Biden Admin Pushing Security Vendors to Embrace Best Practices

Each week, TechTarget Editorial's news team and industry experts provide candid insight and analysis of the biggest IT news headlines of the week. Today's show examines generative AI's impact on software development, the need for higher-performing storage for AI applications, and the cybersecurity industry's reaction to the Biden administration's plans to tighten software security.

 

Watch Tech News this Week on the TechTarget News Bytes Channel:

Tech News this Week

Episode Transcript

Alexander Culafi (00:00):
The vulnerability landscape is, is

(00:02):
worse than ever, or theresearchers are better at
finding them than ever.

Antone Gonsalves (00:08):
Hi, and welcome to Tech News this week.
I'm your host techtargeteditorial news director, Antonia
Sophos, on today's show, we'lldiscuss the impact generative AI
could have on softwaredevelopment, we'll take a look
at how the Biden administrationwants to tighten software
security. And we'll talk aboutthe need for higher performing

(00:30):
storage for AI applications.First is AI and software, the AI
natural language processingmodel called G P, T. Four could
have a dramatic impact on thedevelopment of business
software. Here to tell us why isPaul nashawaty, an analyst at
Tech targets Enterprise StrategyGroup, so how could AI the AI

(00:56):
language models like GPT? For tochange software development?

Unknown (01:01):
Yeah, and so exciting times right now, right when
we're looking at and GPT ingeneral, GPT not to be confused
with chat GPT. But GPT overall,is the underlying technology
underlying engine that allowswill save code that then allows
for a lot of things to happen,right? So so when we look at
software development, you canone can envision and vendors

(01:23):
that I'm speaking with, canenvision use cases, such as
customer support enhancements,such as roadmap generation, such
as dynamic bug fixes, QAtesting, you know, and how that
would work. Also dynamicinfrastructure, right. So like
all these areas where you seechanges that are happening
across the ecosystem, wheresoftware needs to be improved,

(01:46):
you don't want to have to waitfor things to happen, you can
actually have these underlyingengine check dynamically start
making changes to the softwarepackages, so you can have things
happen more dynamically acrossthe board.

Antone Gonsalves (01:59):
Now, in an article you written you talked
about that GPT, four could havean impact on customer support,
for example. Can you elaborateon that a little bit?

Unknown (02:10):
Oh, absolutely. I'm trying. So I mentioned customer
support as a as a use case. Solike, if you think about it,
today, a lot of times when yougo to a site or go to a vendor
site, and you say, Hey, I mightneed some help, and you get a
chatbot, that pops up, and theygive you some limited responses.
And that's, and that's okay,right? That's okay. But when you
start incorporating an internalinstantiation, of GPT. And the

(02:32):
reason why I make thatdistinction, internal and
instantiation, is because wedon't want to go we want to be
careful that organizations andcompanies such everyone is not
putting proprietary informationin a general public domain, like
like a chat, GPT, you don't wantto put that information out

(02:53):
there. Because then it goes intothe public and it becomes public
domain. That's a bad thing,right. But if you have an
internal instantiation of GPT,that's running for your
knowledge base, you can takethat envision taking that
Chatbot. And really making itwhere it's dynamically learning
that knowledge base andanalyzing problems in the in the
application stack. And really,the goal is to help delight

(03:14):
customers by providing thatrapid response, and also do
predictive problem solving. Soyou can see how that would be a
good time together for thatcustomer experience

Antone Gonsalves (03:23):
during and you've also talked about greater
level of human machinecollaboration. What do you mean
by that?

Unknown (03:31):
Yeah, I mean, you know, when you look at shifting of
resources, it for example, asbeing asked to do far more now
than they did in just two yearsago, according to our Enterprise
Strategy Group research, we'reseeing that it is tasked with
doing far more now than theywere with the same or fewer
resources than they had just twoyears ago. So a lot of a lot of

(03:53):
challenges here. So when we lookat GPT, and the use case of
automation, and we look at howGPT can be used, we could look
at shift and skill saw a skillstaff were still skilled,
skilled resources, right. So youcan basically take those kind of
tedious tasks that you havemaybe a maybe a resource doing
today, and really shift thatthose tedious tasks to more

(04:15):
automated and shift the highvalue resources to innovative
projects rather than focus onthe low value low return
projects. So that's one example.There's another example of
using, you know, focus thathuman collaboration,
understanding the business focusand adjustments. So by
understanding the competitivelandscape and monitoring and

(04:35):
reviewing the day to daychanges, you know, across the
industry, that really helpsprovide organizations with the
proper insights to adjust thebusiness models really to stay
ahead of the competitivelandscape, right and traditional
approaches usually requireshuman capital to to do this
research. That's also errorprone due to miss you know,
misinformation across the everchanging landscape. So those are

(04:56):
just two examples, but you cansee how Avid, you know, utilize
Using GPT to do staffaugmentation, skill
augmentation, or just using itfor task management, it's a good
vehicle to enhance thatautomation process that
businesses may not be doingtoday.

Antone Gonsalves (05:18):
All right back in March, the Biden
administration unveiled plans tohold vendors and software
publishers accountable for thesecurity flaws in their
products. The administrationargues that too many vendors
ignore best practices for securesoftware development. Here to
tell us what the cybersecurityindustry thinks of the proposal

(05:41):
is tick target editorials,security reporter outs
philosophy. So tell us why theadministration is proposing
this. Now, you know, after allsoftware with security holes has
been around for decades.

Alexander Culafi (05:53):
The Biden administration, as you said back
in March unveiled their NationalCybersecurity strategy. It
includes a bunch of things. It'slike a 40 page document, maybe
39 pages. And one section, thesection that I found the most
interesting was strategicobjective 3.3, which is
dedicated to softwarevulnerabilities. And the idea

(06:16):
that the people who are hurtmost when there are severe
software vulnerabilities are theend users. And yet, vendors,
software publishers don't reallyface many, or in any case, in
most cases, any legalconsequences whatsoever. Like
there's the case of Uber, whenlike a breach was covered up.

(06:37):
But for the most part, like ifyou're publishing popular
software, and you have a bunchof vulnerabilities, and some
vendors, as we know, havehundreds of vulnerabilities a
year, they don't really faceconsequences for VAT. So the
Biden administration is arguingthat there should be some legal
consequence for vendors thataren't following best practices.

(06:59):
Now, they aren't very specificabout what those are. Other than
that, they would like to passlegislation. And they also said
that there would be some safeharbor frameworks so that folks
who are following softwaredevelopment best practices
aren't going to be punished fordoing the best by doing their
best because softwaredevelopments are,

(07:20):
vulnerabilities are aninevitable fact of life. But to
actually answer your question,there are more software
vulnerabilities every year, thebar of entry for threat actors
to exploit flaws is lower thanever. And I think while I don't
know if some legislation willactually come to pass, I think

(07:41):
it's really interesting thatthey're pushing for it now.
Because, you know, thevulnerability landscape is, is
worse than ever, or theresearchers are better at
finding them than ever.

Antone Gonsalves (07:53):
Yeah, but it is critical that that Congress
work in collaboration with theadministration, right, because
they're the ones who would passactual laws and penalties and
then fill in the details.Correct. Is that That's correct,
right. This is not justsomething the administration can
do on its own.

Alexander Culafi (08:10):
No, no, no, this would be an executive
order. And but I put that said,I'm not optimistic about the
current Congress's odds to passlegislation that could prove
controversial, and in the way itcould impact businesses doing
business, right, not to getpolitical. But it is very hard

(08:33):
to get laws passed in thecurrent state of legislature in
the United States. And so Ithink, for that reason,
something that's even mildlycontroversial like this, I have
my doubts about whethersomething would actually get
passed in the near future.

Antone Gonsalves (08:48):
Okay, well, what's the cybersecurity
industry's response to what theadministration is proposing,
whatever, whatever you'd like todo?

Alexander Culafi (08:58):
So the reason we're talking today is for the
last few weeks, I've beentalking to vendors and security
researchers to get an idea ofhow folks are feeling about
these ideas. Now that the dustis sort of settled a bit. And
I'm actually surprised peoplewere more open and willing to
talk about it than I expected. Ithought that when I talked to

(09:19):
people PR was going to be like,Oh, no, no, no. This is a little
off scope. You know how they canbe sometimes. But people were
very open to, to their credittalking about this and the
reaction was generally positive.I think people were very happy
that the conversation wasgetting started about sort of
taking the onus forvulnerabilities off the end user

(09:42):
and on to the vendor more Ithink some people disagree
whether it should have startedin legislature, and I think a
lot of people are worried aboutwhat implementation would look
like not even that it would betoo strict or anything but
whether something resemblingimplement, implement tation
could even occur right now. Sopeople were positive a few

(10:03):
people were even bullish, Iwould say. But the other emotion
that I did see was we'll see ifsomething like this actually
happens.

Antone Gonsalves (10:14):
Yeah, I mean, the bottom line here for
business is that this adds acertain amount of uncertainty
right now. And in business isnot like uncertainty. You know,
it's hot conditions. All right.Finally, the large language
models that drive generative AIneed high performance computing.

(10:36):
So there's an obvious need forfaster and better CPUs, and
GPUs. But what about storage?How are the storage vendors
serving the companies runninggenerative AI? Here to tell us
is techtarget editorial storagereporter Adam Armstrong, it's so

(10:57):
so what are the storage vendorsselling for generative AI
infrastructure?

Adam Armstrong (11:02):
Interestingly, they don't have any new products
yet the V storage infrastructureand architecture for high
performance computing kind offits generative AI like a glove,
that so far, that's what they'vebeen using PD scale out parallel
file systems scale, that isanother thing that using the
large language model sits on thestorage and is loaded to the

(11:23):
memory then it gets processed inthe compute the GPU CPU, so they
need storage with high I ops tofeed the memory. So flash
storage fits that bill, flashstorage, the NVMe flash the PCIe
Gen four is pretty fast. Andthat right now is what they're
using.

Antone Gonsalves (11:39):
And there's going to be some they are
talking about doing somethingwith memory, right tweaking
memory, so that it could gethigher performance and storage
for generative AI because as weknow these large language models
require speed and just aboutevery part of the
infrastructure. Yeah, the

Adam Armstrong (11:56):
the natural evolution of storage
technologies to get denser andfaster, both of which will play
into generative AI, their largelanguage models will get more
complex and therefore larger,and they will need to load them
faster. So the the storageitself will get faster over
time, which fits in this withmemory memory is constrained
right now. Because a it'sexpensive, and b It's just very

(12:19):
small. It's hard to really scaleit up. But there are
advancements coming like the CSLprotocol, which can open up
memory much, much larger.

Antone Gonsalves (12:28):
Yeah, it's good that you mentioned CSL,
which stands for computerExpress Express link interface.
Tell us a little bit about that.Where what is what will it do?

Adam Armstrong (12:40):
A six does a lot of things. It's a it's a
protocol that goes from the CPUto memory mainly, but from the
storage perspective and upcomingadvancements it will be able to
it will allow people to pullmemory together. Regardless of
its generations, it could be thecurrent DDR five generation
memory or older ones, DDR threeor four. Another thing it does

(13:02):
is it can look at storage asthough it's memory. Now this
won't increase the speed ofmemory, but you can still tear
it off. So if you need a lot ofmemory, instead of spending
millions of dollars forterabytes of memory, you can
throw storage into the mix, getthe cost down, and you can tear
it in a way that you could stilluse the memory in a fast way for
generative AI.

Antone Gonsalves (13:22):
And you also wrote about a company create
crater labs in the storagesystem that is using to run
generative AI. Can you tell us alittle bit about crater labs

Adam Armstrong (13:32):
for the generative AI part, what they
did, or what they told me as anexample was that they generate
images, similar to what youwould see with Dali, but a
little more specific and theexample given, they're working
for a nuclear power plant. Andthey were looking at specific
welds and specific smallspecific parts. And in those
cases, you can't have anydefects. So immediately, they

(13:52):
have really low defects andcrater labs would go in and
generate terabytes worth ofimages. So 1000s or hundreds of
1000s of images to get theminimal amount of defects
possible. And to do this, theyuse Pure Storage. Flash blade,
which is not a parallel filesystem, but it's a it's a scale
out NAS system. So on pure theyhad an on prem for its speed.

(14:14):
You don't have to deal with thelatency of going back and forth
with the cloud. But they wouldalso use peers built in object
storage to like the bulk of theimages they generate. They
weren't using they would justtear off to the cloud.

Antone Gonsalves (14:27):
Alright, that wraps up this week's show.
Thanks for watching and enjoythe weekend.