Kirsty Paine is the Strategic Advisor in Technology and Innovation for cybersecurity and observability leader, Splunk. She provides technical thought leadership for strategic accounts across the EMEA region.

Paine spoke to Information Age about what it means to make the right choices in cybersecurity and the lessons we can learn from the Internet of Things (IoT).

When it comes to cybersecurity, your mantra is to ‘make good choices’. What are the common bad choices that tech leaders tend to make?

Some bad choices involve an over-focus on a particular latest hype, or really going too deep and missing the bigger picture. I think that making good choices is more about recognising that it’s better to make a good choice than to wait until you can make a perfect choice. This is what I see a lot of people doing, where they’re waiting for the most perfect solution to come along – it’s very pure – and such a thing doesn’t really exist. The whole time you don’t have a solution in place, you’re losing your capacity and your ability to respond.

Other bad choices include:

• Not investing enough in the basics
• Not conveying the value that you get from making your choices
• Sticking too much to your technical language when explaining what you’re doing

But you need to be creative and thinking about the ways that you can address challenges such as multi-factor authentication in a way that it doesn’t massively irritate all of your users, such that they find a different workaround – like they just all share their login or something terrible.

So that’s what I mean about good choices, not perfect choices. Just keep the big picture. Overall, it would be better to have everyone doing reasonable security, things that are frictionless, rather than perfect security things that inevitably lead them to writing down their password somewhere, you know?

You used to be with the National Cybersecurity Centre. A colleague told the BBC that cybersecurity needs to be built into AI systems, that there is perhaps a rush to get AI products to market without doing adequate cybersecurity integrations.

What is your view on that? What kind of checks and measures should businesses be having in place before they deploy AI systems?

I think there’s a lot of similarity between AI today and IoT, even five years ago. The innovation space is great because you’re creating things that have never been done before. It’s important to have that innovation. But as we saw with IoT, you can end up with a lot of rubbish on the market that has no security whatsoever, and people buy it in good faith, they install it in their homes, and then they are vulnerable to attacks, they are vulnerable to device takeover. It’s a place no one wants to be.

In the case of IoT, the UK government worked a lot on technical standards and a good code of practice. Then they moved into legislation because they found this voluntary guidance was not necessarily getting the results they wanted. They introduced legislation to say you can only sell in the UK market if you meet these very basic security principles and I think it’s a lesson to be learned in the AI space. As technologists voluntarily meeting these kinds of safeguarding guidelines, these secure by design principles built in from the start, which is what secure by design is. You start with security – you don’t add it on at the end as an afterthought. If we follow that approach with AI, we can avoid all of these horrendous attacks happening with legislation coming in as a last resort. We can actually, from the start, make a very positive technological improvement.

I think that when we talk about the security of AI, lots of people mean different things. The cybersecurity of AI, for me, is really about good software development practices that you would apply to any software development. You have peer programming, you have tests, you have a full history of what’s been done by whom, you have privileged user access management, you have all of this stuff that really controls how and who has access to that software, and what changes they can make, and then a full log of what’s been done.

There are some very basic software development principles that equally apply to AI. This may be new data that the model will be trained on, and making sure that that has some security to it.  

There’s an infamous example in some research, where you have visual recognition of road signs. As you drive in your car, you see it pops up, a 30 mile per hour zone, and it appears on your dashboard. There’s some research that shows if you just put a Post-it note on some of those signs and you train that model to say whenever there’s a Post-It note, like a bright pink square, the speed limit is 1000mph. That’s a theoretical attack but it shows the power of a poisoning attack. Imagine autonomous cars or self-driving cars suddenly accelerating to 1000 miles an hour. That is really hard, if not impossible, to detect. When people talk about the security of AI, they usually mean that software development part. They also mean making sure the data you’re training on is good quality, it’s trustworthy. I think it’s important to unpick what we mean by security.

Finally, you’ll notice I’ve said nothing about ethics, because when people say AI needs to be safe or secure, they’re talking about ethics. And they mean it can’t be biased. The very difficult thing with that is that ethics are different to everybody. When you’re teaching AI ethics, you have to set in some threshold or some boundary that it can or cannot cross. You see this with chatbots – they can’t give certain responses to offensive questions. But that has been coded in by someone who thinks offensive responses to certain questions is the line. And someone else might have different responses based on the age of the user and things like that. There’s a whole raft of things in ethics that are separate to the security conversation.

It’s difficult to put a timeframe on but to properly develop an AI system, how long would you say given all the checks, the testing and everything else?

If we talk about machine learning models, you get different complexities of these. Honestly, maybe 80 per cent of the task is getting the data together. In terms of time getting the right data, you need it labelled, making sure the labels are accurate and making sure it’s not poisoned.

Then you have to work out how good is good enough. By that I mean that I can cluster users based on their behaviours and I can say this group of users all look fraudulent. Well, they look like an insider threat for your company. Here you go. There are 20 users to investigate. Then your Security Operation Centre (SOC) might look at that and say, ‘Okay, we’ve investigated the 20 people, and ten were real insiders and ten were not.’ They might be very happy with a 50 per cent hit rate. Or they might say that last time it was a 50 per cent hit rate. It’s not good enough for us to spend our time on that – it needs to be at 90 per cent or 95 per cent before we will start taking that feed seriously. You always have this kind of feedback loop. That’s just clustering. That’s predictive stuff.

It does vary greatly depending on the complexity and how neat your data is. You can spin up a machine learning model just using a Jupyter Notebook, maybe in an hour – it doesn’t take very long. But if you’re building a full facial recognition, a fully developed system that can deal with lots of different types of data that’s done in a secure way. If you’re working on that full-time, maybe it would take you a month. It’s so variable, depending on the quality that you need it to meet.

Observability does play a massive role in developing these kinds of products.

Yeah. If you take AI, just like normal software, you need to know how users are using it, the average lag time, if there are any performance issues, all of that stuff. It should feed back into the development lifecycle. If the model always takes a long time with a certain input, you would want to know that. Often these things are hosted on websites and observability can help with that uptime and performance as well.

Then you move further up the lifecycle into this sort of DevOps phase. When they’re developing the model, it’s really helpful as well. You can do real user monitoring, you can do synthetic monitoring, where you’re seeing how users interact with a session or at least giving some test input to see how the model or the software would react to a user before it goes for release. There’s a range of things for observability, that would be completely applicable.

For cybersecurity and observability solutions, check out Splunk‘s suite of products

Read more

What is generative AI and its use cases? – Generative AI is the is a technological marvel destined to change the way we work, but what does it do and what are its use cases for CTOs?

Eight steps to a successful AI implementation – In this article, we outline the eight key implementation steps to help AI and machine learning deliver on its full potential

ChatGPT vs alternatives for programmers – ChatGPT and its alternatives are set to be especially useful for programmers writing code. But just how reliable is the technology for developers? Antony Savvas considers what’s available and what the alternatives are