Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Sarah Armstrong-Smith on understanding the attacker mindset
Guest:
Sarah Armstrong-Smith
Published:
Updated:
Duration:
46 min
Episode summary
Sarah Armstrong-Smith, Chief Security Advisor at Microsoft and a cyber security author, discusses her role in improving cyber postures and staying ahead of threats. She explains how Microsoft uses machine learning in their threat intelligence and what’s next with the onset of generative AI. She also highlights the importance of understanding the risks and consequences of AI technology, as well as the need for CISOs to embrace new technologies while ensuring accountability.
In this WE’RE IN! episode, Sarah emphasizes the significance of diversity in the cybersecurity workforce and the need for organizations to foster a culture that encourages diverse perspectives.
Listen to hear more about:
Understanding and addressing the unique cyber challenges of different sectors and countries
Balancing the threat landscape with available resources
The human aspect of security and understanding the motivations of attackers
Listen to the episode
S3 E3 · Sarah Armstrong-Smith on understanding the attacker mindsetWE'RE IN! Podcast · 46 min
Key takeaways
Tell the board what to do Sarah says every report to the board should make clear whether it is for information, a decision, or accepting or transferring a risk, written in plain English.
Keep a decision trail With an assumed compromise mindset, organizations should record who decided what and when before and during an incident, especially if regulators or government later ask.
Communicate out of band during attacks Attackers in your network may read Teams or email, so crisis teams need separate, isolated communications and should think several steps ahead of each decision.
Cloud kept Ukraine's data out of reach Ukraine changed its data residency law about a week before the invasion, so government data was copied to European data centers before Russia struck the physical sites.
Shadow IT reveals your culture Sarah suggests looking at shadow IT and shadow processes to see how people bypass controls, because you cannot protect a business and people you do not understand.
Topics covered
Cyber in the Boardroom
Partnerships
Talent Gap
Notable quotes
You have to assume your attacker is watching you and they're waiting and preempting your next move.
So there are a multitude of hows, and I think from a cybersecurity, we're always focused on the how.
The fact is if we don't understand our business and we don't understand our people, how can we protect it?
…they did actually blow up some of the Ukrainian government data centers, but the data itself wasn't there.
Questions this episode answers
How do you explain cyber risk to non-technical board members?
Sarah frames cybersecurity as enterprise risk, which boards already understand, and puts threats, vulnerabilities, and the specific ask into plain English. Read this section
How should organizations handle an active ransomware attack?
Expect attackers to use media and deadlines to apply pressure, step back to think rationally, and use separate isolated communications because the attacker may be watching. Read this section
What motivates cyber attackers besides money?
Sarah found that many are financially motivated, but an ex member of Anonymous she interviewed said money never came into it and that social justice was the driver. Read this section
How did Microsoft help defend Ukraine's infrastructure?
Microsoft helped move government data to the cloud across European data centers, and deployed Defender for Endpoint and RiskIQ technology to spot command and control servers and warn targeted organizations. Read this section
How is generative AI being used in security operations?
Tools like Copilot for security let analysts ask questions in plain English instead of writing complex threat hunting queries, aiming to augment people and speed up both response and training. Read this section
About the guest
At the time of recording, Sarah Armstrong-Smith was chief security advisor at Microsoft, working with the company's largest enterprise customers across Europe at the CISO and C-suite level. Her background is in business continuity, disaster recovery, crisis management, and cyber, and she is the author of Effective Crisis Management, with a second book, Understand the Cyber Attacker Mindset, on the way. She volunteered as a CTO mentor in Ukraine in the months before Russia's invasion.
and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and we have a very special guest today, Sarah Armstrong-Smith, chief security adviser at Microsoft and a cybersecurity author. Sarah routinely works with board members and CISOs seeking to improve their cyber postures and stay ahead of the next threat looming around the corner. Sarah has also mentored chief technology officers in Ukraine in the run up to Russia's invasion. There's a lot to dive into with Sarah, but first, let's hear a quick word from our sponsor, Synack.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
So you're currently Chief Security Advisor for Microsoft. That is a heck of a title, if I do say so myself. Tell me a little bit about what that role entails and how it fits into what could reasonably be described as one of the largest security companies in the world.
Yeah. So in essence, my role is to liaise with Microsoft's largest enterprise customers across Europe. So, I work multi sector and multi country, tends to be CISO, CIO, kind of C suite, kind of security leadership level. But in essence, it's to decouple the conversational from talking about products per se, and really getting into the heart of what their challenges are. So we think back over the last three years, we've had a global pandemic, we've had the Russian invasion of Ukraine, we've had the war with Israel and Hamas. And that's kind of just from a geopolitical standpoint. So when you add in all the other social issues, technology issues, myriad of cyber attacks, regulatory changes, all of those things combined is a really easy say getting to the heart of what their challenges are and ultimately how Microsoft can help with all of those things combined.
You just listed a ton of potential, both geopolitical flashpoints and cyber challenges. In these conversations, I guess, how do you go about distilling what's most important? How do you prioritize amid this deluge of various threats you could even consider?
Well, it's really driven by the customers. And a lot of that is dependent, let's say, country they're in, what sector they're in. So obviously sometimes I'm talking to critical infrastructure, so that could be energy, financial services. Then we might flip into sort of retail manufacturing. And I think the interesting thing is each one is quite unique in terms of their individual challenges. So you could argue all companies are the same more or less in terms of you've all got infrastructure, you've got people, you've got technology, you're all being bombarded with cyber attacks left, right and center. But it's then really trying to understand through all of that, what really is the priority and what's really keeping people up at night. I think you then have to balance the threat with the reality of the world as well, which is people do not have an infinite pot of money to fix all of these different things and fix all these risks.
So in essence, I think it's about not just understanding the risk here and now, but also how that might evolve over the next six months, twelve months, eighteen months plus. Because what we don't want is for that customer to be in a perpetual cycle of transformation. So as soon as they bought a product, it might take them a year, twelve months, no, eighteen months to roll out. By that time, eighteen months down the road, the challenge, the risk has moved on. So you kind of think with the pace of change that we're talking about, the level of threat that we're talking about, it really is about that longevity and thinking way beyond the here and now and kind of anticipating what that fright may continue to look like.
So you mentioned you often work with C suite, potentially board members in your capacity as chief security advisor. When it comes to board members in particular, this is something that's come up quite often here in The US. How do you get non technical business leaders to really wrap their heads around concepts of cyber risk and the importance of good security practices?
I think first and foremost, it's making sure that we talk about cybersecurity from a business perspective. And again, I think historically cybersecurity is being thought about from an IT perspective. So cybersecurity, got CISOs, CIOs, CTOs, and kind of the board may say, Oh, I've dedicated that to the IT part of the organization or to the kind of the CISO. But ultimately, when we think about the scale of some of the things that we're talking about, we've already mentioned about geopolitical threats, huge scale cyber attacks on critical infrastructure. The impact of that is huge. So it goes way beyond an IT incident. And so the knock on effect when we're thinking about what's the impact of not providing services critical infrastructure, we've a knock on effect to consumers, our people, the media, they all kind of latch onto all of these things.
So first and foremost, we wanna think about cybersecurity in the realm of enterprise risk. So even if the board are not from an IT background, they're not from a security background, they really do understand enterprise risk. And obviously there are multiple risks from an enterprise perspective. So the second thing that we can then have to do is make sure that when we're communicating about cybersecurity, so either that's from a, what is the threat that we're dealing with? What are the vulnerabilities that we have? And ultimately kind of what's our plan and what are we asking the board for? So we asking for help, we're asking for resources, we're asking to change the priority maybe on that kind of risk register. So we have to put it into a language it's going to resonate with the bored people. So we want to put in plain English and make it as simple to understand as possible.
So when we are communicating these risks and the threat landscape and all of these things and because of the rapid pace of change that we're talking about, we also need to be again very cognizant about what is it you're expecting the board to do as a result of this information. Because sometimes you've got risk registered audit reports, test reports, know, whatever the case may be. And they've got that multiple times over from different areas of the business. So, know, am I giving you specific for information purposes? Am I asking you to make a decision? Am I asking you to accept the risk or transfer the risk? And so it's really important that whatever we're reporting upwards, A, that the board understand and B, that they know what they're supposed to do with that information. Because ultimately, if it does hit the fan and we talk from a Microsoft, we say you have to have an assumed compromise mindset.
So for the best way in the world, technology, training, whatever the case may be, you still have to assume that an adversary is in your network. They're trying to exfiltrate data. It may or may not go into the public domain. And therefore that being the case, you then need to show that kind of audit record if you like. Particularly if you're a regulated business, dependent on the size of the incident, dare I say, you might get hold up in front of a select committee or the government to answer for all of these things. So actually having that record of who said what and when, what decisions were made. And that might have been the right decision at the time because of the other risks that were going on, because of the different landscape, because of all of these things combined. And it might be that we decided to prioritize this area over this one. We put this particular project or plan on the back burner because we have other critical things.
I can definitely see how having that sort of documentation would really resonate with the board members who have to be worried about getting drawn up, as you mentioned, in front of parliament or in front of US Congress and shaken by the collar a little bit in the wake of a breach and being able to point to, Hey, okay, we listened to the risk, we heated it, we treated it as part of the business, a core element, and did this and XYZ, or XYZ, I should say, and really accomplished that. Now, I imagine that also with some of those conversations, the steady drumbeat of absolutely impressive hacking headlines that fall regularly throughout the world somewhat help move things along. Here in The US, we've unfortunately seen some water utilities recently in the news suffering cyber attacks reportedly linked to the Iranian government's Islamic Revolutionary Guard Corps. Dusting off your crisis response hat, what would you say to these small utilities who maybe don't have a board of directors who can point them to direct resources a certain way, don't even have those resources, who might find themselves in the crosshairs of these nation state hackers?
Yeah. Well, as I said, because of my background is in business continuity, disaster recovery, crisis management and cyber and all of those things. So two years ago, I made the decision to actually write my first book, which is Effective Crisis Management. So it's looking back over all of that kind of the last twenty years, looking at all of the incidents I've been personally involved in, but also looking at some of those major, major incidents. Kind of how did it happen? So you're kind of looking at 9/11, Deepwater Horizon, the Colonial Pipeline disaster. And a lot of these have very common things in play. And in hindsight, you can look back and we've got a 2020 vision, everything like, but actually there's always a pattern that I really want you to reflect on. And sometimes when you have public inquiries and you have incidents of such a big magnitude, as we were saying, sometimes you have select committees, you get called up, there's gonna be post incident reviews, all of these things.
But these are such valuable reports and so valuable to take into consideration. Normally what you have therefore is a kind of like being able to look backwards and kind of look at where there's a history here of failed warning signs, failing to act on the risk, test reports, audit reports. So it really comes into play after what I was just saying a minute ago about having that audit record and being able to kind of look backwards. But a lot of that comes down to the culture of the organisation. And really, again, have you got a good history that when people come to you with reds and big issues, what are you going to do about it? Do you just put it on the risk register, hope that someone somewhere is going to look at it? Or do you kind of put it under the carpet, hope no one notices and then move on?
But your culture of your organization has a massive bearing on what comes next. So either how you've planned for an incident or how you're gonna deal with an incident. So from a crisis management perspective, your strategy has to be proactive and reactive. So from a proactive standpoint, it really is doing that due diligence that we were talking about, understanding the vulnerabilities, understanding how those vulnerabilities are going to impact the crown jewels, and then being able to articulate where we are today. The reactive part then is having that defined incident response and plan. And again, making sure that everybody understands their role and understanding as well how the attackers themselves are trying to manipulate the situation.
So again, if we think about active ransomware attack, the idea is they want it to be in the public domain. They want to have the media attention. They want you to have as much pressure on you from consumers, regulators, again, the government. It's all part of their game plan. Because the more pressure that they put onto you, and they may even give you a timeline. If you don't respond within X timeframe, I'm gonna release this. I'm gonna do all these various different things. And so part of that is then making sure that even with all of those things going on, you're still thinking rationally and you're still able to make effective decisions. You kind of almost have to take yourself out of the situation. So again, one of the things that we'll talk about is having completely separate isolated communications, hands off keyboards, because of that assumed compromise mindset that we were talking about.
You have to assume your attacker is watching you and they're waiting and preempting your next move. So if they're in your network and you're talking on teams or you're talking on email or whatever and you're kind of, you're coming across very confident. Yeah, I have a backup. Absolutely not gonna pay. Oh really? You're not gonna pay? Let me just delete all those backups. Therefore it's kind of really important as we sort say, if you take yourself out of the situation and being able to think rationally about your decision. But on that decision as well, we also need to make sure that we understand that every decision has a ripple effect. And so once we've kind of started on this path, it might be very difficult to kind of come off that path. And so we're not just thinking about the decision that we have to make now. We need to kind of think what's the consequence of that decision.
Again, kind of thinking one step, two step, three steps ahead. So that again, we understand by making this decision now at this minute, we understand the consequence of that and what's gonna come next. And therefore we're prepared. Maybe we're prepared for the fallout that's coming from whoever our stakeholders are or whatever else. But we're thinking that one step ahead all the time. And so it's kind of, as I sort of say, it's that balance between the reactive and the proactive, but you really do have to make sure that you've got an effective crisis management strategy.
That proactive level of planning, it sounds so important in the field of cybersecurity, but it's also, it has to be so enormously challenging, especially you mentioned ransomware attackers. These attackers are pulling out all the stops and just taking a no holds barred approach. I remember quite cheekily, and I won't even dignify naming the ransomware group, they turned around and reported a company that they had hacked to the US Securities and Exchange Commission for failing to divulge the fact that they were hacked. And I couldn't believe it. I said, You've got to be kidding me. I mean, how do you anticipate something like that? And you actually have a book on the way titled Understand the Cyber Attacker Mindset. Please tell us, because I can't imagine it's so nefarious the way that these groups are behaving.
Well, I've always been interested in the human aspects of security. So when I was a kid, my dad used to be in the Royal Air Force and we were based in Germany, so he was working in psychiatry. And when we were living in Germany in sort of 1982, getting to show my age, the Falklands War was underway and this is the first time since the Second World War that the entirety of the British military had been in a kind of active war situation. And soldiers were coming back from the Falklands War and I really saw the difference. So even though I was quite young, I really saw the difference between how people were treated if they came back with physical injuries versus mental injuries. PTSD, so post traumatic stress disorder was still relatively new at that point of time as well.
And I think it's really similar to cybercrime and fraud because we don't see it. And when we're thinking about how we, the victims of cybercrime and fraud, we treat them very differently to if they'd been a victim of a violent crime or a robbery. And again, it's kind of that really kind of understanding and really, so one of the aspects I've looked at from the book's perspective, explore some of the issues when it comes to victim blaming and scapegoating. And again, you know, we're thinking about what we've just been talking about from a crisis management perspective. It's really easy just to sit there and say, who are we going to blame today? So are we hanging the CISO out dry? We think about SolarWinds. They blamed it on the intern and actually sitting there putting blame out of having a scapegoat doesn't actually change anything.
So I look at some of the aspects of that side of things about how we think about the victim themselves, but also then moving us into the attacker. I'm really what I'm trying to do is remove the fear behind some of the attackers who they are. But also I think we also have this image that we have perpetuated by the media of this kind of faceless hooded figure in the dark, crouching over a laptop. And so what I'm trying to do then is actually put a human behind that attack. So I'm using actual names. I'm speaking to ex criminals, law enforcement, military, but also academics as well. And really what I'm trying to do is understand the why. So there are a multitude of hows, and I think from a cybersecurity, we're always focused on the how.
So if you kind of think about the how could be, they're using malware, they're using a zero day ransomware phishing, phishing. And it's a million and one ways in which they could try and get access to your network or try and get access to the data or try and get access to the people, but really understand why, why are they trying to do that? And I think again, there's a kind of a misconception that a lot of the cyber attackers are motivated by money and financial gain. And I think a lot of them are, but actually I also interviewed an ex member of Anonymous, for example, and they said, money never came into it. So they were motivated by this need to have social justice and to stick up for all of those people who didn't have a voice and couldn't stick up for themselves. And I found that really interesting to get to really get to the bottom of some of those whys.
And then I was digging around and understand, as I say, understanding some of these ex criminals, how they've reformed. Cause I was really conscious that I didn't wanna give a platform to current criminals, let's say, because they could take that as a bit of kudos and showing off and whatever else. So some of the people I've interviewed, I say are ex criminals, they've reformed, they're sharing their why, sharing why they changed as well. But ultimately what has really kind of got to the bottom of is the deep rooted human emotions that a lot of attackers take advantage of when we're talking about social engineering. And this can be victim or attacker. And so can we think about kind of the seven deadly sins, cardinal sins? And this is kind of going right the way back, like hundreds of years ago to the Roman Catholic church.
And they were kind of talking about how people can be motivated or tempted by greed, gluttony, pride, lust, envy, wrath and sloth in essence. And I was really then taken back that these are kind of really kind of core towards us being a human. And those are kind of the core motivators, if you like, that kind of lead us that one step further. If you understand the human, you understand their motivations, how far they're prepared to go in some of these situations, What are we gonna do about it? And that's where I'm trying to get to the human centric part of security. So again, we can talk about different technologies and how we're gonna block all these malware, ransomware, etcetera. But what I challenge people on is again, we've already reflected on is the organizational culture and having a really good look at the inside of your organization.
And a good way of doing that is to really reflect on the level of shadow IT and the level of shadow processes in essence. All the ways in which people in the business have found a way of bypassing all your controls, ignoring the policies, whether they're doing it maliciously or they just don't understand. The fact is if we don't understand our business and we don't understand our people, how can we protect it?
Interesting. Interesting. Yeah, I know. I'm looking forward to reading Understand the Cyber Attacker Mindset. Speaking of various motivations, we've seen a lot of hacktivists come out of Ukraine. And I noticed on your LinkedIn that you volunteered as a CTO mentor in Ukraine through the USAID right before the onset of the war with Russia there. What can you share about that experience and how would you gauge the impact of that war and that conflict on global cybersecurity so far?
Yeah, I think it's a very humbling experience. And I think, as you sort of say, it was kind of the few three months, four months leading up to the actual invasion. And they didn't know when they were gonna be invaded. They just knew that their troops were starting to amass on the border. They're getting heavily hit with cyber attacks. And I think the real testament that was really making the difference at the time is that Ukraine was utilizing a lot of old Soviet infrastructure. So Russia understood a lot of the infrastructure where we're talking about healthcare systems or energy, all of those kinds of different things combined. And what they were trying to do is really trying to look at how do I, I kind of got all this massive big legacy estate. My adversaries know exactly what I've got.
They know exactly how to attack it. They know what my vulnerabilities are. What am I going to do? And so in essence, part of this program was to have security leaders from across The US and also Europe to basically mentor the CTOs of some of these organizations. So these people, they own the technology. They are trying to modernize the technology at the same time, but they're having to deal with this real threat at the same point. So some of the things that we were talking about was first of all, really kind of understanding the state of play with some of the critical infrastructure. And also then thinking about what's their strategy. It really comes back to exactly what we just discussed. Having that incident response plan, understanding the vulnerabilities, understanding how the adversary could exploit those vulnerabilities.
So let's say that they're able to get straight into a nuclear power station. They're able to get straight into hospitals. They're able to get into education, central government. What can they do with those systems, with that data, with that information? So it's really trying to just get them into the right mindset. It wasn't enough time. This wasn't about rolling out new infrastructure or projects or anything like that, but it was really about preparing them from what was to come. And a real field for them because a part of that was a real challenge that they had to keep that critical infrastructure running and kind of no matter what's hitting at them. And so they have that mix between, so the cyber attacks, but also the kinetic, the actual missiles as well. But I think from that program, one of the things I'm really proud that Microsoft was able to do kind of on that run up was actually to help Ukraine government move a lot of their data to the cloud and move it very, very quickly.
And so again, we think about a lot of government across the globe. So this is not unique to the Ukraine. They have many requirements for data sovereignty, data residency. Your data cannot leave the country. It must stay in where it is. Well, I think that's great in peacetime to have your data as close to you as possible. But actually, if all your data is in data centers and the adversary knows exactly where those data centers are and are prepared to basically blow them up, what are you going to do? And so the Ukraine government actually changed the law probably at one week before the physical invasion, which then enabled them to move the data. And so not only did they move their data to the cloud, but they also moved it out of Ukraine as well. So we were able to kind of copy that data, if you like, across multiple European data centers.
And so from a Russian perspective, they did actually blow up some of the Ukrainian government data centers, but the data itself wasn't there. So I think from an adversarial perspective, it's kind of in the cloud in inverted commas. I don't know where it is. And I don't know where to attack. And associating, I think that's really important from that perspective, but we were also able to provide free security technology as well. So we deployed a number of security software. So I don't wanna be a promotion for Microsoft per se, but we deployed Defender for Endpoint, but we also deployed a brand new technology that we just acquired from a company called RiskIQ. Now, of the things that RiskIQ does is actually to map the internet, sounds like a kind of mammoth task. But if I just explain the rationale for this, why we deployed this technology.
So if you're thinking about malware on an endpoint, and you're thinking about it's pinging something in the external world, and I don't know what it's pinging. And so in this is what this technology does, it's kind of reverse engineer, if you like, and to pinpoint those command and control servers. And so we can therefore then identify that not only are you being pinged, but that company, that company, that company, that company is also being attacked exactly the same time. So by us deploying that infrastructure throughout Ukraine's critical environment, we were able to actually give advanced warnings to different organizations. So they weren't necessarily Microsoft customers. It was just the fact that I can actively see across the network that you are being targeted by this new strain of malware, wiper malware, ransomware, whatever the case may be.
And therefore by deploying the Defender for Endpoint, we were able to then block that malware as well. So that was hugely successful and really great opportunity because what we identified with Russia in particular, that they created seven brand new strains of wiper malware. We see more active attacks in the first four months than the previous eight years. And so actually, as soon as you play your hand, if you like, so if you're going to develop a new strain of malware, whatever the case may be, once we've identified it, we can create a detection for it, we can block it. And then having that deployed as quickly as possible, not just in the Ukraine, but into other countries really has made a difference, I think, in terms of Russia's ability to be able to affect Ukraine's critical infrastructure.
I think from their perspective, they thought the war was probably gonna end very quickly because I hit the critical infrastructure with all of this kind of like wiper malware, destroy hard drives, destroy all the data. Then I hit you with actual missiles. You're probably going to surrender very quickly. That isn't actually what happened.
Well, I think to your point earlier about not wanting to sound too promotional of Microsoft, any neutral observer of the Ukraine war and the Russia's invasion there. And of course, as we mentioned, Russian President Vladimir Putin had another think coming with what he initially thought would happen. But I think any unbiased observer would really have to recognize the role that Microsoft played in, like you mentioned, disseminating some of the information, getting threat information out in public very quickly. And this was certainly the hybrid aspect of this war on the cyber IT side to many outside third party observers has been underwhelming on Russia's part, but that's in large part, I think, a testament to the defenses that went in and both Ukraine and its third party international partners' ability to thwart some of these and some of the planning that went into it. So no, don't think it's promotion at all. I think it's a reflection of the reality of what played out on the ground there from that cyber IT defensive perspective.
Now, I do have to switch gears here for a second and give us kudos because we're well into this podcast recording. And to my knowledge, we can check the transcript. Neither of us has mentioned artificial intelligence. And that's quite a feat with the way that AI has been the buzzword of the day. I would be curious to hear, when it comes to the security space, what does AI mean? How are these large language models, this generative AI technology, how is it shaping the future of cybersecurity? Small question, I know.
I think the interesting thing is, even when we talk about AI in its general term, AI is nothing new. So it's been talked about since the 1950s, even way back when scientists and technicians were thinking about, if one day we could have machines that are as intelligent as humans? Then it kind of all got a little bit hard and too difficult. Nobody could really figure it out until the kind of 90s, late 90s. Then we kind of had machine learning. And when I think when we talk about AI in the modern era, really what we are talking about is the machine learning that many companies have adopted. Like kind of looking at huge datasets, being able to kind of find the patterns in the datasets. That in essence is how Microsoft utilizes a lot of machine learning in our threat intelligence. So look for those patterns, what's new, what's different, and how things are evolving.
So even machine learning in a Microsoft security context has been utilized for a fair number of years. I think what's changed in essence is kind of been this onset generative AI, which again is a subset of the machine learning sort of deep learning kind of networks. And I think that's probably brought to life in the last year when we think about ChatGPT. All the kind of facts and really what we're talking about is the building of those large language models. Again, I guess why now if we've been talking about this since the 1950s? Well, one of those things, again, if I'll just talk about Microsoft for a little bit, is the relationship Microsoft has had with OpenAI who is the builders, if you like, of ChatGPT. But our relationship with OpenAI has also helped with that a little bit.
So Microsoft has built a supercomputer that runs the OpenAI technology, if you like. So imagine that you've now got a supercomputer in the cloud, you've got the computational power of the cloud, as well as all the data that's needed to kind of build these large language models. And that's really been the differentiator. I think we've had to get to now almost to have the level of computational power and data and have the know how how to bring it all together. So I think when we think about therefore, a ChatGPT is just one of many technologies that we're now kind of seeing at Google and various others are also building this capability. But in essence, I think that there is kind of two camps. One camp is looking at the art of the possible, how do I embrace this new technology, lots of different case studies.
We're seeing huge number of businesses who are standing at R and D and innovation centers, all very cool thinking about what does the future look like. That being said, when I talked about some of the conversations that I'm having with CISOs and other technology leaders, there's a little bit of a nervousness really. But do we really understand this technology? And even if we kind of think about in the last year, we've talked about what is biases, is hallucinating, is mixed stuff up. We don't really understand the consequences of how this technology is being utilized.
Exactly, exactly. And so I think what we then have to kind of consider is the CISOs don't want to be the one that says no. And again, historically, as soon as it gets to security, they're always the ones that put the brakes on. They come at us with all of these policies and processes. They're the kind of the naysayers, don't let us do anything. And I see that CISOs are really trying to change that perception. They really need to be part of the business. So it's not about saying no, it's about understanding, as you said, the scale of the risk and what those risks are. It's about getting the balance right. It's not about saying no, not to use the technology, but actually do it for the right reasons. I'm being accountable for whatever comes next. So if you don't fully understand it, you haven't tested it, you've put it into the wild and it does something a bit weird, let's say, what are you gonna do?
But it really comes back to that crisis management. But I would sort of say there's three things to think about. One of which I've already spoken about a little bit, which is in how AI is being embedded into security. So again, if I think about, okay, we've been utilizing machine learning for a very long time. How's a large language model helping? So you may have heard of Copilot from a Microsoft perspective. Copilot's being embedded into every bit of technologies, GitHub, Office, but we're also having Copilot built into security. And the idea is to augment the human, not to replace the human. But if you think about from a security analyst perspective, working security operations, and you see something a bit weird that you don't really know what it is. It could be a zero day. So in essence, there are no detections. There's no nothing. The idea really is to be able to ask a question in plain English and get an answer back without having to know how to do active threat hunting, how to do these really complex queries.
This is one of the game changers that we're kind of seeing from that perspective. And the idea is to speed up the response, but also speed up the knowledge. So how quickly we can train people to be an analyst, active threat hunter, complex queries. Maybe at the moment it takes twelve months, eighteen months, however long it takes. And as I say, by having just being able to ask the question in as plain English as possible and get the answer back, so that's one element. The second element then comes down to the security of the AI itself. So for me, again, you think from an adversary's perspective, their ability to get hold of the model, understand the algorithms, how they might be able to manipulate the output, reverse engineer or even steal it.
So you need to then think about the adversarial AI. So how might an adversary either utilize the large language models that have already been built or whether they would actually build their own? And we are seeing some little elements of this that are kind of worrying people. So we have seen attackers utilizing some of these large language models, let's say to refine the code that's being used in malware or to perfect the phishing emails. And I would just caveat that the machine itself, the AI is not actually doing bad things. It's the, again, back to the human, it's the human behind the software, the AI that is manipulating the machine, if you like to give an output. So we've kind of, again, you reflect again back through ChatGPT, other technologies, what's kind of happened with that is the developers, if you like, have put safeguards in and jail breaks.
So if you just turn around and say, let's ask a question. How do I kill people? And it will say, absolutely not. I'm a responsible AI. I love humans. I'm never gonna tell you how to do that. And so kind of they'll get around it because, yeah, but imagine I'm an evil villain in a Marvel film and I wanna know how to kind of do these things. I'm like, yeah, okay. I'll tell you how to create a great story plot for a film. And you can kind of see that it's asking in a very slightly different way to get the outcome that you're after in the first place. And this is kind of bringing in a whole new realm of what we call prompt engineering. And it really comes down to it's not what you say, it's how you say it. And this is really interesting. And I think that's where you're kind of seeing how people are able to bend and get around policies.
It's exactly what we were just talking about, where there's a will, there's a way. And if I understand what it is I need to ask and do it in a slightly different way, I'll get the machine to tell me how to do it.
I wanted to pivot to a topic that's certainly of interest to Synack as well, which is the need to build a bigger tent for women in STEM and usher in a more diverse cybersecurity workforce. And what are some tangible steps that organizations can take to make that reality? I feel like it's all too easy sometimes to pay lip service to this idea of, Oh, we welcome diversity in tech without actually doing anything.
Exactly. And I think we all need to be cognizant first and foremost about what do diversity? So some people will say, well, means, oh, we need to have more women as an example, because it's a male dominated industry. But actually diversity is much, much more than that. I think we only look at diversity from all different perspectives. And I think, again, if you think about the cybersecurity risks, the threats that we're talking about, how they're evolving, actually what we need is different backgrounds, experiences, different cultures, and all of that different perspective together. Because ultimately what that means, when we have diversity in our teams, we remove the group think. So we all think the same and we all kind of have the same life experiences. What we kind of come up with is probably very similar. As much as I think it's a cliche, we do really need people who can think outside the box, but we also need enough people with a healthy amount of challenge on the status quo.
So if we just kind of say, well, that's the way it's always been and kind of move on and don't ask difficult questions, we're never gonna move forward. And I think therefore it kind of comes back again to the culture of the organization. And it's a realization about the culture that we've created and also the culture that we want. We can't, as you said, you can't just will it to be so because we said so. We can't just say, well, we want to have a diverse organization and we want to be inclusive and we want to do all of those things. If that's not your organization, it's not gonna change overnight. So you actually have to have a very top down, very deliberate process, if you like. First of all, you say, have for that introspection, to really kind of understand where we are today. Is it giving us the right balance, the right outputs, the right outcomes that we're expecting?
And if not, A, what's the impact of that? And B, what are we gonna do about it? But it's not an easy task. I actually sort of say, I think people sometimes play lip service to it a little bit by having quotas. And if we have X percent of people from this culture or the X number of women or whatever the case may be, then we've met our diversity quota. And actually it's much, much more than that. But if we get it right, it can have really, really beneficial consequences for the entirety of the business. Not just in terms of how we help people in the organization, how we attract new talent, but also how we manage risk in totality. Because people are scared. And if they feel like if I put my head above the parapet, I'm gonna get shot down. If I've done anything wrong, maybe I did click on that phishing link. But if I tell anyone I'm gonna get chastised, I'm gonna get disciplined.
You know what, I'm not gonna bother. I'll just put it under the carpet, like I said with everything else. And you kind see, as we sort of said about some these major incidents, there's a pattern there. And so these little things that seem like, great, it's not so bad. Yeah, this is the way we've always done it. No one cares. Yeah, just break a few rules here and there. And it kind of these things build up to big things. And that's why I said that that's where, you know, sometimes therefore we then have to look backwards. How did it get here? There's a pattern and it really is. And how do you break the little pattern? And it really is a conscious decision to do it, not just something you will.
Well, finally, there's one question that we ask of all of our guests on the podcast, which is the dreaded fun fact question, if you will. What's something that we wouldn't know about you just by looking at your very illustrious, by the way, LinkedIn profile?
Well, I think I'm a pretty open book, literally speaking. I mean, I've talked about my first book, Effective Crisis Management, but I really laid it all to bear in there as well. So I talked about a lot of the incidents. I talked about from my perspective, having lived and breathed from it, I talked about real life experience of trauma as well. And I think that was kind of important to have that out there. But then you've kind of like my, the other thing that I do, which sounds very odd, but I actually use my dogs and my dogs make a special appearance on LinkedIn as well to promote cyber security awareness. It sounds very weird, but actually it kind of raises a smile. And I have a bit of a cult following now. So I'm like, yeah, yeah, Microsoft, whatever. Where's the dogs? Well, yeah, haven't seen you post about your dogs for a while. I But think it's whatever works.
But ultimately, as I said, there's not a lot that's secret, but I think it's actually important as we've been talking about all the way through today's podcast, it's really about understanding the human. We are all human ultimately, no matter what job we do.
Thanks so much for joining us. Really fascinating insights. You've inspired me. Now I need to figure out how to get my ginger tabby to say something meaningful about cybersecurity or pose him in a certain way. I don't know. We'll find out. But thanks again for joining us. Discussion and look forward to checking out your Understand the Cyber Attacker mindset book.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
