SentinelOne’s Gregor Stewart on AI in Cybersecurity

hi I'm James McGuire and on today's video we're talking about the role of artificial intelligence in cyber security along the way we'll take a deep dive into how to use AI focusing on the best strategies for AI and your company's security infrastructure to discuss that I'm joined by a major industry expert with me is Gregor Stewart VP of AI and machine learning at centenal one Gregor very good to have you with us today he great to be here James thank you so I think AI is really interesting I I'm concerned a little bit I think some companies view it as this sort of magic pixie dust just you know sprinkle some AI in the hardware the software maybe the networking and it kind of makes everything work better uh I'd like us to go a little deeper than that so I'll ask you how exactly does AI help cyber security and in particular where are the best places to use AI in your security infrastructure yeah it's a great question I also think that customers are right that they know that AI is a value right um but it only becomes um you know meaningful when it's used in specific ways right so in cyber security in particular um there like three ways it becomes valuable the first way is that um it enables perception right of uh you know circumstances you know uh attacks Etc that would otherwise be very difficult to detect or see right um with other means either people um you know or deterministic software right um and so the very flexibility of artificial int elligence over traditional software um and its ability to see patterns across um you know different time scales um it many channels uh Etc than than a person could right you know make it incredibly valuable right so for example you might see um you know a very slow moving attack right which uh essentially has a number of different components which if you were a person looking at logs right you know would be incredibly difficult to see uh and if you were a deterministic piece of software you might only catch small pieces of right but not be able to bring it into Focus as a whole so the first one is perception being able to see things that we otherwise can't see the second one is a kind of reasoning which is an ability to flexibly apply a policy all right um to the circumstances right so for example our policy is none of our sensitive data should leave you know certain elements of the um of our infrastructure right um and seeing that a certain set of actions is a uh you know an attempt at exfiltration that's the one that we said before but then how do I either stop it right or change configuration to prevent that right um is a um is is another aspect of uh the the the AI Advantage right so um your environment may be different from you know a more General one right um and may need specific uh parameters to be to be specified so that it can um you know that an attack can be rebuffed effectively let's say right and in the way in the past how this was done was that you would write these little bits of code right or no code in these sore type environments right um um but it was incredibly difficult to keep up to date as policy changed right now we have uh the opportunity to do this very flexibly in real time right and we'll get into that perhaps a little bit later right the third uh advantage of AI in uh security which is really a composite of the for two is uh what you might call speed of action right so the ability to see things um and the ability to flexibly apply a complex policy right in order to um either rebuff an attack or um you know or find ways to mitigate potential attacks right uh is the is probably the the chief Advantage there right um again ability of an organization to perceive problems and fix them very quickly is is at the core of being secure right the faster you can do that right um what is it the more preemptively you can do that let's say right um the the better you know speed of action I think does make make a huge difference uh on on the flip side what about some of the pitfalls of AI and cyber security and I know that it it may not be able to solve every problem every time the real question is what should companies be aware of as they deploy AI in their Enterprise security really two two key things the first one is the way in which AI is incor is incorporated into the workflow right so um I think uh it it can be difficult to uh make sure you're still getting the best value from Human judgment right when certain aspects of um of the work are automated right um and uh it can be that uh you know uh AI can detect many more things right than people can um can actually triage right so if all you've got is really good way of seeing potential threats right you don't also have um you know a way to help the the person triage those um those potential threats um that then you haven't really made the Enterprise more secure right and so you have to balance um you know the uh say increased efficacy of detection right to see um you know more stealthy attacks sooner right you know well before they you know bad things happen with the ability to figure out which things to work on right um and to assist um you know analysts in in getting those things uh done right so integration into the human workflow um and the second one is uh you know that the kind of additional Vector that it adds right to these kinds of systems right um so uh now I have sorry now I have an element which is um uh non in many cases non-deterministic right it's very difficult to know how it's going to behave let's say especially in uh in the most recent Incarnation you know llms Foundation models right they their ability to be creative right is is prized right um but that also makes them difficult to um uh you know keep track of and audit so um uh for example uh you know the uh assistant right you know can be jailbroken right and you can get them to say embarrassing things we've seen this in many different um uh you know uh spheres right um and those can have consequences like Canada's um you know uh having to honor right certain um you know fairs because their chatbot said said so so those are some of the those are the two main things integration into the human workflow and um and the inherent dangers of systems which are um non-deterministic right you know and the the needs to put additional um safeguards around them right right right makes perfect sense well all right let's let's talk about the Sentinel one cyber security offer offering let's drill down into that I mean what exactly is purple Ai and how does it improve a client's cyber security right so first of all um it focuses on helping um analysts do things that they do now right um and so an analyst will uh essentially one action one activity that they can under take is threat hunting right um so they want to go proactively into um the data that the system has been collecting and see if there are threats which haven't been detected right um you know perhaps there's uh you know notes on uh certain activity from a threat actor right they want to see if there are any indications right you know that weren't otherwise picked up right in the um in the environment and this uh requires them to understand uh three things at least what data is being collected the format that the data are in and uh the language in which you query that data right um and this is quite different right from the language in which you think about security problems right so you might say is there this kind of activity in something in any of these sources now I have to think about how I would cast that as a query right in a domain specific language right um so ours is called powerquery but there are many others you know Splunk has SPL right um and and so on and so you have to think in that language right um the intent that you have and in order to do that you also have to understand what data is there and how it's structured right in order to to effectively craft a query so just to summarize there often answering security related questions right that you do in the course of say threat hunting um requires you to translate your your natural thought into um a domain specific language and you have to have all this knowledge of the data set and it and its structure so one of the things that purple does is help you avoid having to know those things right and so you can stay at the level of intent you ask an language question it gets turned into a query um you know for the security data lake or singular Singularity data Lake as we call it now right and you get a response back now that response could be a very large table right so the next step is to take that information and to contextualize it and essentially summarize it right so take the important parts of it for that question that you actually had right and then um and then and try to answer the question let's say so if you say have I been targeted by finn2 a name threat actor right I'm going to say ah signs of fin2 would be this kind of activity or these um you know these indicators of compromise let's say right I'll go and search for any of those I'll bring it back and then ideally you would want an answer like yes or no right and then an explanation of the things that have been seen so this is this is the main flow right so you call this assistive right in that it's helping you do something that you've decided to do right um it's removing a bunch of knowledge and work that you would otherwise have to um undertake um Can can I ask you a question about that I think it's really interesting in that uh so it's sort of it's a natural language query uh if I'm correct and thinking that that means that someone who is May maybe a Security administrator who's really in a hurry can can handle that better or maybe maybe there's a junior person on duty that you know three in the morning so it really assists people in any number of ways that the natural language query really helps people that's right um You you hit on exactly the two um you know core use cases here someone who is less skilled right um or less knowledgeable more can can be augmented right and so they they they can they can be useful with um a little less skill not not with no skill right um you know and also a person who is able right who already is is experienced right certain aspects of query writing is still going to take even an expert um you know uh 15 minutes a time let's say right and if that can happen in a minute and be refined through natural language get through an awful lot more of this work one one last thing to say here is that um in in many ways uh uh the value of prol um sits on top of the value of the singularity data Lake one of the things that makes a conversational assistant possible is that the data system responds in conversational time and in many other prior platforms right and in fact many many modern platforms right um the response time is still too slow right to facilitate that kind of conversational approach right so in in many ways purple sits on top of sdl right and and much of its Advantage is derived from that right anything else we should know about purple how purple makes a difference for clients yeah so um not only does it um reduce the amount of time um you know required to get usable answers right you know from A system that you may not know much about right um but also uh would guide you um uh you know through suggestion um turn by turn right so you would ask a question you get a response and it would suggest um next steps if you like right which would nudge you in the direction of say a more comprehensive or precise investigation right of the of the kind that you're you seem to be undertaking don't quite say hey I'll do this investigation for you right now um but it is nudging you in a good direction right um a given best practice that um we have um you know in our database one other thing to say is that um it facilitates um the transfer of knowledge between people um and the collaboration of people um through this uh essentially context of what we call a notebook right so you don't just do your work in a little chat window right and it might save your chat or whatever you're doing it in what we what looks like um a data scientist notebook right because much of security analytics work right is very much like data science right it's a very specialized kind right um and so you can save these notebooks you can extend them later um you can share them with other um other analysts right um and they can be used as templates right for forther work right so they have forensic value they have educational value um and they have just generally communication value as follows right one one further things this second half right is that so this is more like co-pilot right um what about autopilot right can you actually lift up um you know this that burden from me so I can focus on you know the harder cases right so in the second half of the Year purple brings in more of that right where you'd say first of all um would say things like hey you actioned this item um items that are similar to this item right you I've got an alert right um what is it and I'm telling you you actioned similar alerts in the past asked in a specific way right do you want to do that again right um so a kind of work amplification or consistency right you action an item right you might say um and then it says Hey here are a bunch of other items right that you know are very similar do you want me to action those in the same way right um and and then hey you always do this do you want me to automate that for you right so there's there's an interim step there of again noticing how people work and then trying to increase increase consistency amplify their effort right you know and reduce the amount that they have to spend time on and then whatever is left over right um you want to put into the true Auto investigation mode where you say hey um given this alert and I'm saying that it's not something I can triage out right could you automatically investigate it for me so do what I would do right um in a flexible way right so again something like here is an access which looks suspicious it doesn't look like anything I would normally um I've I've actioned before um please do the following you know 20 um you know uh investigative steps right and then tell me what your recommendation is right so the idea is um we can help you as you do work that you've decided to do um we can help you by uh essentially taking work that you've already done and and spreading it over uh the additional things that look that looks like you have to do and then when it comes to the investigation um and actually doing it for you so that you're left with a decision to make right rather than a bunch of grind to do so the whole idea here over the um let's say the next 18 months right is to go from what is essentially a very high stakes grind if you if you miss even one thing that might be the thing right that um is is the cause of the breach right or the beginning of a of an incident right um and so it's an incredibly stressful and at the same time tedious kind of work right and so the idea is to get the analyst into this mode of validating work that has been done right and thinking thoroughly about um work that um you know is left if you like right does that make sense it does it does so the the system actually suggests some of its own automations yes so again you can observe people doing um you know the same thing again and again right on similar uh on similar alerts or or or similar um indications and suggest that these things be be automated right I'll give you an example would be um many many things um uh to do with identity uh you know the uh the response is to force the user to reauthenticate right we we're not quite sure if this is a problem or an issue but really since it's a lowrisk action we should just ask them to reauthenticate right and so for for many um uh uh um uh socks that would be the policy right you would say Okay anything like this force reauthentication and you want to have that as a um uh as a kind of observable automation that you have put in place now it's driven by a piece of intelligence which is it needs to be sufficiently similar right to these cases right that we um that we've judged should be handled that way right um so the AI there is just absorbing irrelevant variation right um if if that makes sense it does well I think the the really fascinating question is what about the future of AI and cyber security I mean it's it's really it's it's a question on the minds of of many managers certainly that you know Technologies are getting you you know hacky Technologies are getting more advanced even is is the good folks improve security what do you see when you think about the future of AI and cyber security I mean there there two kinds of exciting in some way that's a word you can use for this uh you know new risk right um and one of them is um this in principle undetectable uh deep fakes right so voice is probably already there um in terms of uh I mean there are examples in the in the literature now of people having phone calls from what what would seem to be the CFO right um and essentially sending millions of dollars right to the wrong the wrong place um and um because of the technology underneath there um again it's going to be very very difficult right to um uh reliably detect those um and um and video obviously in some ways looks fairly primitive now right you know but uh given you and I are talking uh you know in this way and you doesn't have to be particularly High uh quality right um you know to to get through say a zoom call in some cases right so this is this is difficult right because um uh this is one way that we've used to protect ourselves right you know from uh to validate if you like right um that we're we're being communicated with by the people that we expect to be so so one thing we're going to have to evolve as new ways of essentially authenticating one another right it's not that they're not available it's not that they're not um you know they're already but we don't use them habitually we've relied on right the short the shortcut of um you know seeing one another and hearing one another so that's one thing that's kind of exciting um in principle like uh you know in in um undetectable right you know spoofing if you like and the second one is um this being used in a way to radicalize people in a very granular way right um which uh if you think about uh the uh the ERS we're often worried about people's credentials being compromised right so that uh you know leaks can occur because attackers can get in and then you know move laterally and and and grab other credentials and then exrate information right but you know we there are key examples of where people just do that right they don't they don't need to compr they do it themselves right you know and I'm thinking of Manning for example on in in the military right you know in in the recent past right where that person just felt you know essentially radicalized and then decided to leak a whole bunch of information right and often um you know that that was because of a long-term um issue but imagine if you were let's put it this way imagine if you were a trans person and you were working for Fir and then someone made a deep fake of the company's CEO essentially saying you know Dreadful things right about that and you were exposed to that in that moment you may think ah I'll show you right I mean that's not beyond the realm of possibility right and so where are the tools for defending against this kind of thing right um and one part you could say is the best defense is to have um you know everyone's views and um you know and stances well understood and grounded but that's not always possible in large organizations right so there's a real danger here of um rather than uh you know us having insecure systems right is us having an insecure corporate culture or um you know essentially human element of our organization there are no tools for that so a a a a fast developing um you know part of the um the the the field will be um essentially more like human security right how do we help people understand right you know when um these kinds of things are true to to feel grounded in our views and our and our values right um that that may sound soft but again we've seen the huge consequences right of people deciding right that this was a good course action because of the attitudes of you know either leadership or um or the organization as a whole well I think it's a it's a deep irony to be sure and that you're you're saying really the some of the protection against some of the technological threats is is is a better human culture exactly I mean and that shouldn't come as a surprise we often think of security culture as this thing of following processes and not doing certain things right and actually this is r large across our society is that what makes us secure is that we have social cohesion that we understand um you know one another's we share one another's um you know values um and we honor one another right in in specific ways right and that's what makes for resilient organizations right socially um and so it's no surprise that it's part of it's becoming part of security and and so in some ways uh I I suppose this would be a a final remark would be uh this is good for us to realize right that at the foundation of all of our security practice um you know are these these essentially social shared social norms and and so on and if we don't protect those um what is it then we are vulnerable right I think it's a really important thought a a very important thought uh Gregory I think you said it a lot of good stuff I certainly learned a lot um I hope you will come back and talk with us again sometime thank you very much I'd love to James thank you

This transcript was generated automatically from the video's captions and may contain errors.