Crucial Tech

This episode is sponsored by the Cyber Marketing Conference in Austin, beginning November 15.

AI agents are making Black Friday a happy hunting ground for scammers. And it's the thrifty shoppers they target.

Threat research from Anomali was the first cybersecurity company to send us a "report" about holiday scams so first come, first serve. We talked with their hed of threa research, Jay Passarelli.

People keep sending me books to review. I don't know why. But I like to read, I read a lot and I read fast, so it's not a big imposition. More often than not I find what the book is missing early on. It was in the first chapter of The Protector’s Edge: Leadership Through Strategy and Action by personal security experts Chuck Randolph, Jonathan Wackrow, and Fred Burton. This is probably not a book on your Amazon wish list and for good reason. It’s a dense book, more suited to a textbook, by one of the author’s own assertions, for Criminal Justice majors and special forces veterans. However, if you are a CEO, a CMO or a CISO, you might want to give it a skim.

But first we talk with Gianna Whitver, CEO of Cybersecurity Marketing Society, about the Cyber Marketing Conference which should be on your calendar.

With the Cyber Marketing Conference starting November 15, I thought I’d take a slight detour into the realm of executive coaching. So I called up an old business acquaintance, Brad Smith, Founder of Stellar Insight to discuss one of the biggest problems executives have in cybersecurity: connecting the dots between what their company does and what their customers actually need. That process, done right, leads to success. Done wrong, it leads moribund growth for the seller and to disaster for the customer who can’t properly protect themselves.

I have a certain affinity for what Brad does because my job is the connect the dots between them and the companies I interview, but an executive coach has a more fiduciary responsibility than a journalist. That's why this conversation could be crucial to a tech company.

The last two episodes have been about imposing the doctrine of reasonable care to the production, distribution and use of AI technology.  I also wrote a story about it that posted this week on Cyber Protection Magazine.  I thought I was done with it.  I was wrong.  Lots of stuff has happened including a new bill in Congress dealing directly with liability of AI companies, Meta changing it’s terms of use to state that they were not responsible for any errors produced by their AI, and a lot of emails and texts from people wanting to chime in.

One of them is Jonathan Capriola, CEO and founder of AI Blockchain Ventures in Siesta Key, Florida, which is making tools and processes to control and identify AI agents.  He’s kinda all over the map as most inventors I have met are, but he’s making inroads to the government and major corporations with his tech.  It was a fascinating discussion.

This episode is sponsored by the Cyber Marketing Conference to be held in Austin beginning November 15

I've been a professsional communicator for more than half a century, as a working journalist, a technical editor, a marketing professional, and back to journalism in the course of my career. No subject area has been more fascinating to me than cybersecurity. But it is also the industry with the worst marketing I've ever seen. Underinvested, misunderstood, misused and lacking serious committment.

That's why I'm glad there is the Cyber Marketing Society. there needs to be a place where communicatiions professionals can go to get a reality check on what is possible and to discovere that they aren't crazy, their management doesn't understand what they do. And that makes the fifth annual Cyber Marketing Conference the right place to be in November. We spent this episode discussing what is needed and why the conference came about with Gianna Whitver, founder of the society and welcome them as a new sponsor of this podcast.

In our second part of this series, we talk to companies actively involved in enforcing responsibility from users. First up is Christopher Dion Johnson, CEO of Indie Me. His company creates a registry for celebrity facial property so they can’t be used without permission in deep fakes. He is followed by Austin Worrell, an attorney and founder/CEO of Dialogica, an AI assistant that provides back office support for law firms, doing the gruntwork of paralegals.

Both guests take different tracks in licensing, but they both agree that mandating personal responsibility is the most effective path to AI safety.

We took a break before launching into Season 13, which should take us to the end of the year, but we have a doozy to start out with.

Earlier this week, my cat decided to throwup on our bed in the early morning and by the time I got it cleaned up I was wide awake. So I started my morning routine of reading the news around 3 am and came across the story of Anthropics IPO documents being leaked early and claiming their technology is a threat to humanity's existence. That came with stories about OpenAI's new model invading hudnreds of other comoanies and more about the giverenment's inability to apply any legislative controls.

But there are examples of how we have put controls on dangerous technologies in the past... by licensing their use and manufacture. This podcast is part one of my investigation into how tht can be done. This week, we have Tom Whipp, a financial CISO in. the UK and a long time AI researcher and expert witness, Joseph Steinberg who offer more traditional controls mandating responsibility in building AI tools. Next week we will look into how to control personal use ad entry into the business and AI without hampering free enterprize.

Back in May the coding world reeled to the news that a hacking group, using customized AI agents, had breached Github and stolen 3,800 of its internal repositories by a threat actor group tracked as TeamPCP.

The attack was designed to stay under the radar: it ran entirely within normal user permissions and explicitly avoided privilege escalation, so it looked like ordinary developer/AI-assisted activity rather than an attack.

The question that comes out of this is, are AI agents fundamentally changing the trust model in collaborative software development?

So today I’m talking with Matan Bar-Efrat, the Rein Security, CEO, who’s company is one of the latest in a growing group of companies specializing in enterprise generative AI governance and data security companies. His answer to that question was refeshingly candid.

Flock has been in the news recently in a backlash against municipal surveillance, but this technology has been in use for half a century. Why the problem now? We sat down to talk with a city commissioner from Del Ray Beach, Florida, Tom Markert, who also consults with the FBI on cybersecurity. He's something of a rennaissance man wh, in addition to his corporate and civic work, also writes thrillers and screenplay related to technology and government. He had some insight into the controversy and it is more than surveillance. It's about competence.

A few months ago the tech world went into a tizzy over Anthropic's announcement that it's latest fronter AI incarnation was finding zero-day vulnerabilities. My BS meter started pinging immediately.

A zero-day attack requires finding a system vulnerability that no one knows about. It is about as creative a process that a blackhatter can pull off. But AIs can't do anything new or creative. It's output is always based on something a human has already done and shared on the internet.

Then I got a pitch from a Swiss academic and tech CEO Ilia Kolochenko titled, 'The illusion of AI Zero-day attacks". this is someone who knows how to get my attention.