Cybersecurity Awesomeness Podcast - Episode 177
Hello, and welcome to the Cybersecurity Awesomeness Podcast hosted by Enterprise Management Associates, an industry leading technology research and consultant group that provides deep insights across the full spectrum of technology and cybersecurity solutions. The Cybersecurity Awesomeness Podcast will take a deep dive into the security topics that are top of mind for information security practitioners, IT professionals, and technology business leaders. Join security expert Chris Steffen, vice president of research at EMA for some truly awesome conversations. Chris, take it away.
Speaker 2:Good morning. Good afternoon. Good evening. Welcome to the Cybersecurity Awesomeness Podcast. I am your host.
Speaker 2:My name is Chris Steffen. Joining me today, finally, finally, after seemingly months and months of trying to get him to come on my podcast is my colleague, the owner of EMA, Herb. He is going to take and give himself a quick introduction, and we're going to talk today about data. All the different aspects of data, how AI impacts data. I have recently had some interesting conversations about data integrity.
Speaker 2:Herb and I have clashing views on what data integrity actually means, and we're going to kind of bash through that a little bit and see where we end up. Really, really laid back conversation. I'm really looking forward to having this conversation with them. We've actually had it multiple times at this point. I wish I had just recorded those things.
Speaker 2:But doesn't matter. Here we are today, and so looking forward to having this conversation. Herb, why don't you give me an introduction? Tell me what you are doing here, and then we'll kinda take it from there.
Speaker 3:Well, I... Number one, long time listener, first time caller, I guess. It is great great to be here. I've... I I think I think I've listened to just about every one of these podcasts and and I enjoy them thoroughly.
Speaker 3:And great to I guess talk to your audience. So so I am Herb. I am the lead analyst of data analytics at Enterprise Management Associates. I identify as a lifelong data analyst. I've been doing this for about twenty five years.
Speaker 3:I got my scar tissue during the financial crisis, managing some of the largest mortgage databases in the country. I've seen all the data quality problems. I've worked with different types of organizations with different types of data. So I love data. I love finding answers to problems, and I love talking about data.
Speaker 3:So excited to see where this goes.
Speaker 2:Yeah. You are what we call a data nerd, and and that's great. We we need more data nerds in the world. I have recently run into an interesting problem that keeps on popping up, and it's something that you and I are uniquely suited to be talking about, and that's data integrity. And let let me start by telling you what I mean by data integrity to begin with.
Speaker 2:When when you start talking about how AI is being used in the wild, there are, of course, 50 gazillion use cases out there, and some of them are great. Some of them are just flat stupid. That's just the nature of how it's going to go. But one that is the most compelling that I keep on hearing more and more about is using AI as part of your GRC evaluation methodology. What that basically means for those in Smallville is that if I have a bunch of data that I need to be able to present a GRC type audit, control audit, whatever have you, from an auditor perspective, whatever have you, I am using AI to aggregate that data, present the the findings of that data into a report that can then be consumed by the auditor to meet whatever due diligence.
Speaker 2:What we're finding, in one of the conversations is that the data is not always good. And it's not because the the the initial data is actually poor because it's not. To... That's to placate her. The the reality of it is is that the analysis or the aggregation of that data is somehow being mishandled or being screwed up and and call it whatever you want.
Speaker 2:Well, when you take and screw up your kid's history report about George Washington, the world doesn't come to a screeching halt and you move on, and that's just great. When you start taking and having falsified data on a 10 k report that's required for fiduciary responsibilities and whatever have you, that is a whole another thing. And so we're seeing this problem starting to crop up. It's not commonplace. It isn't all over the place.
Speaker 2:But as you start thinking about the tools that are available out there and the auditors that are using these tools, this is the kind of problem that exists, and this is the kind of problem that we're going to be facing here immediately. So when I talk about data integrity, that is part of that conversation. Herb, what do you think about that right off the bat?
Speaker 3:You know, I'm I'm gonna I'm gonna bring up a analogy that I absolutely hate. So so in in data, when we talk about definitions, when we talk about meanings, you know, the the the term is semantics. You know, you've got a semantic layer that defines your what each field means. And the problem, and you'll see it all over social media if you're if you're looking in the data space right now. The example that everyone uses is that if I wanna know what the revenue was, and I asked AI what what was the revenue this month.
Speaker 3:Well, does that mean customer revenue? Does it mean net revenue? Does it mean marketing revenue? Revenue is is a very broad term. So the problem I'm hearing is that when you go to AI and you give it a word, if it doesn't know exactly what that word means, it might go find it elsewhere.
Speaker 3:So it might find something that rhymes with it. But unless you have that strict definitional meaning, it's gotta be deterministic for the AI to follow. If there's confusion, you're gonna see problematic outcomes. And so Yeah.
Speaker 2:That's awesome. Thank you. And and I I agree with everything that you just said. So your I
Speaker 3:apologize to everyone for saying... For for using the revenue. I've got many other examples. You can check out my blog, but that one was the easiest in your in your in your example there.
Speaker 2:Yeah. And... Well, and that that actually works out really good. And and I don't I I I don't need to delve into that anyway, but I... It's the idea that it's not the data that is at fault.
Speaker 2:It is the model training that is at fault. And and so cross applying that to security related concerns, if you take and look at an agentic solution and its ability to take and deterministically do things in your SOC, it will do what you tell it to do. The question is, do you want it to do more than what you tell it to do? If the answer is yes, eventually... And and I think the answer is yes.
Speaker 2:I think you you eventually want it to be able to act as a adjunct to your tier one analyst or whatever have you. I think that that's ideal, but it's only going to do what you want it to do. It isn't going to do something weird beyond what you want it to do unless you tell it to do something weird beyond what you want it to do. We've been hearing a lot in the news lately about the various AI models that are out there taking and conducting their own attacks. And and I...
Speaker 2:Again, I I I wanna state this for the record. I have set... Said it multiple times. They didn't do that. They were given instructions to do something along those lines or or or some kind of freedom to do something along those lines, and that is how they interpreted that freedom.
Speaker 2:So here we are today, end end of twenty twenty six, and this is going to be a conversation that we are going to have probably for the better part of the next decade. How are you going to utilize some of these different AI models to do some of the the drudgery work that you need to do, not only with data, but in in the SOC, in just regular IT operations, in in data analysis, whatever have you.
Speaker 3:And and I'd argue that that AI is is data on top of data on top of data on top of data, and you need guardrails. So so, you know, going back before AI, we still had data quality checks. You had process checks that that just sat within the data analyst role. So so when someone came to me and said, what are my revenue numbers? I knew from looking at the person who they were and and what revenue numbers they wanted.
Speaker 3:And if I gave them the wrong answer, then they could yell at me about it. Right? We... As much as we might yell at our AIs, that that that doesn't matter. So the solution is, I think putting that similar architecture around it because whether it's AI in the security space, whether it's AI in the data space, whether it's AI in service ops, the word that you're hearing everywhere is context.
Speaker 3:So how do we tie all this stuff together? Well, what does context mean? It means five different things to five different people. So we need to get back to the foundations of we need to define the guardrails. That means we need clear definitions.
Speaker 3:We need that semantics. We need clear lineage. So I need to know where this is coming from. And more and more nowadays, I need to know who's asking and why. All of that framework fits into that contextual, you know, the the old, you know, an ontology knowledge graph kinda kinda framework where we're just categorizing the requests or we're categorizing the data or we're categorizing the reason that people are wanting to access the data.
Speaker 3:We're using that in order to guide the answers to the correct ones.
Speaker 2:Yeah. I... Again, great, great answer to that. And I I really appreciate that perspective. It it aligns with what we're talking about from a zero trust perspective.
Speaker 2:It aligns with what we're talking about best practices for guardrails. We, EMA, we, you and me, have actually conducted research, you know, basically saying, yes. This is what customers are interested in. Here's why they're interested in it, and you just parroted exactly what the responses were. You basically said, we are interested in having these guardrails.
Speaker 2:We are interested in in understanding why you want that data. We are interested in the entities, nonhuman identities that want that information and why they're using it and who authorized them to use it and what we're doing with that information after the fact, blah blah blah blah blah. This conversation that we keep on having over and over again. But I I really appreciate your perspective from a data, from from the data side because, again, we're not done having a conversation about how data integrity or the results of the data that we are generating through using AI is going to be used and how it being used is going to impact our business processes. At the end of the day, that's the conversation.
Speaker 2:I think that it it... To to Herb's point, I don't think it is a data issue. It is how we are aggregating that data, how we are permissioning the the retrieval and the analysis of that data, and then taking and doing something with it from there. Data is... To to paraphrase, data is data.
Speaker 2:It's a matter of what we actually do with it. And and and I think we have a long way to go to try to understand how we're going to protect ourselves using that data in a way that we can feel confident about, but also take and not have to have every single decision and every single bit of it be man in the middle reviewed, so on and so forth. That's where we are today. If if you were to ask me today about... You know, again, let's just use the hypothetical example that you gave her.
Speaker 2:If you were to ask me what the numbers were, so on and so forth, I can have an AI bot spit that out. That's not a problem. But for damn tooting, I'm going to take and double check those numbers to make sure they align with reality. If I don't do that, then I am... I feel that I am liable for any of the mismatching that could have come from that AI analysis being hallucinogenic.
Speaker 3:So... And I'll just give a quick quick anecdote anecdote here is that as part of my practice, I get hands on with as many applications as I can. I spend a lot of time with the conversational analytics that are going on out there. You'd be surprised how easy it is to get not just wrong answers out, but dangerous answers out. There's PII back there.
Speaker 3:If you're not specific and the AI is confused and this has happened to me, it will give you the PII back. And so, yeah, that that just... For for the audience out there, check the answers, ask the same question twice, see if you get the same answer. We've got plenty of data that shows that that that happens a lot less often than you'd hope.
Speaker 2:Yeah. I I agree with that. Before we wrap up, talk to me about some of the upcoming research that you're doing kind of in this space because I think people would like to probably know a little bit about that as well.
Speaker 3:Yeah. It was a lot of sort of what we're talking about here. These frameworks have been around for a long time. So so semantics is not new. Pathology is not new.
Speaker 3:Even context is not new, although it... It's it's grown and and and and it's expanded. The problem is that these things don't have standard definitions. So they've matured in the age of AI because we need them to guide the the AI to the right answers. However, the the tools vary, the implementation varies.
Speaker 3:Importantly, the organizational readiness varies. You and I have talked about this a lot. So the best tools, the best architectures are gonna fail in an immature organization if they're not prepared. So what we're gonna be looking at is in the frameworks that that we have semantics. We don't need to reinvent invent the wheel necessarily.
Speaker 3:In in the frameworks that we have of semantics, ontology, context, what are the the practical lessons that we're learning from, enterprises that are implementing these things, where are the problems, what problems are related to, what what architectures, and ultimately, how do we get reliable answers out of AI when we're putting it on top of our data?
Speaker 2:Yeah. I I hope you find those answers because I am interested in that research as well. It is... Again, I think it's fundamental for us to understand... Again, I'll I'll put a security spin on it.
Speaker 2:When we're taking and talking about trying to understand how to gain confidence in agentic solutions in your SOC or just agentic solutions in your operations environment, period, understanding that core information, I think, is critical. And we we have a long way to go before we really understand it the way that I would wanna understand it to be comfortable. So, again, I really appreciate your your perspective today. We will talk about this again. It was great to finally get you here on the podcast.
Speaker 2:It has been a long time coming. He is absolutely the data nerd that you think that he is in every possible way. And, again, you you should just listen to some of our conversations in general. They are as bad and nerdy as they get, but it is it is absolutely worthwhile to have an expert opinion based on something that is near and dear to all of our hearts, which is the data that runs our universe. So, Herb, again, thanks for coming on today.
Speaker 2:I hope this was interesting to everybody on the podcast. Again, we'll have Herb on here again eventually here sometime soon. Until next time, thanks for listening.
Speaker 1:Thanks, Chris, for all your great insights today. Make your next podcast awesome when you work with the EMA team on your organization's next project. Demonstrate thought leadership, differentiate your solution, and add the credibility of a third party expert to your message. Visit cybersecurityawesomeness.com to listen to past episodes.
