AI: Cyber Security, Agents, and the Future

So Jae, I'd like to start out today talking about how does AI threaten or enhance cybersecurity in the country?

It can do it in a myriad of different ways, but I'll mention only just a few.

One of them is social engineering, when a scammer basically tries to scam you out of your money by calling and pretending to be someone else.

That's one of the examples.

You've had this happen to you once or twice before where, where you get a phone call and the person on the other end of the line is trying to convince you to send some money.

With generative AI, it becomes infinitely easier to fake someone else's voice or image to trick the person on the phone.

And AI itself can be, also be vulnerable to attacks, so data poisoning is one of the things.

Data poisoning is an instance where the data used to train AI before it becomes accessible to the general public gets poisoned.

So say you are training an AI program to recognize a picture of a dog.

You show the AI thousands and thousands of images of a dog, but you can conceivably switch or flip the label of that image of a dog and to indicate that it's a cat instead.

That is an instance of poisoning.

And there's a recent article out through Anthropic, I believe, that stated only 250 poisoned documents out of millions and millions of data points is necessary to corrupt AI.

On the other hand, AI's ability to process a vast amount of information quickly can really help cybersecurity professionals focus on actual attacks.

In the report, we talked about the Legislative Data Processing Center's, a presentation on their usage of AI.

They have an AI software that basically can sift through millions of security events, and then in this instance, they talked about one day where they had to cover 300 million security events, which is impossible even if you had a team of, say, 100 people, which they don't.

But by using AI, they've managed to sift it down to one noteworthy event that has to be investigated.

Okay, Jae, so what can the Commonwealth do to improve our cybersecurity?

So I think it's important to understand that AI is a tool that comes after cybersecurity infrastructure, and we really need to beef up our cybersecurity infrastructure before we get AI going.

So I've met with Heidi Norman, who used to be the CIO for the city of Pittsburgh, recently at, at an event, and she basically mentioned a few things that I think we can all think about.

So her point was that we have to focus on county and municipal governments that lack money to hire full-time cybersecurity staff.

First, the Commonwealth can create and publicize cybersecurity bundles, and what she means by a cybersecurity bundle is a package that has information of pre-vetted cybersecurity vendor as well as IT professionals who can serve as cybersecurity staff on call if necessary.

All this information would be pre-vetted by the Commonwealth government, which makes it reliable information for the local, local officials.

The Commonwealth could create a .gov domain website where government officials can shop for cybersecurity bundles, and it would be laid out in a grid system similar to airfare and hotel search engines.

So the horizontal axis could indicate the amount of funding the municipality has available, uh, and then the vertical axis could indicate the basic security needs of the municipality.

So, uh, depending on what kind of data they have to secure or any kind of systems that they have to secure, you know, they could literally just look at the axes and point to where they are in terms of cybersecurity needs.