Supercharge security with generative AI

Key Takeaways

[Music] hi everyone my name is Umesh chunker I'm the chief technologist here at Google Cloud security and I'm excited to talk to you today about work we've been doing in the area of generative AI we're going to cover a number of areas here today we're going to go through a brief history of innovation of AI in the generative space here at Google we're going to talk about key security challenges that we face as an industry and how AI could help with those we're going to talk about how we've been infusing AI into all our products and we're going to talk about a custom AI model that we've developed here in the cloud Security Group and how we're going to make that model available through a security AI platform and finally we're going to conclude by talking about some next steps I'm going to take now if you're like most of our audience what do you think about the year 2017 you think isn't that the year that Harry Styles releases debut solo album yes yes it is but it turns out over in the world of machine learning other exciting things are happening at the same time Google research released a paper then called attention is all you need which introduced the Transformer architecture to machine learning by being able to reason about words using the context in which they appeared we were able to make immediate and dramatic gains in machine translation what was hard to predict is that this architecture would spark a revolution in AI with large language models that had a broad set of abilities such as generating content and logical reasoning as well since that 2017 paper Google has led a number of foundational advances Bert led to significant improvements in Google search quality Lambda was a Leap Forward in conversation quality and was the basis for the barred chatbot that many of you might be familiar with and the Palm 2 model we recently introduced at Google I O made big steps in multilingual capabilities reasoning and coding tasks so what does all this have to do with security let's take a look at three long-standing big challenges we face in the industry in some ways we think AI can make a big difference in the world of medicine there's a concept of patient zero the first person infected with a novel disease in security we have a similar concept the first user or organization hit with the novel compromise today can be an overwhelming challenge for people to keep up with the evolving threat landscape even if you know all the threats knowing what to do and doing it isn't easy so we asked ourselves what if we could prevent patient ones if we could use AI to take what we learn in real time from that first compromise and operationalize that to protect everyone else let's go to our second category toil if we're being honest the practice of security can feel like trying to stay on a treadmill that goes faster and faster every day and most of the people who do security aren't security Specialists there are software Engineers sres I.T admits database events they're people whose main job is not doing security and even experts often end up doing repetitive or manual tasks leaving them with little time to focus on more complex and interesting problems that only they can tackle this is a big cause of burnout in the industry as well it's something we spend a lot of time thinking about so we asked ourselves What If instead we could build systems that secure themselves that when you want to deploy a new piece of software or setup we're able to automatically generate the right security policy to go along with that that eliminates enormous amounts of manual work to just figure out what is the right change to make and finally let's turn our attention to the tally Gap we know in our industry there's a gap of millions of jobs compared to the number of skilled people who are available to fill them we think AI can make non-specialists productive much more quickly with the skills they already have and help them climb the learning curve to expertise much more quickly we're already building features in our products to tackle each of these challenges virus total today with its code inside feature is able to analyze previously unseen Power Cell scripts to explain and assess them using generative AI it was able to classify some scripts as risky as well as or better than existing AV engines for each analytics for chronicle takes indicators and other markers from known breaches including those happening in real time and operationalizes those to detect the same activity elsewhere our assured open source offering lets customers get curated scanned securely built versions of OSS packages helping to mitigate software's abuse security supply chain risk we are using AI to detect previously unknown vulnerabilities more scalably duet AI for manual threat intelligence is able to synthesize and summarize relevant threat intelligence and make it digestible by a range of audiences saving lots of manual analysis and compilation duet AI for chronicle lets users who are not familiar with the domain-specific udm schema language write natural language search queries like show me which Windows machines used RDP or VNC in the last month and how to generate the exact search query that you need to do that this can be a big time saver for experts as well giving them a starting query that they can then refine by hand authoring detections in chronicle is also going to benefit from AI authoring detections can be challenging and require lots of iteration to get right being able to have a good starting point for natural language and being able to use the conversational AI features to continually refine those detections is something we think is going to save people time and lead to better detection quality and finally duet AI for security Command Center enhances our attack path simulation capability which shows possible ways your sensitive resources might be accessed by adding a plain language explanation and summary of the sometimes complex graph data that you have to process now to do these things well you need a security specific model one that speaks security natively and we discovered this because we try general purpose models first and we found they didn't always perform as well as we would like on these security tasks for example security specific languages aren't always well represented in general purpose model training sense beyond that a lot of important security data just isn't on the public internet which is where a lot of training data comes from so we combined both public security resources and the incredibly Rich threat intelligence data we've compiled across Google and mandion to fine-tune a model aimed at solving security tasks specifically in 2022 Mandy had conducted over a thousand incident responsing agents this gives us world-class Frontline intelligence visibility to capture new threats as they unfold Beyond these engagements we have hundreds of threat analysts looking for and tracking behaviors by Bad actors we also analyzed millions of potentially malicious artifacts a day all of this gives us a strong data foundation on which to train our model SEC palm-2 is a descendant of Google's General Palm 2 model which we recently introduced at Google I O Google is continually developing more powerful Foundation models like Palm 2 and will evolve SEC Palm to take advantage of those models as they become available as well you already saw some ways we're using SEC Palm to build Innovative features to tackle the problems of threats to oil and talent now we're making this model available by a security AI workbench the core of which is sec palm-2 vertex AI is Google Cloud's AI platform and we leverage the easy to use generative AI apis that were recently introduced by building on vertex you get Enterprise grade controls for data protection compliance and sovereignty you get access to Google's custom-built AI chips tpus or tensor processing units and you get management friendly features like identity integration scale delivery and slos it's the same platform we're using to build our own AI powered product features of course all this wouldn't be nearly as exciting if you made it just for ourselves customers will be able to use workbench for internal use cases as well as developing product features of Their Own the API is particularly well suited to three kinds of atomic tasks summarization classification and generation summarization is a key capability when trying to make sense of large volumes of security data and making it digestible for a variety of audiences something that often takes a lot of manual effort classification in the security context is often about detecting potentially risky or malicious activity or artifacts and explaining the reasons behind that decision and generation is valuable when working with formats like security policy or query languages when you want to generate the right snippet to capture a higher level intent this is something that people often struggle to do manually of course a big part of the value of large language models is their ability to stitch all of this together and to present a conversational interface on top of those capabilities we think this is particularly valuable in the security space where information can be spread across many different systems and has to be synthesized in order to make sense of it we know in all this that privacy is top of mind for many of our customers it's important to know that the prompts that you give to the API don't get logged or fed back into the training set for the model we think extensibility is key to making the workbench maximally useful it's important to let customers tap into their own data seamlessly and to connect to other security apis like threat intelligence from our partners to do this we're planning to enable a plug-in model for the SEC palm2 API which will allow secure API connections to the data at inference time keeping all the platform data Protections in the process you'll be able to do this without leaving your compliance boundary plugins can be private to a single customer or made available for other customers to use through a Marketplace we'll continue to extend the SEC palm-2 model to cover additional security specific languages that are necessary to interpret security data that our customers find important or that these plugins provide we've seen a lot of interest in the industry from our partners and customers since we introduced this model of the RSA conference in April this year we're now starting to work with some early Partners to build and extend the workbench ecosystem it's important to emphasize that this is just the start of a long and exciting Journey we're all very excited here to see the Innovative applications all of you come up with if you're interested to learn more about what we're doing with generative AI check out our website at cloud.google.com security AI again for joining me here today and I hope you enjoy the rest of the sessions here at the Google Cloud security Summit foreign [Applause] [Music]