you Yeah.

Yeah. Well, I think being able to get people to pay for it now is a bold step. It is.

But those commitment, a lot of 'em are made many months before this too. Of course. Right.

So it will be interesting. So we'll take a 10 by 10. No, you'll stick with that 40 by 20 this year.

Yeah. And, and we'll see, you know, what happens next year in terms of, you know, people's willingness to wanna spend that amount of money. Mm-hmm.

Well, and, and people are talking about like San Francisco not doing conferences there because of the economic impact and how much downtown has changed. Yeah. Vegas seems to be the venue now.

It does. I I have a standing seat on once a week on a flight out here it seems Like. Yeah.

Well, you know, between restaurants and conference facilities and all that. I mean, it really does make sense. Yeah.

But it doesn't make me happy. Not at 112 degrees. Doesn't Yeah.

In the Shade Man. In the shade. Mitchell, thank you.

Really great to be able to do this. You too, man. In Perf in person, right?

Live mono. It is. Um, and usually we're like having a beer or something, you know, we're sitting this close together.

That's right. Exactly. Maybe that'll be later.

Later. Exactly. So good to see everybody.

This is Mike Rothman for Textron Research Review. We will be back next week with another show.