Data Security in the AI Era, Don't Let AI Ruin your Presentation, and the Weekly News - ESW #480
Ayman discusses the importance of simplifying presentation slides, emphasizing readability and avoiding over-reliance on AI tools that can amplify poor content. He also highlights reducing exposure as a key data security strategy, suggesting limiting access to sensitive information and focusing on preventative measures. Additionally, he reflects on the risks of AI in software development, noting potential issues with supply chain security if AI-generated code becomes widespread.
Transcript
Only Ayman's parts of this conversation are included, with the question before each answer for context.
A bunch of problems there, and I think it's totally solvable. I think what we need to see, and I'm sure it's not just cybersecurity, it's probably every field at this point. We need some skills on like, look, a slide, you can't use font smaller than this, right? Like you just can't go below a certain point. You can't be incredibly verbose.
That's what you do, Adrian. Publish an Adrian approved by Adrian skill. Yeah. That people could just use on GitHub.
Bingo, bingo. Let's simplify it down. And maybe that's a skill that we can put into Clot.
I was just thinking about that. Like, Tyler, as you're saying that, we just, I mean, lately... Honestly, like lately when I'm, past couple of things I've been putting together slides for, I almost got overwhelmed trying to get AI to like do it. So I'm like, you know what, forget this. And I just went to Google slides and just put simple bullet points, white on black or black on white, and that's it. And maybe that's, you know, maybe that'll be the new thing. Wow, your slides are so clean.
A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria. Some people who really should have put more effort. You should have known better.
So I guess it comes back to the speaker then, huh? It really does.
Yeah, yeah.
I guess, you know... Go ahead.
Yeah, if you don't have the time, you don't have the time. I mean, that's just, I think that is probably the most common excuse, Tyler. And I think it's the worst excuse. Oh, it's 100% the worst excuse. If you don't have the time, don't sign up to speak.
Well, yeah, you know, honestly, I mean, I think like, I think experienced people, I don't know how many people I've talked to. I thought I was the only one, but I've talked to a lot. We've all done it here where we've delivered excellent slides, but in the last like 48 hours. So, you know, I think it still comes down to a skill thing and, you know, and a lot of people just have that ability where only under pressure can they deliver good stuff. But I guess what's interesting, you brought up kind of like an underlying theme here is whatever you're doing with AI is going to be 10x'd. 45:23 So if it's mediocre stuff, then it's going to be mediocre 10x, right? So it's not necessarily levels of up, it's more like expansion of the amplification, kind of like a signal. When a bad signal from a speaker is bad and you amplify it, you get bad, much worse. So it's interesting. This kind of reflection of our AI world now.
Yeah.
Because you know, you don't, you don't ask a junior engineer, sorry, like, like, same thing with engineering, right? They're asking, they want senior engineers that know how to code that understand software engineering. Yes, but go ahead and use AI. But they're not going to ask a junior engineer. You know what I mean? Anyway, sorry.
I read it out loud, verbally, you know, okay, please let the dough rise for 30 minutes. I read it out loud. And if I said the word ascend, I'd be like, who says that? And I would change it, right? Like, it's same thing with these slides. You literally read them and look at them and make changes so it doesn't suck. This just is, AI is not the problem. It's the people. Yeah.
Yeah, I love the semantic coherence. Just for those out there, like the speech may have proper grammar, but lacks any real meaning. So, interesting.
Kind of like what Tyler says nine times out of 10.
You're too hard on yourself. It's not true.
No, in fact, you kind of nailed it, and we can wrap on that, Tyler. It really just all comes down to, do you care about the quality of it? And if you do, you got to spend a little bit more time with it, give it some love, and that love will show when you put it in front of an audience.
Yep.
I think I have to go with shrinking what's exposed, mainly because when I look at how breaches are happening, it's stuff that should have never been exposed in the first place.
Yeah, reducing surface area. I mean, you know, if you're the type that likes preventative stuff, then I think shrinking what's exposed is along those lines, I think.
Again, that's not security applying ACLs and stuff. You're again begging the network team to do that.
Yeah, I mean, my mental model is, I try to split it into a couple ways, because when you come in, there's too much to fix, right? There's what's already exposed, and then paying it forward. So if I'm going to take the paying it forward approach, I want to do preventative. So as I'm building out, or whatever it may be, like, let's take preventative controls. Now, if we're trying to fix what's already exposed, also taking a preventative approach, like, for example, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, A talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec,
Mental notes. Send Adrian an exploitable file so that he opens it as a seven-year-old.
Adrian, watch your AppSec.
It was hypothetical.
He's honeypotting the users. He's honeypotting them. The viewers. I mean, maybe, yeah, maybe like, so one way I look at shrinking what's exposed is, again, process, right? So if I have PHI everywhere, right, I'm more exposed. It increases my, to answer the question, increases my risk. So how do I bring down that risk? Well, don't put PHI everywhere, right? Or if more people have access to your database to see customer data, well, let's reduce that access, right? 1:01:00 So yeah, maybe it's not a tool that I invest. Maybe it's a process. So yeah, that's how I see shrinking exposure. Anyway, maybe we should move on.
Kidnapping is kind of the classic case there.
Yeah, there's a lot of movies. I think there's a bunch of Denzel movies where the cops are really corrupt, right?
Like the way he wrote everything was like... Oh, like you get popped, your security wasn't good enough, but he already had, he was an admin, he already had all the access. So, yeah, and he's been sentenced for locking over 3000 devices on his own employer's network. This is a 57 year old in Kansas City pleaded guilty, and 32 months in prison.
There's a good Darknet Diaries episode. I can't find it right now. But about the guy who was disgruntled. Oh, Ubiquity. The Ubiquity one. Oh, yeah.
I remember that.
Yeah. So Jack did an episode on it. And it was a good lesson. It was a good lesson.
I call these angry admin cases. And in my list of companies that have been destroyed by breach, there are two angry admin cases on that list of 37 companies. Yeah, definitely something. I remember it's been a while back. You remember when there was a San Francisco, what is the name of the San Francisco transit? Bart?
Bart, yeah.
Yeah, yeah. Remember when there was an engineer that just like locked everybody out of stuff? Yep, I remember that.
I do not, yeah.
There's a list. You got a list here on the name of the firms too. Wow.
Oh, sorry. Go ahead.
I was just going to call out, this is all from databreaches.net, which is an excellent source. I don't know how Descent keeps up with all this. We don't know Descent's real name, but she works very, very hard at this and has excellent content.
Yeah, it's a pretty good website. It's awesome. It's just simple it is. But one thing for your viewers is definitely where it's possible, read the indictments. Those are just always fun reads and that's where one learns good service security for those who are out there trying to learn or get acclimated to different parts of the field.
Ayman, you mentioned something about reading the indictments. If you had an example of that, I would love to see it.
I'm reading the one with the engineer for locking 3000 devices. Oh, so we already have an example. Yeah, there's a link to court documents on there. Yeah, because I'm trying to see how they caught him. You know, in the ubiquity case, it was an IP address had slipped. You know, he had logged in from home. So I'm trying to see how they caught this engineer. It's interesting. The engineer set up a bunch of scheduled tasks to delete the domain admins, but apparently they caught him by tracing the email, that extortion email that he sent. 1:14:02 But I don't know. I'm still reading it right now.
We have to thaw you out.
And his admin password was the same as the other.
Yeah, as the crew name.
Oh my God.
That's even more painful. Like this guy didn't even know how to hack.
We're in such a bad state.
We need risk reduction, Tyler. We need risk reduction. First thing to do, fire that guy. That reduces risk. Does that reduce the attack surface area? What was the item? No, it reduces risk.
Shrinking what's exposed. Is that shrinking what's exposed?
And he jumped onto the FTP server and like messed with the menus and took the allergens off and all that stuff. I don't know if you got, we covered that like a year, year and a half ago or something like that. But yeah, he also got arrested, got sentenced after that. I think he got around the same amount of time as this guy. He got a lot of time for that.
There's got to be a word, like maybe we make a new psychological disorder, like God complex for admins, right? So like admins that get disaffected because they're not being treated well or whatever it is and take on this like alter ego approach. We should come up with a term.
So there's this like kind of controlling, like, you know, like I got paid through the crime, but I ultimately did the crime because their security was bad and they needed to be punished. But my knowledge of the DSM is not very good. So, and I am not a therapist or a psychologist. So...
I'm going to research it. We got to come up with a term.
Ayman. Yes. You published something. I'm here. You published something a couple of days ago. Cybersecurity is center stage in AI. Tell us what you're talking about here.
Yeah. I attended a talk. Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, 1:28:28 So yeah, I pulled a bunch of interesting quotes from there that I thought were really good takeaways. And I can go through them. And I put them in that article on Security Cafe. And then I added my own commentary. So this was really fun to write. Again, you know, I love writing my stuff without AI. It's kind of like I'm enjoying writing again, like in the beginning. Anyway, I digress. So some of the quotes... Some of the takeaways were like, you know, our security is built, assuming it's a human on the other side, which is interesting because now, especially if you read the misalignment report on how people are abusing, AI for cybersecurity tactics, it's true. 1:29:14 We, we need to change our posture and how we're defending. Right. So that, that was interesting. One guy had a hot take. There's not enough inference in the world to secure all the software. So that was interesting. And that might be the case now. So, but one of the most interesting ones that I, one of my favorites was the future would not have NPM. The model would just write it itself, the package.
I mean- I thought that was an interesting take.
Yeah.
Yeah. Like why depend on a third party library when it's just like an extra couple of tokens to just build it yourself?
Yeah, like eliminate supply chain altogether.
I disagree with that completely.
Yeah, go for it.
It's expanding what's exposed if AI rewrites everything.
Well, I mean, first of all, this is a future, right? The future in an AI future world, right? Where tokens and inference is cheap. But, you know, you could also take it a step further. Or sorry, there could be an in-between where you bring libraries in one time and then you just work on that library and you don't depend on the library because look at all the supply chain attacks that are happening right now. I mean, if you're in a super sensitive environment, this is like... Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria 1:32:30 I just found it interesting. I mean, you know, it is, it was, these are all things that were just mentioned that, you know, we're thinking about.
So, so there is, there is another angle here where, you know, we've seen this trend of people who are not software engineers building software companies, right? Like, will you even know which path it took? Will you even know if it's using NPM versus building its own libraries? Nope. I would argue some percentage of vibe coders will not even know which path was taken.
No, I mean, you have all sorts of mistakes that AI makes, you know, uses an older version of Node or whatever it may be, or, I mean, you just run into all these things. Or maybe you want to use a particular library, but it's not compatible with your version of Node, right? So if inference is super cheap, then just create it. Just create it yourself that one time or adapt it. I mean, you know, in this, in that future world, rewriting software from Python to Rust should be easy, right? 1:34:01 It's just all about the spec. Anyway, it's interesting.
All right, there are, for the second week in a row, we've had this I don't like Passkeys essay here, and we have not covered it. So go check it out. It probably won't show up a third time. It is an excellent discussion on pros and cons of Passkeys. The TLDR is the author thinks they're great for enterprises, but they kind of suck for consumers. And I kind of don't disagree with them. That's Ethan Hawksley behind that one.
So is his hot take that he just doesn't like devices locked to a device? I mean, sorry, Passkeys locked to a device? Is that the idea?
I didn't follow the article either. I read it top to bottom. And I was like, wait a minute, I love Passkeys. Why is this guy complaining?
I think it's just that one part where he says when Passkeys don't work. When you handle a colleague's computer, it gets more inconvenient. Plug in a hardware key.
So, I know my complaints. Like, I will spend five minutes trying to log in with a passkey, only to realize I don't have a passkey for it. Right? So, like, understanding... CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST, FedRAMP, GDPR, HIPAA, SSO, IAM, OAuth, phishing, ransomware, pentest, OSCP, NIST,
And that's the idea is that like there's two types of passkey or many types, but in general, you have synced passkeys that are allowed to sync. And then those are device bound. And so, you know, when you're doing the device bound one, that's where it could be an issue. It's obviously better security. But yeah, it's, yeah, it's, I like them in general. I think they're good. They're better than.
I think they're fantastic.
Yeah, they're great. You know, it's only, I think it's how the software company implements it. Like Costco's like passkey thing implementation, like would not work on my phone for a while until I had to like delete Costco, delete the cache and start over. And then maybe it worked.
I really worried about like forgetting or losing my security keys, my YubiKeys, right? So, you know, the solution to that is you have three of them and you use all three, but then some things like AWS only allowed you to use one. You couldn't register more than three for a long time.
Maybe the writer did not use security keys extensively. Yeah.