AI is changing the cybersecurity threat landscape

0:03Welcome to Practical AI, the podcast that makes artificial intelligence practical, productive, productive, and accessible to all. If you like this show, you will love The Change Log. It's news on Mondays, deep technical interviews on Wednesdays, and on Fridays, an awesome talk show for your weekend enjoyment. Find us by searching for The Change Log wherever you get your podcasts. Thanks to our partners at Fly.io. Launch your AI apps in five minutes or less. Learn how at Fly.io. What's up, nerds? I'm here with Kurt Mackey, co-founder and CEO of Fly. You know we love Fly. So Kurt, I want to talk to you about the magic of the cloud.

0:44You have thoughts on this, right? Right. I think it's valuable to understand the magic behind the cloud because you can build better features for users, basically, if you understand that. You can do a lot of stuff, particularly now that people are doing LLM stuff. But you can do a lot of stuff if you get that and can be creative with it. So when you say clouds aren't magic because you're building a public cloud for developers and you go on to explain exactly how it works, what does that mean to you? In some ways, it means these all came from somewhere. Like there was a simpler time before clouds where we'd get a server at Rack Shack and we'd SSH or Telnet into it even and put files somewhere and run the web servers ourselves to serve them up to users.

1:25Clouds are not magic on top of that. They're just more complicated ways of doing those same things in a way that meets the needs of a lot of people instead of just one. One of the things I think that people miss out on, and a lot of this is actually because AWS and GCP have created such big black box abstractions. Like Lambda is really black boxy. You can't like pick apart Lambda and see how it works from the outside. You have to sort of just use what's there. But the reality is like Lambda is not all that complicated. It's just a modern way to launch little VMs and serve some requests from them and let them like kind of pause and resume and free up like physical compute time.

2:00The interesting thing about understanding how clouds work is it lets you build kind of features for your users you never would expect it. And our canonical version of this for us is that like when we looked at how we wanted to isolate user code, we decided to just expose this machines concept, which is a much lower level abstraction of Lambda that you could use to build Lambda on top of. And what machines are is just these VMs that are designed to start really fast or designed to stop and then restart really fast or designed to suspend sort of like your laptop does when it closes and resume really fast when you tell them to.

2:30And what we found is that giving people as primitive is actually there's like new apps being built that couldn't be built before, specifically because we went so low level and made such a minimal abstraction on top of generally like Linux kernel features. A lot of our platform is actually just exposing a nice UX around Linux kernel features, which I think is kind of interesting. But like you still need to understand what they're doing to get the most use out of them. Very cool. OK, so experience the magic of Fly and get told the secrets of Fly because that's what they want you to do. They want to share all the secrets behind the magic of the Fly cloud, the cloud for productive developers, the cloud for developers who ship.

3:09Learn more and get started for free at fly.io. Again, fly.io.

3:32Welcome to another episode of the Practical AI Podcast. I'm Chris Benson. I'm a principal AI and autonomy research engineer at Lockheed Martin. And with me today, I have two guests that are going to join in the conversation. They are both from BlackBerry. One is Gregory Richardson, who is Vice President and Global Advisory CISO at BlackBerry. And there's also Ismael Valenzuela. Did I get that correct? Yes. Thank you, Chris. And I normally have Daniel for that. And he is Vice President of Threat Research and Intelligence at BlackBerry. Gentlemen, welcome to the show. Thank you so much for joining.

4:10Honor to be here, Chris. Thank you. Thank you, Chris. Really glad to have you. We're going to talk today all about security and threats and issues like that. I know that there's a blog post to get us started, and I'll let you guys kind of take it from there, that you have on the BlackBerry blog that was the AI standoff, attackers versus defenders. And I know Daniel was the first person to see it and said, we got to get these guys on the show. And then ironically, he is not able to get here today. And I know he's disappointed about that. But wanted to kind of start off and kind of can you tell us a little bit about the topic in general before we dive into the specifics and the landscape and who does it affect and why should they care?

4:58So maybe it has to do a little bit with our backgrounds as well. Right. So I cannot really say I'm an expert in AI. Well, I cannot really say I'm an expert on anything. And the more I spend time in this industry, the less you feel you know, right? But I can say my career has been mostly dedicated to cyber defense. I started on the offensive side, but then I quickly moved into the, well, not quickly, but over years, I moved into the defensive side. So I've seen both sides and I still like to, you know, pick on the offensive side to learn from it. I call that think red, act blue, right? Think as an attacker to become a better defender.

5:34So obviously, when I was writing about this, I had to bring the AI flavor to it. Is AI going to represent an advantage to attackers or defenders? And we usually get that question. So I wrote this from a cyber defense perspective, and that's what you see there. So before we dive fully into the article, what was driving the need? What are you seeing? You guys both at BlackBerry, there's clearly a need driving, addressing cyber. Tell us a little bit about how you see the lay of the world from a cyber standpoint and what it is that, you know, what's the problem you're trying to solve in the large?

6:14Yeah, let me give you the contrasting kind of perspectives, because I actually didn't know that Ismail, who I've worked with for many years now, even at different companies before BlackBerry. I didn't know that you started on the offensive side and then switched to the defensive side. I am very much the opposite, well, except for the switch. I started on the offensive side, and I remain on the offensive side. The part that I am most intrigued by and always have been is what I call, well, what's called attacker ontology. So I've always wanted to understand what makes the attacker behave like an attacker so I can better defend.

6:53But my primary areas of research and areas of work and my primary focus has always been trying to anticipate what the attacker is going to do so that I can help our clients strategize, et cetera, et cetera. It's always been like even before, and just from an AI perspective, cybersecurity has been using AI for well over 20 years. I'd say probably 30 years almost. So it's not as novel as it is to the average layperson. But even before the popularization or the democratization of AI that we've seen in the last two, three, four years with companies like OpenAI, etc., even before AI was so much in the forefront, I've been very intrigued with how we can build strategies that help customers, organizations, governments anticipate earlier what they need to be protecting against.

7:48And that's kind of where my perspective comes. So I didn't contribute to the blog. I believe it was primarily Ismail's blog and maybe Ismail and his team. But my perspective on the blog was very much how can we use AI to also help level the fields a little bit more. It's a constant battle with the feels going back and forth and kind of who's winning the race between attackers, cyber criminals and defenders. So anything we can use to help balance that out, that's always been my interest. I'm curious, before we fully dive into the AI stuff, can you describe, because we have a very AI-focused audience diversely in that area, but a lot of folks maybe have never been really addressing cyber themselves.

8:37And when you talked about that, the ontology, and kind of talked about maybe some of the motivators that, you know, what are these people out there? Who do they represent? What are they trying to do in a baseline, like with or without AI? What are we dealing with in the world? I remember, and again, I've been at this for a while, probably longer than most. I'm like your age, Chris, so I'm approaching 60 years old. Yep. Exactly. Old, curmudgeon-y. Get off my lawn. That's right. So I'm approaching that age, that scary age of 60, at least it's scary to me. So I remember a lot of things historically about the cybersecurity industry that give me perspective.

9:20One was, I want to say it was around 2010, 11, or 12, somewhere around there. It was the first time that I noticed in the FBI's threat intelligence report that they used to release every year. In that report around 2010, 11, 12, was the first time that they reported, the FBI reported, that profits derived from cybercrime surpassed, globally, surpassed profits from cybercrime. heroin, cocaine, marijuana sales combined. And for me, this was 2010, like I said, that to me was a tipping point. In my mind, I've built the narrative that right around then, or maybe a year or two, year or three before then, or after then, that's when criminal organizations focused in on cybercrime.

10:16And it switched from being the harmless hacker in the grandma's basement, thinking like a Kevin Mitnick type of a guy who kind of started off that. For those who are in the cyberspace, they know the name. He was kind of like a quote unquote harmless hacker. He was arrested. I think he might've been one of the first cases of a full-fledged arrest and conviction for cybercrime. But his cybercrime was always focused on what can I learn? What can I gain from these things that I'm illegally getting access into? It was less, if at all, it was not about what can I financially gain. Now, it is largely financially motivated.

10:58I'll let Ismail deal with this a little bit more because this is his forte. He runs our threat organization. But from my perspective, it is largely based on what can we monetize. Ismail, what do you have to add to that? Well, the first thing is I'm so happy to know that I'm the youngest one in the room. Okay. So it says me with a white beard, right? We're all showing it a little bit, but that's okay. We're on top of things, man. But yes. So as Greg says, my team, our job is to characterize the adversary and to translate that into, we call it countermeasures, right? So think about, you know, you're analyzing or your goal is to design a vest to protect law enforcement, for example, right?

11:39So we analyze the weapons, we analyze their tools, we analyze their motivation, how they operate. And then we take all of that and we use this information to design the most effective vest to protect against those bullets. But it's not just about the bullets. It's about who is using these weapons and what's the reason they're using them for. That's the motivation. That's really the key piece. And this financial motivation, as Greg has been saying, has been growing very fast. And that's why we all know about ransomware, for example. But there's a lot of other motivations, and maybe we don't talk about that much.

12:12Well, some of them we do. Spionage, nation states, the so-called APTs, advanced persistent threats, that we often see in the news, and especially right now around election times, there's a lot of talking about this manipulation of information by these nation state actors. These are very well funded, and typically they're the most advanced of all of them. But there's other motivations too. There's hacktivism. We have seen groups like Anonymous in the past, like many others, that they would target organizations just because they make money, I don't know, selling records. And they think that's evil.

12:48But at the end of the day, cyber is just a weapon. It's a weapon that can be used for good. It's a weapon that can be used for evil. Same as AI. AI is just one more tool in the arsenal of any of these people. So that's why I like to talk about the motivations because it helps us to understand what's the purpose of using a tool, in this case like AI, in this cyber world if you want. So how does BlackBerry, can you kind of layer in BlackBerry having kind of given us that landscape of what you're looking at in the world? And how does BlackBerry start layering into this? What are your interests in that capacity and what are you trying to accomplish?

13:28Good question. Well, so we have been in the world of securing communications for quite some time, right? And I think everybody remembers those Blackberry devices. We don't do devices anymore, but we do software to protect devices, not just phones, but also endpoints all over the world. and specifically my team, what we do is to, as I mentioned before, try to characterize these attackers to be able to protect customers, right? And this takes the form of products. It takes also the form of services from endpoint software to zero trust network access to high military-grade encryption to secure communications to even software to manage a crisis.

14:18It could be instant response, like the environment is on fire, the attacker is here, and we need to remediate that. Or it could be even like a natural disaster. So when we talk about threats, we just even go beyond just the cybersecurity threats. That's a high-level overview. I don't know, Greg, if you want to go deeper into that. I don't know if I'll go deeper. I might hang off of one of the branches. The side of BlackBerry that I'm maniacally focused on is really just, I want to say, purely the cybersecurity part. So obviously, BlackBerry does a lot of other things. We have our automotive and IoT section, segment that's very, very, very large, probably a billion-dollar business in and of itself with operating systems that run in any car that has anything digital in it, et cetera.

15:03The part that I'm focused on, though, is pretty much purely my area of expertise, which is cybersecurity. So what we've been doing from my side of the house is helping customers build their defenses in a way that allows them to do something that I call preemptive security. If you remember in my earlier preamble, I referred to, you know, we need to be able to predict what the attackers are going to do so that we can defend against it. I help my customers strategize around building those platforms, those tools, those combination of different tools to do exactly that. The nuance of it with cybersecurity is just because of organically how the industry has grown and VC investment and a million other reasons, we've sprawled very much into there's thousands of tools to get the job done.

15:59And there's probably thousands, if not tens of thousands, of different little aspects that need to be protected in the average organization. You might have, you know, endpoints, you know, the computers. You might have servers. You might have a network. You might have stuff up in the cloud. You might have operational technology or IoT technology. All different aspects that all need to be protected that all require completely different tool sets. That sprawl has made it difficult for customers to have a homogenous approach to how do we defend against it all. Ismail can probably talk more about one of the things that attackers do, I want to say very, very, very well, is attack the gaps between our tools.

16:46So if they detect that you have a great tool that is the foremost tool on protecting computers, your endpoints, but your network stack is a little bit weak, they're going to attack right in the middle of that network stack and gain access to the endpoints. Vice versa, if they see your network and your endpoint, rock solid, but you have a weakness over in the cloud, you're going to start seeing cloud attacks. What the industry has not been very good at that BlackBerry is trying to help resolve is how do we help customers pull all of that telemetry in to be able to get, as I said, a homogenous view of everything that's attacking them and everything they're doing about defenses across all those little silos.

17:28That's what I help my customers strategize on. And my customers vary from governments. I met with the government of Morocco a couple of weeks ago to large corporations, the biggest banks in the world, the biggest airlines in the world, et cetera, et cetera. And it just spans the range. But all of them have that problem. The most mature organizations have well-developed tools that are unintegrated. And the least, like the SMBs, which are also our targets, our customers, have oftentimes less developed security stacks. But the problem is the same. Even if they say, well, we can make an investment in this one little tool, then they have their gaps and they're not being able to ingest all of that intelligence that they have.

18:14It says something about the industry, and I'm going to kind of shoot at my own job now. It says something about the industry that a strategist at that level focused on those types of problems is even needed. Like you don't have that in the medical industry, as far as I know. You definitely don't have that in, for example, the automotive industry. Like there aren't integrators that need to help you with how to integrate, you know, your car to work properly. You go to Ford. You say, I want an SUV. They give you the whole SUV. They don't say buy the motor here and then go down the street and get four tires and go across the way and get a transmission.

18:52You glue it together and you make it work. They give you the whole thing. Cybersecurity doesn't do that. We don't give you the whole thing. So that necessitates a cross section of strategists like myself and the team that supports me to go out and actually help customers parse through this web of tools that they've built. You probably don't go to cybersecurity industry events. I do. Ismail does as well. Ismail speaks at many of them. The amount of vendors on the expo floor, I remember going to RSA 13 years ago or so. Handful of vendors. It was a small convention. Now, it's early. Thousands, 3, 4, 5 ,000 vendors.

19:3440 ,000 people last year. That's a lot. Dude, I thought it was big. I went to a conference called Jitex. holy spook almost a million people at Jitex at a conference talking about technology it was crazy insane the amount of boots I think was 40 ,000 vendor like insane that there's an appetite for all of these tools and customers are bobbling them up and it makes their environment more complex and that's where we oftentimes come in noisy too yeah there's a lot of noise this industry

20:23Okay, friends, here's what I love about Notion. And I'm a big fan of Notion. I think all the new improvements they've made recently with Notion AI built right in is just astounding. Being able to have your notes, your docs, your projects, your to-dos, your tasks, your dashboards, all the things in one single place, beautifully designed, and then add on top of that Notion AI with the ability to search, analyze, chat, and even describe to you how to build dashboards. You can ask it, hey, I want to do this. And it will help you build out a dashboard or a database or a template that makes sense for you, your workflows, your business, your orgs, or whatever.

21:02Notion really is the perfect place to organize your tasks, track your habits, write beautiful docs collaborate with your team there's just so much you can do with it and notion ai already has the context of all that work it's also connected to multiple knowledge sources it uses ai knowledge from gpt4 and claude to chat with you about any topic they can search across thousands of notion docs in seconds to quickly answer really any question you have about your context which is all of your Notion docs. They also have AI connectors. This is now in beta. Notion AI can search across Slack discussions, Google documents, Google slides, Google sheets, and even tools like GitHub and Jira.

21:45Those are coming soon. And the cool thing with Notion is it could be used by small teams, individuals, or even fortune 500 companies. It is a very scalable tool that can help you spend less time emailing, cancel more meetings, save your time searching for all your work, and reduce spending on multiple tools. And this helps everyone be on the same page. Try Notion today for free when you go to notion.com slash practical AI. That's all of our case letters, notion.com slash practical AI to try the powerful, easy to use Notion AI today. And when you use our link. Of course, you are supporting our show and we love that.

22:27Again, notion.com slash practical AI.

22:51okay so as you guys have watched the industry explode and you're and you're dealing with these things that other industries don't necessarily have to address. You talked about kind of just the sprawl of assets to defend and the gaps between them and the fact that there are so many tools addressing different components. I would imagine that's quite a challenge, which is one of the reasons I'm sure the industry has gotten as big as it is. As you're looking at that and you're starting to see these new things, and when I say new, meaning some of the more recent tools on the AI realm and stuff like that.

23:27As cyber experts, how is AI starting to layer into this ecosystem? How do you see that? What are the pros and cons, the risks and threats that it creates? Can you tell us a little bit about how those two converge? Yeah, as Gregor mentioned it before and explained really well that this is an industry that is always chasing the new shiny. right like what's the new thing that can solve all of my problems and there is no such a thing it's a lot more complex than that and every time that we try to find that single tool that silver bullet uh we often fail right because of a lack of an understanding of how all these things need to come together so we're we're in the middle of that hype and now the tool is of course ai right and i would say even more specifically llms uh generative ai because we know and you guys in this show know well that when we talk about AI, it's not one thing, right?

24:22It's a lot of different things. For example, at BlackBerry, we have been using for many years, coming from the Silence engine, from the Silence days, a predictive AI engine, right? We know we're talking about predictive machine learning, essentially. And I remember, well, I wasn't at Silence at that time, but some of my colleagues that were told me that they were at Black Hat, I think probably 2016 maybe 2016 or something like that, right? They were talking at Black Hat about this. And a lot of people were like, oh, boo, you know, that's not possible. You're selling smoke. You know, that's not the way you detect malware.

24:57Fast forward to today and everybody understands that you cannot fight malware with signatures, right? I mean, in our report, and we produce these reports on a quarterly basis, we talked about the latest increase in the last quarter. we're talking about a 53 % increase in unique pieces of malware, right? I think, I don't know if the audience is familiar with the concept of a hash or a fingerprint. You take a binary, a blob of data, and you create a fingerprint or a hash of that. And that says, okay, that's unique, right? Different hashes, different files. So we're talking about over 11 ,000 pieces of unique malware per quarter that we have seen with our telemetry.

25:37How in the world are you going to, create a database, maintain a database. It's an unscalable issue. It's not scalable, right? So predictive machine learning helps us with that. And it's been helping us for many years to have really, really good detection of these type of things. Now, LLMs can also be useful for different things. So once again, I think the summary is AI is a useful tool in the hands of defenders. It is also used by attackers, and we can maybe get into that if you want. But I would say that once we go over this hype cycle that we always have in this industry, we'll probably understand that it's just one more tooling in our arsenal and that we need to remain problem focused.

26:24Just because we have a solution to a specific thing, it doesn't mean that it's going to be the solution to absolutely everything. But of course, it helps. Yeah, I'll comment on that if I may, Chris. Sure, absolutely. Ismail touched a little bit. He kind of grazed over LLMs. And I'm glad you only grazed over it because of what I'm about to say. We think LLMs, as good as they are, and they have some excellent use cases and value, I think they contribute to a lot of the noise and the hype machines that we hear in the industry right now. I'll speak specifically for cybersecurity. I am not yet convinced of the utility, the usefulness of an LLM, particularly for its natural language ability, ability to process things via natural language.

27:12I'm not sure that that was the problem we had. I speak to psych analysts and chief information security officers literally on a daily basis. That's my job. I can't remember in the last 30 years doing this that a group of operators, SOC analysts, etc., have told me, you know what would be great, Greg? We don't know how to extract the data from our tools. If we could only say that in natural language, that would really help. That's not the problem. The people that are doing these jobs in the SOCs, etc., etc., are very adept at their tools. They don't have a problem communicating with the tools and writing a parsing command or a query or whatever to extract the data.