Latest / CYBR.Signal / Risk and Innovation with Michael Farnum

Transcript

Risk and Innovation with Michael Farnum · CYBR.Signal

• 0:00
  SPEAKER_00: Hey everybody, Michael Farnum here, CEO of Cyberset Community.
• 0:04
  SPEAKER_00: Wanted to do this cyber signal real quick.
• 0:08
  SPEAKER_00: So I was on a panel a few weeks ago.
• 0:11
  SPEAKER_00: Unfortunately, it wasn't recorded, but it was an AI governance panel bringing up cybersecurity topics for AI, but not a typical audience.
• 0:24
  SPEAKER_00: So this wasn't a cybersecurity audience.
• 0:26
  SPEAKER_00: There were cybersecurity folks in the audience, but the audience was mostly made up of AI professionals.
• 0:32
  SPEAKER_00: So AI developers, AI enthusiasts, people who are starting companies with AI, things like that.
• 0:38
  SPEAKER_00: So we were doing the panel, the four of us that were on the panel coming from a cybersecurity background, trying to talk to people who were not necessarily cybersecurity professionals about governance of AI, things like that.
• 0:52
  SPEAKER_00: So a little bit different.
• 0:53
  SPEAKER_00: What was interesting, what came out of the panel and made me really think and challenged my brain, was the use of AI and the innovative use of AI and the need to take some risks to be innovative with AI.
• 1:11
  SPEAKER_00: So let me explain that.
• 1:13
  SPEAKER_00: So Tommy Todd and I were on the panel.
• 1:16
  SPEAKER_00: He and I, longtime friends from AcuVot pre-optive days.
• 1:20
  SPEAKER_00: We come with that CISO background, that peer security background.
• 1:24
  SPEAKER_00: Joe Alapat was on the panel.
• 1:27
  SPEAKER_00: Joe is a founder of Lionguard and comes from that security background, but also, you know, more of a founder these days and working on product stuff and that kind of thing.
• 1:39
  SPEAKER_00: And then you had Salim Juwala, I think.
• 1:42
  SPEAKER_00: I'm sorry, Salim, if I mispronounced your name.
• 1:44
  SPEAKER_00: I didn't know him prior to this panel, but he comes from a lot, he has a lot of marketing background.
• 1:50
  SPEAKER_00: So what he was saying on that panel was that he was pretty much the only one on there who was taking more of that risky behavior type of mindset where, like, yes, we have to put guardrails around AI if we're gonna, you know, do this stuff right, but we have to be willing to take those risky moves and be risky with our some of our behavior and AI in order to innovate.
• 2:20
  SPEAKER_00: And Tommy and I were kind of like, well, yeah, but you know, we we tend to that CISO level.
• 2:26
  SPEAKER_00: But what it started making me think of later, and and I'll link to Salim's LinkedIn post that he put in there, he was really challenging us, and I think in a good way, because I think what Tommy and I were kind of doing was leaning back towards that we're the office of know, or the department of know from a security perspective.
• 2:47
  SPEAKER_00: And it it really made me feel like later when I started thinking about it that I was kind of going back to my old ways a little bit of hey, we can't we can't be doing this stuff, we can't be putting uh putting so much risk in place because we've really got to guard this, and you know, I I can't connect this AI to this, or I can't connect this AI to that.
• 3:10
  SPEAKER_00: And I I think there's probably a happy medium somewhere between what Tommy and I were saying and what Selim was saying.
• 3:18
  SPEAKER_00: Um he would I think he was probably leaning a little bit too far to the risky side, and we were probably leaning a little too far to the non-risky side, but it it it still comes back to the fact that in order to innovate, you have to have risk in there.
• 3:35
  SPEAKER_00: And the security department is not there to stop that behavior, they're there to make sure business is able to do what it needs to do, they're there to enable business, they're there to take what the executives say is acceptable behavior and move forward with that.
• 3:57
  SPEAKER_00: Now, is there such a thing as too risky of a behavior?
• 4:00
  SPEAKER_00: And if you, you know, you don't want to be in an organization as a CISO or security management or whatever when the behavior is a little too risky.
• 4:09
  SPEAKER_00: I mean, yeah, but that's not up to you as a security person to decide for the business.
• 4:14
  SPEAKER_00: It's up to the business to decide for that.
• 4:17
  SPEAKER_00: So if you don't want to be involved in that, or if you want to make sure you're covered, I mean, there are steps you can take or you can just get out of that that business, but it's not up to us to say no to them.
• 4:28
  SPEAKER_00: So I want to say thanks officially to Salim for kind of making us think about that a little bit more during that during that panel, and also making me think about it more by posting later on LinkedIn.
• 4:44
  SPEAKER_00: Again, I'll I'll put we'll put that in the post, in the show notes here, that you know, he was kind of taking a contrary view from the makeup of that panel, but not a contr not a contrary view to what most people are trying to do with AI.
• 5:01
  SPEAKER_00: And again, there's there's somewhere in that middle that we need to meet where we don't take too risky behavior, we don't hook it to everything and just let AI have free reign.
• 5:11
  SPEAKER_00: But at the same time, as security people, we need to be open to letting that innovation happen, and we need to be open to letting some of that risky behavior happen.
• 5:19
  SPEAKER_00: And it's our job to be to protect, but also to be resilient so business can move forward.
• 5:26
  SPEAKER_00: And if there is a breach or if there is a failure, we can recover from that quickly.
• 5:30
  SPEAKER_00: So, anyway, just thought I would uh pass that lesson back along since uh we're supposed to have learned that lesson a while back, and sometimes we revert to old bad behaviors.
• 5:40
  SPEAKER_00: So, all right, everybody, thanks.
• 5:41
  SPEAKER_00: See you on the next one.