Episode Introduction

What happens when the attackersand the defenders both get the same new tool on the same day?

In this episode of WithGratitude, Stephanie Hogen and Allen Debes sit down with Brian Gallagher,President of Koniag Cyber, and Matt Meyers, Senior Manager of AdversaryOperations at The Home Depot and Deputy Lead of Connecticut's Cyber IncidentResponse Team.

You'll hear what it used to taketo exploit a leaked API key, and how little it takes now, why the mostdangerous thing most of us do in a workday is approve a prompt we never read,and hear them explain why they're not shutting down AI experimentation and areinstead building a safer playground for it.

Whether you run a security team,run a business that depends on one, or just want to be a little harder tocompromise this month, this conversation is a clear look at who's the cat,who's the mouse, and what hasn't changed at all.

Let's jump in.

Transcript

[00:00:56]  Stephanie Hogen

Good afternoon and welcome to10,000 Feet, the Vervint Podcast. We're continuing our special series withgratitude where humans and AI take us next. The idea behind our series issimple. The best technology works and it creates lasting human gratitude forthe people who use it, the teams who build it, and the customers they serve.Many of you know October is Breast Cancer Awareness Month, but what you may nothave known is that it's also Cybersecurity Awareness Month. So in this episode,we're taking the conversation somewhere we haven't gone yet. And today we'rejoined by people who have built their careers around thinking like attackers.I'm Stephanie Hogen, Chief Consulting Officer, and I'm joined by my fellowhost, Allen Debes, CEO of Koniag Capital, along with two special guests. BrianGallagher is the president of our cyber team, former Secret Service and authorof Stay Cyber Safe: What Every CEO Should Know About Cybersecurity, and MattMeyers, senior manager in adversary operations at The Home Depot. His teamscover red teaming, threat intelligence, deception engineering, and purpleteaming. And for a common civilian like me who learned about cybersecurity fromWreck-It Ralph to Ralph Breaks the Internet, these folks are the people whoattack their own companies so that real attackers can't find things they cantake. Matt has also spent 25 years in the Air National Guard where he is deputylead of Connecticut's Cyber Incident Response Team and works alongside alongstanding partner nation as it continues to grow its cyber capabilities. SoMatt, I'm gonna start with you. You do this work twice over, first for one ofour largest retailers in the world, and second in uniform for your state andcountry. You're a busy person, so thank you sincerely for being here. You toldus when we first met that you enlisted in the Air National Guard on August 15thof 2001. 27 days later, the world changed, as we all know. Take us back to thatmoment for a minute and how it eventually led you into this line of work.

[00:03:00]  Matt Meyers

Yeah, so thank you. Thank youfor having me. I really appreciate you having me here on this podcast. I'll goback to, you know, August 15, 2001. I was joining the Air National Guard. I wasalways a little bit enamored by the military. I remember being a little kid,taking apart technology like VCRs and stuff and laying them out in like acommand center. So I've always had the thought that military is something Iwanted to join. And I knew that there was also a chance that, or theopportunity presented itself that it would help pay for college. So I knew Iwanted to go to college and I was always enamored with the military. So Idecided, why not join the Air National Guard? It was the best fit to handleboth of those. And I joined thinking, I would experience what the guard has tooffer. I'd get school paid for and then see what happens next. 9/11 came aroundand I kind of, that kind of changed things. It took me, took us all bysurprise. I think we can all go back and remember that day, but I think it alsokind of, I don't know, I don't want to say it lit a fire, but it kind of mademe realize that it's going to end up being a lot more than I really anticipatedor bargained for. But going on 25 years now, I think back, and it's the bestdecision I ever made. I started out initially in munitions, so building bombsand missiles for the A-10, ended up deploying twice. Then things started tochange a little bit on the DoD side. Trying to fast forward a little bit here.I ended up getting trained in cyber in around the 2007 timeframe. And that kindof led me to my civilian career where I was really fortunate to join a SOC whenit was brand new. They had a lessons learned where they realized we have allthis technology in place. We don't really have the people in place to monitorthe technology, the alerts that stem from it. So I got real lucky in that sensewhere I got to do just about everything that you can think of as far as cyberis concerned over about 11 years at General Dynamics. And fast forward and hereI am, you know, 25 years later. Working at The Home Depot, enjoying everyminute of it, and still in the military, which is kind of nuts to think that 25years later, I'm still in, and I still don't believe it.

[00:05:28]  Stephanie Hogen

What about you, Brian?

[00:05:29]  Brian Gallagher

Yeah, well, Matt, so one, my dadwas in the Air Force Reserves as well, and at the end of his career, worked atan A-10 base. So I love the A-10 Warthog, absolutely. But it's ironic becauseyou and I kind of have the same timeline on things. We both pretty much hit our25-year mark or so in industry. And for me, 9/11 was also a major impact on mylife. So you mentioned that everybody remembers where they were, but on 9/11, Iwas working outside of DC as an EMT and firefighter. And when the attack happenedand the plane hit the Pentagon, units from my station were dispatched and wentto the Pentagon. And later that night, I was in New York at Ground Zero with abunch of paramedics. And that just shifted my whole view of the world. So aboutone year later, the following year, I joined the US Secret Service and reallycontinued my career serving people and trying to protect people in everythingthat we do. Unfortunately, the Secret Service does not have a reserve program.If they did, I would be on it or part of it. So 2013, I got one of those joboffers that were just too good to say no to and left and went into the privatesector, really focused on frontier technologies. And that shifted intocybersecurity. I have been trying to get the Army to take me, though, in theirnew reserve group for tech execs, Detachment 201, but they haven't called meback. So I guess it's because I'm not the CEO of Google or CrowdStrike orsomething like that. But anyhow, so with all that being said, I understand yourstruggle when it comes to trying to serve the country and feeling this missionand fit to doing what you're doing, but also wanting to make money in thecommercial world and really provide for your family. So let me throw a questionback to you. After 25 years, you could retire from the military. What's keptyou in uniform for so long, continuing to drive that mission to serve with whatyou're doing today?

[00:07:42]  Matt Meyers

Yeah, I think about that often,right? Especially every year when PT fitness standards come around and I haveto realize I have to stay fit and make sure I can pass my fitness test. But itreally, it comes down to serving with a lot of the people that I've served. Icould just think back to some of the relationships that I formed when I firstjoined. I look at a lot of those individuals as family members. I've met suchamazing people throughout my career and on the deployments I've been on, thedifferent jobs that I've worked with. And then, you know, most recently, so Idid, just to give a little bit more context, I did 20 years enlisted and wasabout to retire enlisted, but then I had two friends send me a position that Iwasn't aware of to, as we say in the military, right, cross over to the darkside and commission and become an officer. They both sent me that. They didn'ttalk to each other, but they both sent it to me knowing that I was kind ofright for the position. And they were right. I looked at it. I'm like, this isperfect. This is exactly what I wanted to do. And I applied for it and I endedup getting it. And just being a part of the mission that we have right now tosupport the state of Connecticut from an incident response perspective. And thenour Uruguayan mission, it's just right now, it's the mission that's mostimportant to me. So continuing to use the knowledge that I've gained in mycivilian career to help support the Air National Guard and kind of vice versatoo, because there's, we have a really phenomenal team in Connecticut where wehave someone who works for Cigna Health Group, right? We have someone who worksfor Travelers Insurance and we're all kind of sharing ideas on drill weekendand I think that only pushes all of us forward. So really, it comes down to thepeople and the mission that's kept me in this long, which, and there's no endin sight for me.

[00:09:41]  Brian Gallagher

Kind of like a public-privatepartnership, just in a different way, being able to pull the best out of bothworlds. That's great. Thank you for sharing that.

[00:09:51]  Stephanie Hogen

Yeah, so one of the things wehad talked about when we first met was this idea of you flip AI to be IA andyou talked about it being your idea assistant. What does that look like whenyou're looking at a real problem?

[00:10:10]  Matt Meyers

Yeah, so I mean, currently Iwork remote, right? So I don't have someone that I can just walk over and talkto about an idea. I mean, I guess I could chat through Teams or Slack orsomething like that. But let me, can I go back a little bit? I want to make ashout out to someone who I consider set my career up very well. He was a mentorI had back at General Dynamics when I first started. And he was just aphenomenal mentor. I remember walking into the security operations center,looking at all these logs, not knowing what I was really looking at. He wouldgo home, he would, he would send in attacks at the environment and create logsand be like, hey, did you see anything last night? And then I had to dig in alittle bit more and I finally found him and I knew he was kind of doing that asa test. But I just say that because having a mentor like that set my career upamazingly. I wish a lot of us had a person like that in our lives and I know alot of us do, but nowadays being remote, having these AI tools, and like Isaid, turning that into an idea assistant, like you mentioned, it reallybecomes almost like a mentor or someone you can bounce. I say someone, becausesometimes you start talking to your favorite AI tool, you start thinking thatthere's someone on the other end. But they're really, they're really, you know,it just becomes that, that board that I'm trying to think of the word, I can'tthink of it, but you can have that talk, right? You can say, hey, this is anidea I'm having or this is a problem I need to solve. What are someassumptions? What are some things that maybe I'm not really thinking of? And itjust really leads you down a path of maybe some new ideas or some things youhaven't thought of. So I mean, that's mainly what I use AI for. So that'sturned into flipping it a little bit. I think also creates more of like a humanutility to AI. It's not so robotic. It becomes just another coworker.

[00:12:11]  Stephanie Hogen

Last year, we attended the GrandRapids Tech Week session, and Steve Wozniak was the keynote. And he called AIactual intelligence. So he was trying to play on it too. And it's very similarto yours. It's like using it to amplify or accelerate what you do versusletting it take over and keeping that human in the lead or human in the loopare kind of words we use.

[00:12:32]  Brian Gallagher

I think a lot of people aredoing that. I always flip it as well and call it intelligence augmentation andlook at that, creating that human AI partnership piece that plays into it,which is kind of cool. But I want to ask you, Matt, when we were talking priorto this and kind of prepping for this, you walked us through kind of a leakedAPI example. And I want to know if you can kind of talk about that a little bitand really what it took to exploit that 10 years ago compared to what somethingnow, you know, using AI and tools and things that we have at our hands today,you know, explain, sort of jump back 10 years and play back to the future andthen back to today and talk about those differences.

[00:13:30]  Matt Meyers

Yeah, so I've worked, obviouslyone of my teams is cyber threat intelligence. So I hear about a lot of eventsor incidents that happen throughout the industry where credentials were leakedsomewhere, right? When I think back about 10 years ago, API tokens, keys, theyexisted, they were there, but I think it took someone that was very familiarwith the technology to realize, hey, this random character, 26 character wordor whatever it looks like is actually, you know, is actually something that canauthenticate you to a service or give you access to data that you're notauthorized to have access to. And only someone, like I said, that had theknowledge, the experience to one, recognize it. And then two, once theyrecognize it, you know, taking that and doing something with it takes a lot ofeffort, takes a lot of knowledge to create a script that, they have tounderstand how the API works or how the access works. Now, nowadays, you know,you can have AI, you can dump a bunch of data in your favorite AI tool, see ifit recognizes those patterns for you. Because they all tend to have similarpatterns, GitHub, for example, starts with certain characters. So I'm notsaying humans can't recognize it. It's just easier for AI to recognize it inlarge data sets. So then you can ask, what is this? Or now that I have thisaccess to this API, how do we test it? How do we know it works? And it'll writeup a script for you in two seconds that is like, we'll test and see if it'sstill valid. And then based off, if that is still valid, how about write me ascript that, you know, 'cause it's gonna know based on external documentationor public documentation of how that API works. And it's gonna know exactly howto use every part of it and will write the tool, the script for you to go outand use it. So it's just, it's really like supercharges the ability withsomeone just with a little bit of intent, right? As compared to someone wouldhave to have tons of experience and knowledge and time. And so.

[00:15:51]  Brian Gallagher

I think back to even five yearsago when SolarWinds happened and it taking hundreds of people weeks just goingthrough line by line by line of code to find what they were looking for. Soamazing how quickly things change.

[00:16:06]  Matt Meyers

I'll never forget SolarWinds. Iwas responsible, responding to an event related to it, and it kind of ruined myChristmas. I'll never forget that.

[00:16:17]  Allen Debes

Well, it's an incredible storyfrom both of you, and I just have to jump in and first say thank you both foryour service. You mentioned that we all knew where we were when 9/11 happened.I certainly do, and I was grateful then, all the way through to now for youguys' service. And anybody that came near that event, it changed our livesforever. And again, thank you both. And you touched on something toointerestingly, Matt, you talked about AI in the third person as a person therefor a couple of minutes. And that is the genesis of this Lasting Gratitudepodcast, is that I found myself thanking software the first time in my lifewhen interacting with Claude. And that led to this idea of lasting gratitude asthe way forward in this new and unique time, this transformational time in ourhistory with the advent of these tools, AI tools. So you're not alone instarting to speak with it as a human, even though that's not the best idea. Interms of, for all of us that aren't in security, you start with you, Matt, thenyou, Brian. For those of us that are not in security, that live in that world,who are interacting with AI tools, interacting with technology every day,what's the one or two or three things that we should do differently this monthto be more secure, to behave in a more secure way, with this technology.

[00:18:04]  Matt Meyers

Yeah, so I mean, for me, I thinkit mostly comes down to the basics. Like when I look back and read about a lotof significant events that have happened from like a cyber perspective, right?You can really kind of, you can trace back to the root cause and most of it is,you know, either the data was there and nobody was looking at it, or the datawas there, they didn't know what they were looking at, or just the visibilitywasn't there and it should have been. So doing the basics, I know not a lot ofpeople listening to this might not be trained up on certain protocols, butthere's an LDAP protocol. And I tried to flip that acronym to LFAP, so leastfunction, access, and privilege. So I think if you kind of take that approachwith any system, right? Try to only provide the least amount of data possible.Only ensure that if you're building something that has the least amount ofaccess. And if you really live your life by the basics of trying to only usethings or some technology to, I guess, I don't know, just try to do the basics,make sure you're secure on your account, strong passwords, MFA, and a lot ofthat, you'll realize that you'll still be in a good place from a cybersecurityperspective.

[00:19:29]  Allen Debes

Helpful.

[00:19:30]  Brian Gallagher

Thank you. I always think it'sgreat when two cyber people come up with the same answer, and I didn't knowAllen was going to ask that. So I'm always preaching about identity access andidentity access management in our terms. And for the tech people listening tothe call, this whole concept between human user interaction and non-human userinteraction and what that has access to in a system. For the everyday users,the people who are listening in and just want to know how to do something alittle bit better, I just think about how easy it is for me when I'm usingClaude in PowerPoint or ChatGPT and something pops up asking a data or anaccess related question and you just want to pound the enter button giving itapproval or saying, you know, approve all because it annoys you, but you don'trealize that you're actually opening up everything to that agent at that pointin time. And so, you know, understanding your data and what you're giving itaccess to, and in an enterprise environment, what levels of control you can putaround that to safeguard it, because the human nature is just to pound thatbutton and say quicker now, which opens up a whole door to other problems.

[00:20:53]  Stephanie Hogen

I thought you were going tostart with two cyber guys walk into a bar. That's where I thought we weregoing.

[00:20:58]  Brian Gallagher

We're going to end with thatone, so we were trying to...

[00:21:03]  Stephanie Hogen

I was really excited.

[00:21:06]  Stephanie Hogen

So acceleration is not a newconcept on this front. One of the things that I thought was really interestingwhen we met the first time is this has unlocked an ability for you to see a lotmore, a lot faster. And yet when you start a year, you have your fixed budgetand your fixed set of XYZ number of humans, but now you know 10 times more,whatever number, you know that much more heading into the year. So how do yousort of calibrate your roadmap to the people and the dollars now that you knowso much more? And that question is for both of you.

[00:21:44]  Matt Meyers

I'll let you take that onefirst.

[00:21:46]  Brian Gallagher

Yes. So from a businessperspective, I think it always comes into aligning what your businesspriorities are, or your mission priorities from a government perspective. Soyou have to know what ultimately, not just your IT or security department isfocused in on, but what's the entity as a whole trying to accomplish. Now wecan use AI to look through all of that data, even do estimates and predictiveanalysis and things along those lines to help gauge where I can get the mostimpact and the most bang for my buck on creating a change or implementing somesort of new initiative into the process. But I find in so many cases, securityrepresentatives don't understand the business aspect behind what's going on.And so they're isolated kind of with blinders on, which makes their job muchharder to do. I used to always say, protecting the president is easy. All wehad to do was put him in a plastic ball and lock him into the basement, notever let him get out, and nothing was going to happen to him. But he couldn't dohis job that way. And I think the same thing is true in the business space. Wecan put all these safeguards up, but if our sales team can't go out and selland our finance team can't do what they need to do in the back office, then thebusiness is never going to move forward and achieve the objectives that it'sset there to do.

[00:23:26]  Stephanie Hogen

That's great.

[00:23:28]  Matt Meyers

Yeah, absolutely agree. I think,I think too, with AI, what you'll find is that, at least for me, in my opinion,it allows you to look at larger data sets, connect more data points together,and maybe it'll open up, well, I know it'll discover more problems for sure,maybe things that weren't so easily identifiable before just because of thesheer size of the data or the sheer amount of the data that you're looking at,so it may bring up more problems than you're really ready for. But at the sametime, I think it also empowers people to maybe not rely on a third party or anew tool purchase or something like that to solve the problem. You know, aslong as the data is there, AI is great at building you a tool that will helpmaybe solve your use case. You know, I think it really depends on the use case,but I think it just, it can empower you to do more with less. And of course,like I said, it's going to come up with newer and different problems, buthopefully you'll still have that same AI power to help solve the new problemsalong with maybe some of the other ones that you had.

[00:24:49]  Stephanie Hogen

Allen, is there anything youwanted to add to that or ask?

[00:24:53]  Allen Debes

Well, you bet. I think it'sgreat answers. Here we do talk quite a bit about the human-AI partnership andhow do we make sure while doing more with less and using the tool to buildtools for us, using AI to build the tools for us, at what point do we continueto ensure that the human really is at the forefront? How do you guys come tothink about that from a security perspective, Matt then Brian? Because yes, itis awesome that the tool can build a tool, right? At some level, I think therestill has to be an overwhelming sense that the human is still at the forefront.Do you have any reactions to that from a security standpoint, and how we makesure that human stays at the center.

[00:25:51]  Matt Meyers

Yeah, I think the humanabsolutely has to be a big part of it. One, I don't think AI is going to comeup with the ideas on their own, right? Like you still have to give it an idea.You still have to understand what your intended outcome is for whatever problemyou're trying to solve. As far as AI is concerned, they're just going to answera question in the way that it wants to satisfy what your question is, notnecessarily to achieve your intended outcome. So I think having the experienceof humans, take myself, for example, right? I've been in cybersecurity since2007-ish, right? And I've been, why I feel like I love cybersecurity is I havea passion for it and I have tons of experience, hands-on experience to where,you know, there aren't a lot of times where a new problem is brand new to me.It's like, oh, I think I've seen this before. I've seen this type of issuebefore and, you know, this is an outcome that maybe helps solve that problem.So you still have to guide. You still have to be there to evaluate the outputsand guide your favorite AI tool to a place where it's going to meet yourintended outcome. I hope that makes sense.

[00:27:11]  Allen Debes

That does make sense. And Ithink that's really important for the audience and important for all of us tobe conscious of. Brian, any additional thoughts?

[00:27:24]  Brian Gallagher

Yeah, I think everything intechnology, I mean, even if you stop and look around the room that you're innow, everything now seems to have some sort of tech in it. And so that allboils down to some element of binary code and a zero and a one that driveseverything. And when you think about how those things are working and you thinkabout, you know, larger network systems and all the stuff that's feeding intoit. I mean, your mind literally can't grasp how much log data and data all ofthat stuff is producing that has to get sifted through. And so, you know,bringing AI into that as an example, to be able to just instantly consume itand come out with information is completely game changing. Now, the humanpiece, though, is just because AI told me it thinks that it found a problem, Igot to be careful on hitting that alarm or shutting down the factory line untilI'm able to come in with the appropriate person and verify what AI told me isactually true, because the consequences of that are huge if AI was wrong or itwas hallucinating or picked up some misinformation for some reason. And sothere's always the flip side is I may never, ever have seen that alert on myown or with a team of 100 people if I didn't have AI doing it. One otherexample, real quick, just from a medical perspective, I mean, you could take abunch of AI and you can say, hey, go try to solve the problem or find the curefor cancer. And eventually AI may do it and say, here it is. But you still needresearchers and all of those doctors and all of those people to go in and say,okay, we have the answer. How did we get to that answer? And let's double,triple check every piece that went into that. But we still found the cure tocancer. So it's that human AI partnership.

[00:29:38]  Allen Debes

Right. Yeah, those are greatexamples. Thank you both for that. Because I think that's, yeah, it's a hugeaccelerator, but it's not the end, right? I don't think it ever really will be.But go ahead, Stephanie, back to you.

[00:29:53]  Stephanie Hogen

No, I was just going to say,Matt, one of the things that you told us you were struggling with, or one ofthe hardest skills that you were trying to translate, was ensuring thattechnical, the technical makes its way through to the people who decide whatyour budget's going to be. And we don't have time for the story, but Allen hasa great story about how he goes to Claude and says, make this PowerPoint for asixth grade audience. So can you talk to us about how AI has changed theconversation with your leadership now that you're talking about things at amuch faster and greater scale?

[00:30:27]  Matt Meyers

Yeah, I have the same story aswell. You know, I feel like I have to do that from time to time, not onlybecause part of my mission on the military side as the deputy team lead is wehave a huge augmentee of non-cyber people who are, who we can call in the eventof a large scale cyber incident. So they don't, they don't practice cyber on aday-to-day basis. You know, we have quite a few people who are police officersor medical workers, kind of, it spans the gamut there. So we have to bring themtogether from time to time and provide training. And we really have to break itdown to the most simple level to make sure that the ideas that we're trying tocommunicate are being captured by the audience. And I have to do a similar, Ihave to have a similar approach with any of the Uruguayan missions that we'reon as well, just solely based on the communication translation there. And thenI think, too, when it comes, I've been pretty fortunate in my career where someof the leaders I've had have been fairly technical. So I can usually talk tothem in a technical manner. But then when you bring someone else outside of thecyber realm and you try to explain to them a business risk around a certaintopic, say like shadow AI, for example, having these tools and lettingeverybody, you know, empowering everybody in the business to build their owntools is great, but that introduces a whole bunch of risks. So being able tomaybe bounce your ideas or how you plan on communicating the risk against yourfavorite AI bot and saying, hey, you're this person, you know, give it thatcontext. You're this person that runs this business process. I need to explaincyber risk to you. You know, this is how I plan. Does this make sense? Andthen, you know, see if it comes back and says that aligns well with, you know,its business processes, or it can understand what you're trying to communicate.You know, it just becomes a really helpful tool to ensure that the messageyou're trying to communicate is framed appropriately, because it is reallyeasy, and I'm definitely guilty of this, of, you know, talking, I guess, tootechnical when I need to understand that there are people in the room that maynot get the technical things that I'm talking about. It took me a while, I wantto say probably 10 plus years to kind of figure that out. And I think I'vegotten pretty good at it, but there's still lots of room for improvement there.

[00:33:09]  Stephanie Hogen

You set us up well for kind ofwhere I was going to take it next, and you talked about that shadow IT. And so,you know, Brian, I know I'm much more familiar with your work because we get towork together every day. But can you both of you give a perspective on whyyou're not shutting down sort of the creativity and the experimentation that'scoming along in this kind of AI journey as cyber leaders, which that also feelsreally scary to me, is just like, hey, everybody, go have fun. But sort of whyare you not shutting it down, and why are you instead saying, let's just makethis more secure? Can you both, either one of you can go first, but I wouldlove to hear about that.

[00:33:48]  Matt Meyers

Yeah, I'll go first. I thinkI've always taken the approach as a leader to try to empower those on your teamto be the best that they can, right? And so if it means they need to use an AItool to build their own tool to help solve a problem, that's phenomenal. And Ithink it's not only happening in cyber, but it is absolutely happening acrossthe entire business. So if you can use the tool like AI to empower everyone tohelp solve problems faster and maybe more thorough than before, that's good foreverybody. It's just obviously that introduces quite a few potential risks. Soif you can, in a perfect world, and I know none of us live in that perfectworld, but provide a safe space, a playground where anyone across the businessis, if you want to build a tool that'll help solve your problem, do it thisway, right? Do it here. And that way we have all the measures in place thatensure that as you're building it, security protections are being met.

[00:35:03]  Stephanie Hogen

So I actually want to change myquestion for Brian then. So how do you govern something you're rooting for? Soyou want this to happen, but how are you putting the right safeguards in placefor the playground?

[00:35:15]  Brian Gallagher

Yeah, I'm happy to answer that.Before I do, I think just explaining what shadow AI or IT is could be helpfulto listeners, mentioning that. So, you know, the concept of shadow IT or morespecific shadow AI really means that your employees are going to want to usetools regardless of whether or not you allow them to use them. So perfectexample could be your business does not allow for ChatGPT or Claude to be used.Well, guess what? Your employees are still going to use it. They're going to beusing it on their phone. They're going to be using it at home. We've seen thata lot in software development where AI came in specifically related to creatingcode. And several years back, we said either people are, 100% of developers areusing AI, or the ones that aren't are lying. I mean, they just had to be usingit one way or another. So the governance piece and the kind of that correlationto playground comes into how do I allow that to happen, knowing it's going tohappen regardless of whether I say yes or no. So I have to set up some sort ofplayground as a word, or governance structure, or way to allow that to be donein a manner that's best for the company. And so, I always, I mentioned thisbefore, but I always pull things to risk and I want to look at what thebusiness risk is in a situation, and getting sued for violating confidentialdata is a pretty big business risk. I mean, those are millions and millions ofdollars of potential business harm that can come to the company. Or releasingintellectual property out to the wild, giving it to companies like Anthropic orOpenAI. Those are massive concerns. So what I try to do is, yes, we talkedabout identity access management in that part, but I really want to make surethat the data that's going into the systems is secure in a way where we own itand we don't have to worry about violating any type of data privacy type ofthings or exposing intellectual property, which means I have to give myemployees the ability to use that in our environment. We have to haveenterprise licensing set up and configured to where they can use it. Becauseagain, they're going to use it anyways and that's where you see the problem. Soas business leaders and CEOs and just organizational heads, really, it startswith you. Your cyber guy can do whatever he wants, but, or whatever, your cyberguy can suggest whatever he wants. But unless you're willing to put the dollarsand cents and the budget in place, you can save a lot of money with AI, butthere's an opportunity cost with it.

[00:38:25]  Stephanie Hogen

Thank you.

[00:38:26]  Allen Debes

Yeah, right on. Thank you. Youknow, you've already touched on this a bit, both of you have, but I'll put aperhaps a finer point on it with this question. Every CEO, myself included,anybody listening in that happens to be in that role, is really, I think,largely saying to an organization, use AI, learn it, use it to the sort ofoptimal benefit to get efficiency and help us grow our business, right? And oh,by the way, you know, the oh, by the way, don't create undue risk. Don't breakanything. So if you think of it from that lens, for most people in my seat,what do you recommend is the sort of that minimum? And we've touched on itthrough several threads here, but truly the, and maybe the answer, Brian, isthe enterprise licenses, I don't know, but the minimum that has to be in placefor the floor of protection so that we can keep going as fast as possible on asecure surface. Matt, maybe you want to go first. How do you think about that?

[00:39:33]  Matt Meyers

Yeah, for me, I think it'simmediately going to come down to visibility. If I approach the problem fromlike a red teamer perspective, the first step is usually enumeration, figuringout what you have or what your target is and determining what is the next step.And I think the same goes with that. Like I mentioned earlier, I would almostbet a paycheck that nine times out of 10 significant events in the past 20years, cyber events, all went back to a visibility issue. So if you can't, ifyou don't have the visibility, you can't diagnose the problem or the root causeand you can't put controls around it if you don't have the visibility. So forme, it'll always go back to visibility because if you can see the data or youcan see the access somewhere, then you can at least respond or determine partof the problem or maybe part of what is happening. And then you can also try toput controls around that.

[00:40:39]  Allen Debes

Got it.

[00:40:41]  Brian Gallagher

I think that's a great response.And I think for the non-cyber people, understanding what visibility means andhaving certain tools where you can have access into what needs to be seen. Andcyber can be very, very confusing. I think about when you go out to one of thebig cyber events or Black Hat in Las Vegas or something, there's thousands ofvendors with different tools that are out there trying to do different things.Yeah, I think that visibility is definitely that starting point for at leasttaking that corrective action with the policy around it too.

[00:41:23]  Stephanie Hogen

Yeah. Thank you.

[00:41:24]  Allen Debes

Right on.

[00:41:24]  Stephanie Hogen

To take us home and into kind ofthe end point of this segment. One of the things that you told us, Matt, thatmade you light up and I think connects to our With Gratitude theme the best isyour work with your longstanding international partner. So could you just giveus the quick 411 on that partnership? I'm not even going to try and say itbecause Allen and Brian know that is like one of the words I can't say. So youcan say it for us. Thank you. I even, you guys, I Googled it like six times.I'm like, I can do this, but I can't. I'm sorry. I think specifically the storyyou told us about the AirPod translation. So if you could tell us a little bitabout the partnership and then how technology and how AI advancements have madethat more interesting and more exciting over time.

[00:42:15]  Matt Meyers

Sure. So for those that aren'taware, every state in the United States, as far as I'm aware, participates in astate partnership program, the military, right? So they usually have somecountry out there that the state partners with from a National Guard perspective.So for Connecticut, Uruguay happens to be our partner and they've been ourpartner for, oh man, I think it was 20 or 25 years. I could be a little bit offon that. But over the last 20 or 25 years, we've really had this partnershipand we've tried to work together with the Uruguayans from basically everymilitary aspect you can think of, all the way from infantry to flying missions.And now cyber has really upticked in the last, I don't know, maybe seven or soyears. So I've been going to Uruguay at least once a year for the last four orfive years. It's a long flight. I love the country. It's beautiful. We usuallygo to Montevideo when we do visit. The people are amazing. And usually it's aninformation exchange where we go through best practices from like a securityoperations or an incident response perspective, and then they share kind ofwhere they're at. We go back and forth and share lessons learned. And up untila few years ago, we would have to rely on a translator, right? Whether we broughtthem or they had one. And there's always that delay with translating, right?Someone talks and you have someone who on the side who translates the message.They're not cyber. So there might be a lot of cyber related information thatgets kind of lost, although the funny part is they don't have a word for likefirewall, so that, you know, that's easy. If you hear the translator sayfirewall, you know exactly what they're talking about. So, but with AirPods andlive translation specifically, you know, you can almost have a one-on-oneconversation and it works really well. It's immediate. And if, even when you'rein a group setting, you know, you can pick up on a few different things thatmaybe the translator didn't pick up on. And then, you know, the translatormight fill in a little bit more context. So I think being able to have a normalconversation and not having that like weird translator three person whereyou're talking to the translator and then you're talking to the person reallykind of breaks down barriers and it, you know, it speeds up the communicationso you can talk about more. You're not just solely talking about cyber, forexample. You can open up a little bit more and learn about family, customs,about the country, all that stuff. So I think it's really kind of mind-blowinghow well it does work. And really kind of thankful for it too. And it's funny,once it came out, I told the rest of our team and we all, you had to get like aspecific AirPods version, I believe, for it to work. And then, you know, we allwent out and grabbed one and we're like, you know, we all have to have theseready for our next trip.

[00:45:32]  Brian Gallagher

And I think, like you, I've donea lot of international travel, my time in government, and my first jobafterwards was internationally based. And so I think I'm up to like 43 or 44countries. But if I had that back when I was a diplomat and at embassies andtrying to listen to different things, it would have been game changing for somany different reasons. So I think that's so cool. And I'm actually excited togo overseas, see if my boss will give me some time off and can go try them outand see how that works, but that's pretty cool. But let me ask you this. So,working with countries and in that government role, my experience has alwaysbeen that, yes, the US can come and we give all kinds of great advice andthoughts, but I've never been to a country from a work related scenario wherethere isn't something that I'm taking back from them in a perspective, or justsomething that we hadn't thought about. So when you think about yourpartnership, what are some things that you've learned? What are some things thatthey've taught you specifically that you've taken from that experience?

[00:46:51]  Matt Meyers

I think it's going to come backto people and the willingness of people to learn, to be passionate incybersecurity specifically, when they give us tours of some of their areas. Forexample, they gave us a tour of their forensics lab, right? And there's just afew people handling a lot of the forensics cases for the entire country in thatroom. And you could just, they had wires and tons of phones and all this crazyawesome setup. And the passion and the excitement was like, you could just tellit was, it was glowing. So, and you know, in my, what, 20 or so years in thecivilian cyber side, you don't always see that passion, right? I thinksometimes I've seen a few people here and there. It's like they'll get thecyber job just because, you know, it pays well, or you know, it was the next,someone told them that they should get into cyber, so they decided to get intocyber and the passion's not there. But from the Uruguayan perspective, like youcan see the passion. In order to be successful, just due to some of theirbudgetary limitations and, you know, the size of the country, and that passionreally comes through and just shows with the right people in the right placewith the right passion, like you can conquer just about anything. And they'vecome really far and they do a great job with what they have to work with,because they just don't have the budget that the United States has when itcomes to cyber specifically. So just seeing how much they're able to do, howquickly they're able to move with the resources that they have is amazing.

[00:48:45]  Stephanie Hogen

Thank you. I want to save timefor a few questions. I know Allen has one more question for you, but I gave yousome homework last time we talked. I don't know if you remember. Give you someweeks to think about it. And this goes to both of you and you can keep itbrief. But what does technology afford the people you serve? So, you know,Brian and your missions and Matt and your missions that we maybe didn't havebefore.

[00:49:11]  Matt Meyers

For me, it breaks down barriers,not only from the communication perspective, maybe the development perspective,but training too. But I think when I first started in security operations, liketraining, there wasn't a whole lot of training outside of like going to SANScourses and stuff like that, which were good trainings. But if you've ever beento a SANS course, you know they're not cheap, right? And every company is notalways able to pay to send their people away to expensive training like that.With AI, I mean, you can have that conversation with it and it can really, itcan train. You can pull someone up from, you know, off the street with thatpassion that I talked about and really move super fast. Like, you know, whattook me five years with hands-on security operations, they can get that in afew months, you know? So I think it's just, it breaks down the barriers thatexist with training, with communication, and even development.

[00:50:12]  Stephanie Hogen

What about you, Brian?

[00:50:14]  Brian Gallagher

I think my answer is going to betime. And what I mean by that is I think in my career, prior to COVID as anexample, I'd jump on a plane and I would fly to the Middle East to sit in aconference room to have a one-hour meeting with some general and then fly allthe way back, and thinking about the cost, physical cost, and the time costassociated with that versus jumping on a 30-minute Zoom call, or the four of usbeing together today in four different parts of the country. And so, I mean, Ithink that's an example that people can relate to because everybody's on somesort of a video call these days, but that expands with everything. That expandswith AI, getting time back and reach and so on. Time, that's my answer, myfinal answer.

[00:51:07]  Stephanie Hogen

That's great. Over to you,Allen.

[00:51:12]  Allen Debes

All right, so to wrap things andthen get to some audience questions, Matt, we ask every guest the followingquestion, or to finish the following sentence. So if you're ready, gratitudebecomes lasting when?

[00:51:29]  Matt Meyers

Gratitude becomes lasting when?I think when technology breaks down barriers. I think there's just, there'senough barriers in this world that, you know, prevent us from reaching ourgoals or from protecting each other or communicating with each other. So Ithink being able to tear those down with, you know, with technology and AIspecifically here, it's just, it's amazing. I'm kind of excited and also alittle bit scary. I'm not going to lie, you know, the rate at which we'removing specifically with AI, right? It's exciting and scary at the same time.

[00:52:10]  Allen Debes

Yeah, for sure. It's definitelytrue that lasting gratitude can't live in toxic, naive positivity, right? So wedefinitely have to have both. Brian, lasting gratitude happens when?

[00:52:34]  Brian Gallagher

You see positive change. And Ithink that can apply to technology or anything. But you're really going toappreciate it when you can see the positive change in the situation that youhave.

[00:52:49]  Stephanie Hogen

Thank you, and thank you forkeeping those answers brief. We had some exciting things to talk about today.So that is it for us. We have two and a half decades of experience in front ofus combined. It's 50 years. That's a whole person. The audience can continue tofollow us on the 10,000 Feet podcast on anywhere you stream podcasts, but thatis our time today. Thank you both for being here and thank you for being partof this experience. Audience, what kind of questions do you have for us? Holdon. I see a little red light. I'm going to click on it. My employees arealready pasting company data into chatbots. What do I do about that? We wantthem using AI. They are definitely productive with it. And how do we balancethis? That's the whole shadow AI piece that we were talking about.

[00:53:45]  Brian Gallagher

That is shadow AI that they'reexplaining. So my answer to them would be you set up the appropriate licensingfor that chatbot so they can continue to do what they're doing, but it be in asafe, secure environment.

[00:54:01]  Matt Meyers

I would definitely agree withthat. I'd also just ensure that you have the right visibility in the rightareas. So that way, if the data that gets submitted ends up in the wrong handsand it turns into an event, you can trace it back to when and where it happenedand how it happened. So you can really learn from that example. So yeah,that's, to me, it goes back to visibility. You can also, you can try to startbroad with your initial policy rollout, right? Because if you get too, I guess,strict with it, it's going to be difficult to uphold. So just, even if youdon't have a policy, start one month with, do not paste business companysensitive, personal sensitive information, however you classify it, into Xtools.

[00:54:50]  Brian Gallagher

And defining what's sensitiveand what's not, you know. Every employee is going to have a different view onwhat that is, you know, if you're not clear about it.

[00:54:58]  Stephanie Hogen

So we have one of our summerinterns, Reeja, she's great. She just asked the question, how do new grads whoare forbidden to use AI in a university begin to adapt this on day one in a newjob? What would you give somebody, what advice would you give somebody who'snew to their career?

[00:55:18]  Brian Gallagher

So I can tell you universitiesare changing. I now sit on a committee with the University of Alaska related tothis, and their university system as a whole is looking at how to be AI firstwithin the education system. So hopefully other universities will continue toshift and change in that way. But I think to directly answer her question, Imean, it's no different than my older parents learning how to use AI. You getwith the tool and you start playing with it and you start learning it. And youcan always take training and classes, but hands-on is the only way you're goingto figure out how to make it effective in your life and in your daily tasks.

[00:56:03]  Matt Meyers

100%, couldn't agree more. Useit at home for even simple tasks. I'm passionate about cyber. I have a wholelab set up and I probably go overboard. Sometimes I feel like I got to get abetter hobby. I do like to go outside and run and hike and all that stuff. ButI also have a very full lab set up to where if there's something that I need tolearn or there's a new technique or something, I'm going to build it out in mylab and I'm going to see exactly what it's going to look like from both anattacker and a responder perspective, mainly just because I'm curious. So becurious and use it for anything you can think of, really.

[00:56:45]  Stephanie Hogen

Love that answer. Yeah, Brian, Ithink the parents thing is funny. My mom recently sent us all images of ourfaces with different hairstyles. So she was playing with ChatGPT and I waslike, mom, do you know that the system now has our faces? Did you know thatthat's what was happening? She's like, I didn't even think about that. No, Ididn't know. So again, that education piece and ensuring that what you give itis what you want to give it and that you know the consequences of what you'reputting in as well. So that concludes our questions today and our podcast.Thank you again for spending the time with us. And thank you to both of you forbeing here again. Take care.

[00:57:24]  Allen Debes

Well done, you guys. Thank you.