Collective Defense: Securing AI Through Shared Intelligence | Amazon Web Services

Key Takeaways

[Music] Welcome to the Executive Insights podcast brought to you by AWS. I'm Clark Rogers, director of enterprise strategy. Today's guest is Adam Morray from Arctic Wolf. Please join our discussion around recruiting security talent from non-traditional backgrounds, Agentic AI security controls, and framing security in the language of business. Please enjoy. >> Adam, thank you so much for joining me today. >> It's great to be here. >> Please introduce yourself so the audience knows all about you and and your role at Arctic Wolf. My name is Adam Marray. I'm the chief information security officer at Arctic Wolf. And uh you know I am actually a CISO. So I'm not a field CISO or evangelist. Sometimes uh because Artic Wolf is a security company, people think uh that I spend my time doing that. But actually I I spend my time protecting the company. So I own all aspects of security including physical security for the company. So that's what I do. >> That's fantastic. I've been really looking forward to this interview uh because you have such an interesting background and lots of transitions through it. So your career started off uh in the US Army and you're listed as a as a former Arabic speaker. I'm sure you still retain some of that. But then your very next role was at Disney Interactive. Can you tell me a little bit how that how that transition happened and of course we know what happens after that but uh really want to hear about that stark transition from the US Army to Disney of all places. >> I actually went uh and you know I was finishing up college late 90s early 2000s and back then there were no video game design degrees. It just wasn't a thing that existed. So, uh, at the university I was at, I was able to cob cobble together a degree that, uh, you know, made me competitive for that. And I actually got a job right out of college making video games at a studio in Salt Lake City. And you would have thought that, you know, got my dream job, I've got it made. But then 9/11 happened. And that changed everything for me. And so, uh, yeah, decided to join the US Army and did so as a counter intelligence agent. And so, uh, I served my time there. And then when I was getting out, I actually went back to the same studio and they got bought by Disney literally the next day. >> But then another transition happened. You you you left video game designing to join the Federal Bureau of Investigation. What what prompted that and what did you do there? >> Well, after my time in the military and I'd gotten to know some guys in the bureau in that time, uh it just seemed like a really good fit, but the application process is really long. And so I was able to work in the video game design job and just see if the FBI happened. And uh there actually it was ups and downs. I thought for a while maybe I wasn't going to get the job, but then they did offer me a position. So so I took it. It just the the application process took almost two years. >> If you had a primary function in the FBI, what did you focus on? Was it cyber security? Was it investigations or or other types of criminal investigations or what was it? So, I did do a smattering of lots of different types of cases from gangs to art theft to kidnappings. I mean, you name it. But my primary function was cyber. And especially when they figure out I had a technical background, which at the time was like, "Oh, you know what a mouse and keyboard are? Then you are a cyber special agent." They gave me tons of training. And that's actually where I got uh, you know, my cyber security background was from the incredible training that the FBI offers. You know, some of that is done through SANS. >> Um, but some of it's the bureau's own. Like I became a forensic examiner and that was training I got straight from the bureau. >> That's fantastic to hear. So, you eventually uh left the FBI and went went back to the private sector. What was the transition like going from the FBI where I assume you had access to all sorts of things from a cyber security perspective that I know lots of CISOs today would love to have and not have access to that in in the corporate world. You know, in the FBI, your main job is to catch the bad guys, right? Like go after the threat actors. Yes, you're there to help companies. Yes, you're help there there to help them recover. And there's lots of resources you can bring to bear to do that. But the main job is you're trying to deter these kinds of things from happening. And that primarily happens from, you know, figuring out who did it, getting attribution, and then going after them if you can. If it's criminal, arresting them. If it's national security, there's other tools that we can use for sure. And you're going from that mindset basically like I protect every company like the whole country right or you know wherever your squad happens to be you go from that to protecting one company but now you have to protect all aspects of it and you don't care as much about the threat actors typically you just want to protect the organization and you know prevent people if you can but detect and respond you must do protect the organization and that's it was a pretty big mindset shift and I I was ready for that. The second big thing is really understanding that this fits in the context of a business. You know, a business exists to be a business or an organization, a nonprofit, whatever it is. And so, you have to understand that mission statement and then create the right risk appetite and then focus the program to that level. And that's a pretty big transition because you have the luxury when you're an agent and you come into these investigations and you're like, you should do all the security things. What are you doing? You know, uh but then when you get there and you realize like, oh, I don't have money to spend on everything. you have to be very surgical about what you do. And so those two were big transitions. >> I love that. So at Arctic Wolf, how do you make how do you have those conversations with leadership? You maybe you want to make a particular security investment. How do you have that conversation without being too jargony and making sure you're speaking their language? And >> you got to bring those cultural tools to bear. You got to look and understand, okay, how what is the language of this organization or even just this executive team or this board? How do they want to receive the information? But also, how can I train and teach them >> to receive the information? And we use the language of risk, right? So, we come and we talk about the risk. Sometimes we'll translate that risk into, you know, a financial cost if we're talking about a breach. Sometimes we'll just talk about likelihood and we'll really focus on that. But it all circles around this idea of risk. And then we bring that risk appetite conversation into it where we say like, how much, you know, money are we willing to risk? how much reputational damage are we willing to risk for this? And I love to use storytelling to do that. In fact, at the end when we're making decisions, especially if it's a decision to accept a risk, like we're going to run this risk and not spend the money to mitigate it. I like to have a story at the end and it might just be something simple like so I want to look around the room and everybody is okay if X Y and Z happens. Like if you know someone was able to you know pop someone's account and then they get that information and they post it on the dark web and it comes back that we didn't do this everyone is okay with us not making that decision and we know how likely that is and you know just doing that gut check at the end with a story is really useful to you know actualize that risk in people's minds but that is a really important job of the CISO or any highle security leader to be that sort of application layer to translate the jargony security stuff into something that those people can understand. And even as a security company, you have to do it. You have to do that translation. >> You have to speak the language of business or what whatever resonates with hoax. You you called out risk and you know the the opposite of risk is opportunity, right? So uh in the last couple years there's been a lot of opportunity around generative AI, AI tools, etc. How do you balance uh in your CISO role the ability to innovate, take advantage of some of these AI tools internally for for business functions versus the risk that they may bring? >> Yeah, that's it's a really difficult question when it comes to generative AI and um all the AI tools that are coming out because it's such a new field. Luckily though, we've been through this a couple times in the security world. I mean, you can think back to like the '9s when websites came out and all of a sudden there were, you know, these new attacks that we' never heard of like cross-ite scripting or serverside request forgeries, you know, stuff that didn't exist before. They didn't have a name and someone, you know, invented this thing. And we can think of that and apply that to AI like we know this is going to happen. Like there's going to be attacks that we haven't anticipated that very clever people are going to figure out. However, we've gotten a lot smarter. So, we're really good at anticipating that. Sometimes, however, though, those risk voices can get really loud and you can get paralyzed into um not wanting to take advantage of the opportunity because of the potential risks that might be there. So, one thing we found it's useful to do is really stop, take a breath, really look at what's happening, try to analyze it as best you can, really analyze the risk, quantify that risk, and then decide what action you're going to take. So, it's really pausing and making sure you're not just slamming the door on something. Sometimes you might need to and some companies made that decision and that was probably right for them, but others just put guidance around it. And then as new tools came out, figuring out new ways to do it and then when people realize the value, maybe you could do something like host the model internally and not have your folks have to reach out to external models and create accounts externally, but now they can do it internally. And so many companies have chosen to go that route because now you control those uh pathways of data a lot better than something going outside. So it's really that understanding that and then also now you know it was pretty quick where we had an OASP top 10 for LLMs which was great. So we have frameworks being designed for this and then of course Amazon uh or AWS bedrock which also helps you host that LLM and then build guard rails that are built in and then you're also doing identity and access management to it. So making sure so we're wrapping the things we already know how to do around it. It took us a little while to get there but not that long if you think about it. So that's what we look at hosting your own model making sure you're doing good proper security controls on that pentesting it >> yep >> against that OASP top 10 >> just like any other piece of software right >> just like any other piece of software then making sure you can you have visibility to the LLMs your folks are reaching out to outside the organization and make sure that's happening in a way that you know you have data privacy protections on it they're doing the right thing like we rolled out a training a few months after chat GPT came out to train our whole organization on how they should be using these But then there's the third piece and that's where your vendors, this is more of a third party risk situation. >> Your vendors are turning on AI features, >> right? >> Are you aware that they're turning them on? Are you aware where your data is going, how they're handling it? So that's a third conversation you have to have. So you have to look at all three of those aspects to really understand how to secure the AI. >> One thing I didn't hear you say in that answer was no, we're not going to use AI. Right. I it's it it's security enabling the business to do what it needs to do with the appropriate controls in place. >> Absolutely. Now, I do think culturally worldwide, we need to be careful about how we're using these things. You can think back to social media and how we just sort of ran like as a global society, we just ran fully into social media and now we're seeing some of the mental health issues and other issues that are coming out of it. I think that is more where I'm like saying we need to be careful. We might need to slow down. But as far as rolling out the technology and protecting it, I think that's something that we have a pretty good grip on. >> Mhm. >> Now, there's going to be unknown unknowns. And that's why it always has to be defense and depth. Right. >> Right. >> So again, protecting that and preventing bad things from happening is great, but detection and response are a must. So you got to wrap that detection and response around that to make sure you have that defense and depth and you can take advantage of the opportunities without being, you know, paralyzed with fear and the risk and not miss an opportunity that you could have had using AI to help, you know, make your business more efficient. >> How are your security teams using generative AI today? >> At Artic Wolf, we have almost I think a thousand security operators now that serve our customers and we have rolled out something for them to use as operators to make them more efficient. And so what it does is it helps them basically conduct the investigations that they would do way faster, develop queries, know where to pivot, can even help them pivot on that information to figure out what happened faster. But we're not taking the human out of the loop. We're just supercharging the human, which that's sort of the bread and butter we were based on. And so that's what our security operations are doing. We're using that AI to help enhance what the security operators can do. Now, as we move forward, we're probably going to go into the uh, you know, agentic realm and start to have agents that can go do a lot more of that. But still, at the end of the day, we're huge human human judgment is needed where decisions need to be made. We're going to have those humans in the loop to help make those decisions. >> How did you have those initial conversations with those humans that, you know, there there's a there's a fear out there for some that AI is going to take my job, right? How did you have that conversation to reassure them that it's not going to take your job, but it's going to make you more effective and make you better? >> I have a small internal security operations team and and I'm also a customer of Artic Wolf, so I have those thousand operators as well. So, I have both. And, you know, I've built up trust with my team that I sat them down and said, "Look, we're we're growing. There's more opportunity here. This might mean we don't hire as many people, but no one here is in jeopardy, and we're just going to use this to make us more efficient." And the same conversation happened at scale with all the other operators. Like we're the b I mean the benefit of growing so fast is they can see that it's true. I mean we we could barely keep up with hiring. And so when they hear like we're going to bring something in to make you more efficient. They're just like thank you. Like yes this is great. This isn't going to jeopardize my job. It's going to help me be more efficient. The other thing I've said is hey learn this stuff well and be along for the ride and you're in a great spot. Like where you are right now you're in a great spot. It's harder for the folks coming out of high school and college to tell them where to go because like who knows where the puck is going, right? Uh but but I think for those um for those operators that we just we have exactly like you said good honest conversations about it. >> I I think it's a brilliant way to do it. Uh staying with the human element. Um, what kind of programs or mentorships do you have internally at Arctic Wolf or maybe you do it outside of Arctic Wolf as well where you're giving a path forward to that sort of that junior security operator uh to come up through the ranks who wants to aspire to be a CISO or senior security leader. Um, what kind of what kind of things are you doing? that we have a lot of operators uh that service our customers and uh we got to find that talent and we also have to train them on our own tools and the way we do things and so uh we have a lot of entry-level positions that we offer. Um we have mid-level positions too that we bring people in and senior level positions we bring people into all the time, experts who want to come work with us but we do have a lot of uh intern analyst and you know junior engineer positions that we bring people into. And then we like to find, you know, different ways to bring them in as long as they show an aptitude and a desire. And desire is probably the most important piece, right? An enthusiasm for security. We give a lot of these people a shot. And so, uh, there's people from all walks of life, you know, security guards, former teachers, and things like that that come to our organization, and we help train up and get to the right levels. And then you can see them rise up in the company and become very, very good security operators. One program in particular that I want to highlight is one called Tech Moms. So, we partnered with an organization there called Tech Moms that's involved in getting uh you know, primarily women who have been homemakers and been raising the kids and they want to get back into the workforce. Either their kids are raised or now they're in school or their life situations changed and now they want to get back into the field. They're interested in tech. And so, we helped work with them to say, "Here's a path to going into security if you're interested in that." And you know, we had some presentations with them and we immediately got some applicants and we've even be been able to hire them. And so now now we got these moms, you know, in our security operations center. And that's not typically what people think of with security operators, but it's great because their life experience, everything they do brings uh a different culture and a different feeling to what they do. And then, you know, we can train them up through our organization. In my whole career, starting from counter intelligence to being an FBI agent and now working in uh in in security in the private sector, I have found that diverse teams come up with better ideas and handle situations better than homogeneous teams. And that's diversity of all kinds >> for sure. >> You know, it can be gender, it can be socioeconomic background, it can be cultural background, age, all kinds of things. If you have diverse teams, it actually makes us better at security operations if we have those different viewpoints >> because your your threat actors are of diverse backgrounds as well. Right. >> They are thinking differently and >> Exactly. And you can come at problems from different way and people think about problems differently and they might have had an experience with the technology that no one else has and I it it just helps to have those different viewpoints. >> You've been in the cyber security profession for quite some time. You've seen a lot in both your uh public and private sector service. where where do you think we're going to be 18 to 24 months from now? We have, you know, the the rise more recently of Agentic AI, uh, model context protocols, things like that. Where where do you think we're going to be both from a security perspective and a technology perspective? >> AI is going to change things, right? We are going to see um that really take off. Now, I actually thought it was going to take off a little bit more in social engineering faster than it has. We have over 10,000 customers and we have uh an incident response practice and so we get to see basically if there's an attack out there we'll see it and many we see for the first time and we see what are successful breaches and because of that we have a pretty good view on you know what's happened and we've only seen about 15 to 20% that we estimate of social engineering campaigns really using AI to help bolster them and I thought we were going to see more of that but I do I am going to call out I do think we're going to see more of Especially as agentic AI becomes something more commoditized that more people can use more easily kind of like chat GBT. And you can imagine when you can take an agent and you can have it go do the research for create and execute a social engineering campaign and then you can just unleash that on the world. What that's going to do also you could do that just for general exploits. We're also seeing a huge increase in the number of CVEes that are posted. I mean to the tune of 20 30% year-over-year which we haven't seen that kind of increase in a while. One of the reasons for that may be folks you know attackers leveraging AI to find vulnerabilities. So I think we're going to see that and again if you think about I can throw an agent it will go find a vulnerability it will create an exploit for that vulnerability execute the exploit and then just give me the access. So these are things I think we could see in the next you know 18 to 24 months. I also think and hope that we see us using the same kind of agents to help protect, right? >> And I could think of like if I could have that same kind of agent finding vulnerabilities, I could just unleash it on my on my tech stack and have it find vulnerabilities and then help me fix them quickly, right? >> For sure. >> So these are things I think we're going to see. We also see that a aentic AI in security operations like we talked about earlier. So I think there's a lot to happen there. Another thing I want to see and I'm hope that we wrap our arms around a little bit better as a security community is third party risk because it's a really big problem right now. >> We've got to give one another the ability to secure this better. Um and uh it's something that I think we really I hope we really look at the supply chain risk in general and just really start to understand it better and start to share information. you know, open up API, open up logging to one another, open up our architecture, you know, uh, software bill of materials, sbombs. This is something we really need to grapple with. So, I hope that we do. I don't know if I'm making a prediction that we will. Uh, I'm voicing a hope that it's something that we need to wrap our arms around because we saw a two-fold increase uh, in third party involved breaches in the last year. And I think that's only increase going to increase. So, we've got to be able to get wrap our arms around it and do better. In closing, any anything you'd like to share with your your fellow CISOs uh and or security practitioners? >> Well, I guess the biggest thing I would like to say if you're going to ask me that question is uh just keep hope alive, right? We have a really difficult job and uh one thing that's been great that I've seen in the CISO community is we've had lots of CISO communities popping up in all kinds of places. We have we have a great community in Utah where I live, but of course there's, you know, works uh like uh Slack workspaces and other places, Discord channels where CISOs get together and share their stories and commiserate. And uh I just think we have to keep on keeping on. We've got to keep trying to spread the message and get people to take security seriously. Um put it on par with shipping new features or doing other things. really take security first so that we can kind of move beyond this and confidently move forward with these new technologies and not be focused on trying to do this after the fact, right? And make people more confident in software, in using these solutions. And so, just keep doing what you're doing. Let's let's get the next generation up. Let's lift those um below us, but let's let's stay strong and um not not lose heart in the face of all the things that are happening. So you mentioned uh CISO communities. Yes. You recently participated in a AWS uh CISO circle with with with peers from your industry. Can you share a little bit about that? >> Yeah. So I've been to a number of these now and they are extremely useful. It's a lot of us CISOs from security companies in particular. So that's kind of a different breed. So it's really great to be with those folks. And then we just sit around and we'll bring up a topic and it's amazing to hear the stories, the wisdom. I mean, I always am jotting down ideas on things to do. Um, I'll give you a specific example. One issue that we are dealing with, you know, all over the states, uh, companies of all types are dealing with people, uh, interviewing for jobs who aren't who they say they are, >> right? And in the scarier cases, it might be somebody from a, you know, foreign adversarial nation wanting to be an IT worker, you know, or it might just be somebody, you know, working multiple jobs or something like that, which is less serious, but also still a concern. And, uh, you know, we were sharing just some like low tech ideas on how you can try to make sure the person is who they say they And one idea was someone like just have them point their camera at an outlet in the wall so you can see what it looks like. You know, if they're in the States, it looks like something from another country, you know, >> you know, and um and there was just a few ideas like that shared. So there's great like immediately actionable things like that, but then also it's like >> this breath of fresh air because everybody's dealing with the same problem I have and I don't feel like I'm alone in it with the Chattam House rules where, you know, nothing's going to, you know, escape there and you can talk freely. people really are sharing and so you hear those war stories or you hear their struggles and you immediately see like I feel seen I feel heard you know these are my people I get it but then you can also say how are we going to solve this what are we going to do and uh you know I think we like to make sure that we have actionable ideas at the end and it's it's really useful and we covered a couple topics in that one we covered that and we covered some incident response but I I have just found those to be extremely valuable for those reasons >> fantastic and I I imagine you bring uh elements of your background to them so people learn from you as well as you're learning from others. >> Yeah, absolutely. And and and we all do that. In fact, it was amazing. There were actually quite a few people from the military in uh you know in that CISO circle and so we were we actually joking about that and talking about it in that that one. So yes, we all bring our diverse backgrounds to it and could share our individual viewpoints. >> That's great. Adam, thanks so much for joining me today. >> Really, thank you so much for having me. This is great. [Music]