Latest / Privacy Please / S6, E240 - From IAPP Insights to Security Challenges: What Really Matters

Transcript

S6, E240 - From IAPP Insights to Security Challenges: What Really Matters · Privacy Please

• 0:00
  Speaker 1: All righty, then.
• 0:01
  Speaker 1: Ladies and gentlemen, welcome back to another episode of Privacy.
• 0:03
  Speaker 1: Please.
• 0:04
  Speaker 1: Cameron Ivey, here with Gabe Gumbs, we are back.
• 0:07
  Speaker 1: We are so sorry.
• 0:09
  Speaker 1: It's been a few weeks.
• 0:10
  Speaker 1: Things have been crazy, gabe.
• 0:12
  Speaker 1: How you doing, man?
• 0:13
  Speaker 1: I know you're back from traveling as well.
• 0:15
  Speaker 2: I am well.
• 0:16
  Speaker 2: It's been a couple of busy weeks for security, privacy, resiliency.
• 0:22
  Speaker 2: We got a lot to cover and not a lot of time to cover it.
• 0:27
  Speaker 1: No, there never is enough time there's never enough time and I'm good.
• 0:32
  Speaker 1: I'm good, yeah, traveling um, finally back at home and had ipp last week.
• 0:38
  Speaker 1: I was about to say last year I had it last year also yeah, ipp last week was awesome.
• 0:46
  Speaker 1: We'll dig into that in a few minutes.
• 0:48
  Speaker 1: I know that you were at an event last week as well.
• 0:51
  Speaker 2: I was out at VeeamOn the Veeam user conference, veeam being the backup and resiliency company, the leader of backup and resilience software and one of Myoda's technology alliance partners.
• 1:09
  Speaker 2: An awesome, awesome event.
• 1:10
  Speaker 2: We had some customers there, got a great chance to meet with some more of the Veeam folks, really just you know, get further into the Veeam community Really excited to continue to serve them.
• 1:24
  Speaker 1: Love that, so does that make you guys Veeamers?
• 1:27
  Speaker 2: Ooh it does now, now that you said it yes, yes, yes, it does.
• 1:31
  Speaker 2: Okay, so was.
• 1:32
  Speaker 1: I APP.
• 1:33
  Speaker 1: It was good, but wait, wait, wait, wait, wait Before we dive into that yeah, because you know we have security folks on here too.
• 1:45
  Speaker 2: Anything you want to leave anybody with that isn't too familiar with these events or anything cool that.
• 1:47
  Speaker 2: So resiliency, in particular, has become an absolute necessity in security, right?
• 1:50
  Speaker 2: So this week RSA is going on right, big deal, huge deal.
• 1:54
  Speaker 2: And you had the biggest arguably the privacy version of RSA, right so IAPP, so that was happening.
• 2:03
  Speaker 2: This week also, the Verizon Data Breach Investigator Report dropped as well.
• 2:08
  Speaker 2: It's been a busy week in the security and privacy space.
• 2:12
  Speaker 2: But, yeah, on the resilience side, well, hell, even at RSA this week you're seeing a growing number of resilience providers.
• 2:20
  Speaker 2: Right so, the Veeams of the world showing up at RSA, because resiliency is a security problem, which shouldn't come to a surprise to anyone who's listened to this show for a while.
• 2:31
  Speaker 2: We talk a lot about confidentiality, integrity and availability.
• 2:33
  Speaker 2: Those are the three things that encompass security and they are the backbone of resiliency.
• 2:39
  Speaker 2: Love that.
• 2:40
  Speaker 1: Yeah, so okay, ipp, we got a lot of privacy listeners as well.
• 2:45
  Speaker 1: I don't know if any of you listeners were able to make it.
• 2:48
  Speaker 1: If not, we can kind of give you a little recap.
• 2:51
  Speaker 1: There was a lot that went on, a lot of good stuff.
• 2:53
  Speaker 1: I don't know where we should start, but let me just I'll start by saying this the major theme of this year's conference was the development of AI governance and their frameworks.
• 3:04
  Speaker 1: That was a huge thing.
• 3:05
  Speaker 1: Companies are navigating, of course, the complexities of AI risks and compliance.
• 3:09
  Speaker 1: What's one of the quotes?
• 3:11
  Speaker 1: I don't know who said this, but building the plane as they're flying.
• 3:13
  Speaker 1: It was one of the main quotes that I took from that.
• 3:16
  Speaker 1: So the focus was on understanding regulatory requirements, addressing business needs and delivering concrete outcomes, like expanded data protection impact assessments, so DPIAs.
• 3:29
  Speaker 2: You know what's interesting about that?
• 3:30
  Speaker 2: What's?
• 3:31
  Speaker 1: that.
• 3:31
  Speaker 2: As a juxtaposition to that Verizon Data Breach Investigative report.
• 3:35
  Speaker 2: They subtly debunk a bunch of overblown fears around AI and security Around AI and security, because attackers are still very much experimenting with AI.
• 3:45
  Speaker 2: But they highlight that the real risks are a bit more mundane.
• 3:48
  Speaker 2: It's data leakage, it's poorly controlled access, it's governance gaps, it's the privacy concerns that AI is really driving, not so much the security concerns, yet that's a good point.
• 3:59
  Speaker 1: Yeah, is that something that would be obvious?
• 4:03
  Speaker 1: I mean, like, does that seem like it's not very shocking to you?
• 4:07
  Speaker 2: I think for me it's not super shocking because, as someone who is both an ethical hacker and a user of a lot of AI tools, including, like AI coding tools, there's a lot that it is very capable of doing.
• 4:19
  Speaker 2: That definitely makes an attacker's job easier for a traditional attacker to be successful.
• 4:29
  Speaker 2: That, if we're being honest, attackers are.
• 4:31
  Speaker 2: They're creatures of habit.
• 4:32
  Speaker 2: They are like water and they will find they will find their level and whatever crevice they can get through, and they also prefer to use the least amount of effort to get success.
• 4:45
  Speaker 2: So retooling or, you know, completely modernizing their own tool stack to include AI isn't really worth the return on effort yet, considering they're still making bank on conventional methods.
• 4:58
  Speaker 2: So attackers are doing a lot of experimenting, but there's a lot of people out there just banging the drums going AI is going to make security Like AI is turning people into super hackers and I'm like I don't know about that.
• 5:10
  Speaker 2: And so the report does suggest the exact same, but points out that the real problems are very much around leakage and governance.
• 5:19
  Speaker 2: That's the real problem.
• 5:21
  Speaker 1: Yeah, yeah, that makes sense.
• 5:23
  Speaker 1: Now I wonder if that kind of falls in line with this next point that I'm going to make.
• 5:27
  Speaker 1: So another big thing from the conference from IPP was around technology right, and you can just hear this in rumblings from groups, from people you're just talking to on the floor.
• 5:38
  Speaker 1: Of course, anyone listening knows that I work for a company called Transcend, but, honestly, the growing frustration with outdated privacy management tools is still like that is one of the biggest things that was being heard on the floor from others, from just rumors going around.
• 5:56
  Speaker 1: It's something that's been talked about even in the past few years, but that's one of the big like demands that people are looking for a better, innovative product that can grow with them, and privacy leaders are looking for scalable solutions that can integrate with their broader data governance that offers like automation and reduces manual work.
• 6:15
  Speaker 1: I feel like that we've heard this years and years and years as like this isn't anything new, but it seems like leadership is really trying to move themselves from those outdated tools, tools and this is a very touchy subject too, gabe, because I know being in a leadership role.
• 6:33
  Speaker 1: It's one of those things where it's like it's hard for someone to say that I need to move on from a tool that you have, not only because it almost says well, I failed at picking this tool, I need to put in another tool and you need to give me money for it.
• 6:48
  Speaker 1: It's hard to do that on the privacy side because the funding is lower and usually you're coming off of either security funding or you definitely have lower funding than the security team, depending on how your company is structured.
• 7:01
  Speaker 1: So I mean that's a big challenge too.
• 7:05
  Speaker 2: Isn't it weird, though, that we just said that confidentiality, integrity and availability are the pillars of security, the C being the first thing confidentiality and yet somehow security doesn't have a privacy budget of their own, so the only tool in their bag is essentially encryption for confidentiality, then, and, I guess, maybe, by extension, identity, and so everything starts looking like a nail.
• 7:33
  Speaker 2: It just doesn't add up that the security budget doesn't include privacy dollars.
• 7:39
  Speaker 2: How else does one keep things confidential?
• 7:42
  Speaker 2: That's a good question.
• 7:44
  Speaker 1: I mean that's the other challenge.
• 7:45
  Speaker 1: There's so many you hear complaints about smaller companies and smaller privacy teams that don't have the backing or support like some of the major companies that care about privacy.
• 7:57
  Speaker 1: But it's a little bit different in terms of being able to afford those types of tools that can be innovative at the same time.
• 8:13
  Speaker 1: I don't know, that's a challenge, but it's nice to know that people are looking for a better, innovative tool rather than just sticking with something that's known, kind of like OneTrust.
• 8:25
  Speaker 1: I'm just going to name bomb Like OneTrust.
• 8:27
  Speaker 1: Everybody knows who OneTrust is, but they've been around a long time and there are better innovative tools out there that can kind of fit your needs a little bit better, that are more customizable, more integratable things that you don't necessarily need to have engineering experience to operate this tool to be efficient in your privacy um, in your privacy game.
• 8:48
  Speaker 1: So you're spot on.
• 8:49
  Speaker 2: I've said it before about security posture, but you can't as we've talked about literally since the first episode of this show over five years ago you can't separate privacy and security, right like you can't have privacy without security and arguably, you can't have security without privacy, considering that confidentiality is a core part of security and security and privacy posture isn't about logos, it's about architecture.
• 9:08
  Speaker 2: It's not about the fact that you bought the most known logo and I've heard it before, literally quote we use the best in class tools Awesome but attackers don't care about your brand stack and humans making mistakes don't care about your brand stack, they care about the gaps in between.
• 9:23
  Speaker 2: That architecture.
• 9:25
  Speaker 2: And the gap between perception and reality is not just academic, it's operational, it's strategic.
• 9:30
  Speaker 1: That's a good point, man, we could see.
• 9:33
  Speaker 1: This is why I wish we had some more time.
• 9:35
  Speaker 2: Well, we do.
• 9:35
  Speaker 2: I think we're going to have to spend the next couple of episodes like really diving into this because it feels.
• 9:41
  Speaker 2: It feels like the narrative needs a bit more informing out there.
• 9:47
  Speaker 1: Well, yeah, because the other, the other problem is that privacy people are always just kind of seen as compliance gatekeepers, and that's not what they are, that's not what they want to be, and I think that's another shift that's happening and you know, I think it's just it's just going to take time because it is getting bigger and better and it's just going to take time to be taken more seriously, and I think it's it's on the right path.
• 10:06
  Speaker 1: Now I will say one one downside from the ipp that everybody was like, uh, kind of disappointed about was sam altman from open ai.
• 10:14
  Speaker 1: He was like the big piece to talk, um, and he ended up showing virtually at the big talk at the end.
• 10:22
  Speaker 1: So everybody was like what?
• 10:23
  Speaker 1: I felt kind of bad for people that waited around for him Cheated yeah.
• 10:27
  Speaker 1: Yeah, it almost like.
• 10:28
  Speaker 1: Do you think that it was recorded?
• 10:30
  Speaker 1: Like, was that actually him live.
• 10:32
  Speaker 2: How am I supposed to hit him in the face with a pie?
• 10:34
  Speaker 1: if he's only virtual.
• 10:35
  Speaker 2: It's a lot of questions, Aya.
• 10:37
  Speaker 1: A lot of questions.
• 10:37
  Speaker 1: I mean, I get it, everybody's busy.
• 10:39
  Speaker 1: I'm sure he's busy, but it's just interesting that he was the.
• 10:43
  Speaker 1: He was the big keynote speaker, um, and he showed up virtually.
• 10:48
  Speaker 2: So I know I'm being honest with you, if I'm the head of open ai, I don't really want to get in front of a bunch of privacy people and answer questions.
• 10:54
  Speaker 2: Holy shit, that's fair.
• 10:55
  Speaker 1: That's fair, I'd be afraid yeah, and and just I'll close this out with saying like it was so awesome to see so many cool people and some really nice people that I ran into that listened to our podcast, Gabe.
• 11:07
  Speaker 1: It's just really neat to run into people in person and it's cool to hear that what we're doing is still something that's important to others, that they tune in and they actually say you know they have good feedback and so we appreciate it.
• 11:20
  Speaker 2: Maybe we hit them with a bonus episode this week.
• 11:22
  Speaker 2: We may want to hit them with a bonus episode this week to catch him up on, because there's been a lot happening this week, so let's do that, yeah let's do that, ok.
• 11:30
  Speaker 1: well, we'll end it here on this one and we'll get that little bonus one out as well.
• 11:35
  Speaker 1: But thank you, guys, and we'll see you in the next one.