Episode 2: Exploring the Double-Edged Sword of AI in Cybersecurity

Imagine a world where artificial intelligence is not just a tool for progress but a weapon for exploitation. Are we prepared for this ironic twist? Join us as I unpack observations from the recent InfoSec conference in Orlando. The discussion delves into the burgeoning trends of utilizing AI technologies, such as chatGPT, across multiple industries with a keen emphasis on cybersecurity. We discuss how vendors employ AI to enhance their products, sometimes as a hands-on guide through processes, or as entirely AI-driven solutions for tasks such as log sorting and risk analysis.

However, the path forward is not without thorns. The conversation takes a sobering turn as I discuss how AI is being weaponized. Yes, the same AI we're leveraging for advancements is being harnessed by hackers to create streamlined workflows, write exploit codes, and more. Tune in for an insightful journey into the future implications of AI in cybersecurity and join the conversation. If you attended InfoSec, I'd love to hear your thoughts. Don't forget to like, subscribe, and follow for more enlightening discussions!

Support the show

Episode Transcript

Speaker 1 (00:13):
Hey, welcome to episode two.
It's been a very, very longtime since I've done this
particular podcast and I'mfeeling, if you're watching this
on YouTube right now, thatthere's some irony in the fact
that I'm in the same shortthat's actually in my logo.
Anyways, I just got back fromspeaking at InfoSec in Orlando
and I wanted just to show acouple or talk about a couple of

(00:33):
observations I found.
So everyone's using chatGPT foreverything now, including
myself, and I have some AI stuffyou may have been watching on
some of my other podcastchannels and so forth where I'm
using it to create content andto take existing content and cut
it up and recirculate it intoother platforms, which has been
very beneficial.
But one of the biggestobservations I had at InfoSec

(00:56):
which is great was everything isAI.
I mean, some vendors were usingit to supplement products, like
to answer a question, so you'rein the product that you're
trying to figure out and you canask it a question and the
assistant will go.
If you haven't used it in anykind of security product, just
think of, like, maybe whenyou're in your banking app or
something and when it kind ofsees that you're asking for help

(01:17):
and the chat button is a littlemore AI driven kind of
something like that.
But I've also noticed that someof them were even a little more
interesting, where they wouldwalk you through like as a
companion.
Like you know, trend Microhousecompanion, I think let's see
CrowdStrike has, I think I thinkit's called Charlotte but you
can ask it questions and it'llactually help you with your

(01:38):
configurations and define thehelp and also to set you up with
the right best practice for theproduct.
So that's a very interestingway to use AI for the product
stance.
But others were completely AIdriven products like log sorting
, risk analysis.
There was a couple of mailsolutions I saw that use AI to
determine if the mail ismalicious or phishing, which is

(01:59):
great because there's beenbehavior analysis and some kind
of analysis like that for yearswhere you know it makes like
look at the old spam filters,like spam assassin and stuff
which is still baked into a lotof spam filter products today
where Bayesian analysis was used.
So that's kind of an earlierform of maybe even machine
learning, if you think about it.
So those things have progressedto the point now where it's AI

(02:23):
kind of reading the email beforeit determines whether it's
right for you or not.
So I also noticed that many ofthe speakers spoke about AI.
Chatgpt was a subject for a lot,how it's changing all the
industries, including, you know,our great industry of
cybersecurity now.
But just like it's being usedfor good and being helpful, it's
also being used for bad as well.

(02:43):
As things usually are, ai isbeing used to write exploit code
.
There's a lot of talk aboutthat and the irony there is you
can ask ChatGPT to write somePython code for you.
It's usually pretty clean, butI think there's been some
studies on one of the speakersmentioned this that the code is
about 60% right most of the time.

(03:04):
So does it make great exploitcode?
Probably not, unless it's justgoing out there and grabbing
things, because I mean, folksremember it's only able to
present to you what it knowsfrom things it could scrape, so
it has to make determinationswhether the information it's
looking at is good or bad beforeit pushes it forward to you.
So who knows actually how greatit's going to be all the time

(03:26):
right?
So I even saw some examplesthat not at Infosec but around
the reasoning behind this, likethink about how in the past, you
might use some code to actuallywrite a phishing email and
attach a coupon to it orsomething like that.
Well, you can do that with someAI tools as well now.
So it's not just the bots andthe botnet so we have to worry

(03:49):
about anymore that the hackersare using.
They're actually using the AIthe same AI tools that we're
using to protect ourselves fromthem.
They're using to come after us.
So they're looking at it to bemore efficient and create better
and faster workflows forthemselves.
So in the future, I think itmight be fun just to see what we
end up with, and I hope, in theend, that it's not AI versus AI
.
So if you're on YouTube, pleaselike and subscribe, leave me a

(04:14):
couple comments about this.
Or if you were at Infosec andif you just happen to see my
speech too, that'd be great Justgive me a good little comment
in there and just tell me what'sup and what you thought about
Infosec.
If you've been there Several, Ithink we just had the Atlanta
one last week, so this one wasOrlando and follow and subscribe
.
Appreciate you guys listening.

(04:34):
Thanks so much.