Cybersecurity Today: AI—What's Holding You Back? (Weekend Special) Summary

Release Date: November 30, 2024

In the "AI: What's Holding You Back? Cyber Security Today Weekend Special" episode of Cybersecurity Today, host Jim Love engages in an insightful discussion with technology expert Marcel Gagne and cybersecurity professional John Pinard. The episode delves into the intersection of artificial intelligence (AI) and cybersecurity, exploring the challenges, misconceptions, and strategies businesses face in adopting AI securely.

Introduction to Project SYNAPSE

Jim Love opens the episode by introducing Project SYNAPSE, a series focused on AI and generative AI's implications in cybersecurity. He welcomes Marcel Gagne, an author and tech enthusiast with extensive experience in open source and Linux, and John Pinard, a seasoned cybersecurity expert.

The State of AI Strategies in Businesses

Jim Love kicks off the discussion by referencing a Cisco report highlighting that 92% of Canadian companies have an AI strategy or are developing one, surpassing the global average of 61%. However, only about 7% feel fully prepared to deploy AI effectively. Jim emphasizes the critical link between strategy and action:

Jim Love [01:43]: "What's the point of having a strategy if you're not going to do something with it?"

John Pinard elaborates on this by distinguishing between corporate strategies—like implementing Microsoft Copilot—and individual or departmental strategies that determine specific use cases within the organization:

John Pinard [03:13]: "There's two types of strategy. There's a corporate strategy... Then there's the individual or departmental strategies now that we have AI in place."

Overcoming Security Fears and Misconceptions

The conversation shifts to the fear surrounding AI security, which Jim believes hampers full-scale AI adoption. Marcel challenges the oversimplified view of AI as a singular entity, emphasizing its multifaceted nature:

Marcel Gagne [05:07]: "AI is not a single thing. There are countless variations of this thing... trying to focus on AI by assuming that you're focusing on a single thing, I think is a terrible mistake."

Jim shares an example of AI positively impacting cybersecurity by uncovering a zero-day vulnerability:

Jim Love [06:51]: "The whole point of that was I thought of that as a really useful example of how AI could be used in cybersecurity."

Marcel critiques the misleading headlines that conflate AI with vulnerabilities, advocating for clearer communication:

Marcel Gagne [07:19]: "Google AI uncovers World's AI Discovered Zero Data Vulnerability... It's not clear just from that headline."

Data Security and AI Model Vulnerabilities

A significant portion of the discussion centers on data security within AI models. Jim references a Stanford study demonstrating that it's possible to extract training data from AI models, raising concerns about information leakage:

Jim Love [17:30]: "There's a study done from Stanford with training data... they were able to extract documents out of the AI intact."

Marcel draws parallels between AI data handling and human memory, highlighting the complexity of completely erasing information from AI models:

Marcel Gagne [22:59]: "If the model is able to continue learning, information continues to develop. We wanted the model to be able to access the Internet."

Strategies for Secure AI Implementation

John Pinard discusses his company’s approach to secure AI deployment by utilizing Microsoft Copilot within a controlled environment:

John Pinard [16:19]: "We've decided that's our starting point... it stays within our own tenant."

Marcel suggests running local large language models (LLMs) to maintain data privacy, advocating for solutions that keep sensitive information on-premises:

Marcel Gagne [24:38]: "You can run a number of local large language models... you can use your own private LLM inside the office."

Jim underscores the importance of data protection measures and internal sandbox environments to safeguard company information:

Jim Love [26:55]: "I've got one less thing that keeps you up at night."

The Reliability and Accuracy of AI Outputs

The trio examines the accuracy of AI-generated information and the necessity for quality assurance (QA). Jim shares an anecdote about AI miscounting the letter 'R' in "raspberry":

John Pinard [30:53]: "When I talk about having to QA things that come out of AI... it's check important info."

Marcel emphasizes the need for critical thinking and information validation when utilizing AI tools:

Marcel Gagne [29:41]: "Thinking critically... we don't reinforce that anywhere near enough."

Jim draws attention to the importance of distinguishing between critical and non-critical tasks, suggesting that AI can handle simpler tasks with minimal oversight:

Jim Love [28:51]: "You have to understand the risks of providing information."

Training and Developing Critical Thinking Skills

The conversation highlights the importance of training in critical thinking to effectively interact with AI:

Marcel Gagne [29:41]: "I would make mandatory... every year I would be teaching a course on critical thinking."

John Pinard connects this to prompt engineering, stressing that the quality of AI outputs depends on how well users formulate their queries:

John Pinard [44:39]: "If you ask a bad question, you're going to get a bad answer."

Marcel adds that modern AI models are becoming better at understanding natural language, reducing the need for intricate prompt engineering:

Marcel Gagne [44:58]: "The AI does a better job of writing prompts than you do."

Final Reflections and Future Considerations

As the episode nears its end, the panel reflects on the human-AI relationship and the necessity for humility and cautious optimism:

Marcel Gagne [47:22]: "Think of AI as an alien intelligence... we still have to be able to look at something even if 95% of the time it's going to be right."

Jim humorously likens AI to a knowledgeable yet overconfident teenager, highlighting the growing pains of integrating AI into daily operations:

Jim Love [48:20]: "AI as a teenager knows everything, tells you absolutely coldly that you don't know anything."

Conclusion

The episode concludes with a consensus on the need for balanced AI adoption—leveraging its strengths while mitigating risks through strategic implementation, data protection, and fostering critical thinking skills among users.

Jim invites listeners to share their thoughts and questions, emphasizing the ongoing dialogue necessary to navigate AI's role in cybersecurity effectively.

Notable Quotes:

• Jim Love [01:43]: "What's the point of having a strategy if you're not going to do something with it?"
• Marcel Gagne [05:07]: "AI is not a single thing. There are countless variations of this thing..."
• John Pinard [03:13]: "There's two types of strategy. There's a corporate strategy... Then there's the individual or departmental strategies..."
• Jim Love [06:51]: "The whole point of that was I thought of that as a really useful example of how AI could be used in cybersecurity."
• Marcel Gagne [22:59]: "If the model is able to continue learning, information continues to develop..."

This comprehensive discussion underscores the multifaceted impact of AI in cybersecurity, urging businesses to adopt informed and secure AI strategies while fostering an environment of continual learning and critical assessment.