|
Is cybersecurity now the number one priority for CIOs? Regardless it has a new urgency and those in cybersecurity should not “waste a crisis,” he suggests.
San Francisco-based Corelight, which offers open-source threat-detection technology to secure computer networks, traces its underlying technology to Lawrence Berkeley National Laboratory. Dye joined Corelight in 2018 as a chief product officer, advancing to CEO in 2020.
Here are edited highlights from the discussion.
WSJLI: Is cybersecurity a growing priority among business leaders?
Dye: I think there's been multiple things that have made security even more relevant in the last six months.
Number one was the adoption of AI within the infrastructure, because now AI, internal AI is the new shadow IT. It used to be SaaS products, and now it's AI. Who's using this stuff? How do we get ahead of data breaches? Whether it’s, you know, actual insider threats versus employees just behaving stupidly because they don’t know what is going on.
InfoSec doesn't want to be the Department of No, so it’s help me fill this visibility gap of who's using what and where's my shadow AI, my new shadow AI problem. That's been big trend number one.
Big trend number two, the Iran war. If you look at what's happening there, the counterattacks have really bridged from purely targeting military assets to targeting civilian assets. And so that means that many folks, many industries, that would have said, hey, look, you know, relatively small Middle Eastern conflict, not my problem. Actually it is your problem because they're targeting civilian assets.
And third is the awareness of the Glasswing and Mythos piece. When organizations like The Wall Street Journal are covering this at a level that the CIOs, the CEOs, the audit committees are getting educated, that they have a fiduciary duty now to go talk to their CISO and say, what does this mean for us? What do we need to do differently?
And then that, again, let's not waste a crisis. So is that a relationship change? No. Is it a relevance change? I think yes, just because the converged series of compelling events hits critical mass to change the cadence of the conversation.
WSJLI: Paint a picture of attackers vs. defenders in this new AI-powered cyber landscape.
Dye: Think of every story you've ever seen or covered about how engineering teams are using AI. Apply those all to the attackers and that's the right mental model.
They're able to fill coding skillset gaps. Like, oh, I don't know Ruby on Rails, and I need to for this particular project. And gee, my AI just helped me, right? So they're getting a bunch of assistance there. They're also able to actually automate big chunks of the attack cycle. Even mid-last year, we were getting stories from our customers that the time from a new vulnerability being published to it being exploited live in the wild, that used to be three weeks. That had turned into two hours.
That is ridiculous in terms of kind of speed and the defensive ferocity that you have to have to kind of stay on top of that. Which, by the way, is the compelling force that's driving this, the defenders need to automate. Because you can't fight that with headcount.
WSJLI: Machine speed versus machine speed.
Dye: Exactly, you gotta fight fire with fire. But the the risk tolerance of these two groups is very different, right? The defenders, actually, their jobs are on the line, they need reliability, they don't want to have a rework problem where the bad AI is worse than the new AI, right? But the attackers are like, get me in the zip code, you've saved me 50% of my time, 80% of my time.
WSJLI: Are we seeing a new level of sophistication in these attacks?
Dye: It is speed, not novelty. The only thing that's novel is the speed at which they're happening. And this is even for the vulnerability exploits. The most common comment I've heard is: What they came up with wasn't pretty or elegant, but it worked and it was fast, right? Dumb and effective if you can get an exploit in an hour in a way that your defenders can't possibly get ahead of the patching of the defense on it.
If stupid works, it ain't stupid, right?
— Tom Loftus
|