Mike Woodward (12:55)

Foreign.

Dave Bittner (13:02)

Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off Mike Woodward is VP of Product Management for App Security at Digital AI. I recently caught up with him to discuss minimizing risk when implementing AI.

Mike Woodward (14:23)

I think we see lots of enthusiasm. We see less knowledge about where it might help. I think we're kind of in the let's kick the tires on some things, do some experimentation, figure out what makes sense. And probably depending on the size of the organization, let's not try to do everything at once. So you know you may be trying it in, you know, one division or trying something with your engineering team, the DevOps folks may be trying something else. But figuring out what's going to make the most sense for an organization overall is, I think, where we are right now.

Dave Bittner (15:05)

Well, you and your colleagues there have some recommendations for folks to approach this in a secure way. What are some of the things you all recommend?

Mike Woodward (15:14)

So there are some very normal things that you would think of when you're thinking about any kind of system. So implementing robust authentication and authorization, you know, you certainly want to make sure that who you think you're interacting with is really that person or that system and that they're only able to do the things that you expect them to be able to do. I mean, that's regardless of what kind of system you're doing, that, you know, is always a good place to start maintaining kind of the integrity and the privacy of your system. So using appropriate controls on your systems and encryption for passing packets back and forth, you can prevent man in the middle attacks, things like that, for those systems doing regular updates and patches, you certainly want to stay up to date with your Software. And when CVEs come out, make sure that all of those have been taken care of in your systems. And those are some of the kind of the things that everybody does everywhere or should do everywhere. But then when we get to AI, there's some things that are maybe a little bit more special in terms of securing the models and the algorithms. These are, you know, the intellectual property, the secret sauce, you know, that some of the threat actors would want to get to. And so making sure that there's not a way in the system for somebody to exfiltrate that data. When you think, you know, that you think that they shouldn't be able to, you want to make sure that they really can't. And also proactively monitoring your systems to make sure that anomalies show up. If all of a sudden you see a lot of data going out, when you expect data to just go out in paragraphs at a time or something like that, those things should be monitored so that you can catch it and stop it, so you can investigate it.

Dave Bittner (17:30)

How big a part do you suppose that user education plays here, reminding folks to, to be careful what you put into that AI system?

Mike Woodward (17:41)

Well, it depends on who you're trying to protect at that point. The users certainly need to know if their data is going to be held confidentially. Certainly you don't want to be interacting with a pseudo AI or imposter AI and be giving Health information, personal information of whatever sort. And so I think we need some of the same kind of campaigns for interacting with AIs that, you know, many organizations have for identifying phishing attempts or something like that. So that, you know, you just have to be a little bit on the lookout for things that, you know, seem a little bit suspicious. So certainly things like that.

Dave Bittner (18:32)

It seems to me like there's this tension right now between people's understanding that there are security issues with AI, but then also this desire to use it for as many things as possible. Or else risk being left behind.

Mike Woodward (18:49)

Yeah, the risk being left behind. You know, nobody wants to think about that. You know, this is, this is arguably the biggest wave that we've had in a long time. And if you want a good ride, you're going to have to make sure you catch this one. But again, in that experimentation phase, the generative AIs have not been available in the mainstream for very long. People don't know exactly what to do with it. They don't understand exactly how it's going to help them or how much it's going to help them. They also have probably visions in their heads of, you know, the Matrix or something else. And not knowing, you know, is. Is AI going to be our ultimate downfall? So all kinds of things that, that are kind of personal intrinsics come into play here when people are thinking about what to do with it and how fast and what to trust it with.

Dave Bittner (19:50)

Do you have any recommendations for the security folks when it comes to communicating to the powers that be in their organization? They're seeing that enthusiasm come, let's say, from the board of directors, who sends down a mandate that it's going to be AI all the time. How do you balance that with the real world need to keep things safe?

Mike Woodward (20:11)

Well, there are probably some things that you can do, and it's like, okay, what are we trying to accomplish with AI? And, and make sure that, that we've, we're able to look at the results a little bit down the road and say, are we getting what we thought we were getting for our investment, for one thing. Another thing is if you're starting to look at, you know, vendors to make sure that, that you vet them properly, you know, you work with your legal team and find out what we can do and what we can't do in terms of consuming various AI models and sharing or not sharing our data with the wider population, there are several things there that I think you can do that maybe just tapping the brakes a little bit and alerting maybe that board of directors. That AI holds a lot of promise, but it's not a silver bullet and it's not something that you can just say, oh, just turn it on and we'll be good all over.

Dave Bittner (21:19)

Our thanks to Mike Woodward from Digital AI for joining us. And now a message from our sponsor, Zscaler, the leader in cloud security Enterprises have spent billions of dollars on firewalls and VPNs, yet breaches continue to rise by an 18% year over year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public facing IPs that are exploited by bad actors more easily than ever With AI tools, it's time to rethink your security. Zscaler Zero Trust AI stops attackers by hiding your attack surface, making apps and IPs invisible, eliminating lateral movement Connecting users only to specific apps, not the entire network Continuously verifying every request based on identity and context Simplifying security management with AI powered automation and detecting threats using AI to analyze over 500 billion daily transactions hackers can't attack what they can't see. Protect your organization with Zscaler Zero Trust and AI. Learn more@zscaler.com Security I can say to my new Samsung Galaxy S25 Ultra, hey, find a keto friendly restaurant nearby and text it to Beth and Steve. And it does without me lifting a finger so I can get in more squats and anywhere I can. 1, 2, 3. Will that be cash or credit? Credit. 4 Galaxy S25 Ultra the AI companion that does the heavy lifting. So you can do you get yours@samsung.com compatible select apps requires Google Gemini account Results may vary based on input. Check responses for accuracy. And finally, researcher Jason Jacobs assigned himself a weekend project to look for the longest and most complex WI fi passwords out there. As you do, coming through a data set of over 31 million actual Wi fi passwords people have actually used, Jacobs came up with a scoring system to rank length and complexity. He set his script loose on the data set, sat back and waited. In terms of length, number one was supercalifragilisticexpialidocious respect. But then there were others. A random string of numbers and letters that looked like an encryption key. A weird mix of words that Jacobs assumed was someone's attempt at speaking alien. And finally, something that looked suspiciously like a NASA project name. Turning to complexity, the number one most complex WI fi password wasn't just a password. It was an actual hacking attempt. Someone somewhere set their WI fi password as a full blown JavaScript hacking script. This means that if a badly built system ever tried to store it without protection, it could actually trigger a security exploit. This is cyberpunk level trolling. Runners up included the scientific name for a chemical compound and a mix of words that sounded like a German hacker's email address. So what did Jacob's weekend project teach him? People use some wildly creative passwords and some terrifying ones. Someone actually thought using a cross site scripting attack payload as their WI FI password was a great idea. Stay safe out there friends. And that's the Cyber Wire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilby is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.