Some edited excerpts:
How do you see the evolution of the information security ecosystem?
Today, with cloud being adopted in a big way, criminals have been smart enough to leverage the cloud to scale up their attacks. Criminals have been smart to leverage the trust built in cloud-based delivery models. With the crime-as-a-service model, it is relatively easier for cyber criminals to outsource their work to smaller crime actors, who can leverage the tools built by experienced criminals to launch their own attacks. As a result, today, it is common to see models such as ransomware-as-a-service gaining more prominence. On the dark web, you can buy a kit that is personalized, customized and tailored to attack the organization that you want to target – from DDoS services to ransomware exploit kits – you can practically buy anything you want with the anonymity required with the help of bitcoins. The crime-as-a-service model has significantly lowered the barriers for criminals to attack.
Your view on AI as an attack tool as well as a critical component of cyber defence infrastructure?
In the digital ecosystem, it is difficult to ascertain if the person who I am interacting or communicating with is genuine. Today, with AI, it is possible to even mimic voice, as several cases of deep fakes imitating popular actors or leaders have shown us. As a result, there is huge erosion of trust in the digital ecosystem. The same AI which is used to find out the motives or behaviour of criminals on a network can also be used by cybercriminals to find out vulnerabilities and attack organizations. We use AI to improve our threat perception, identify malware better and classify data better. This is still an evolving field, and there is huge potential for using AI for improving the overall cyber security posture.
How can CISOs use emerging technologies or platforms such as ChatGPT to their advantage?
For starters, a platform like ChatGPT can certainly be leveraged to identify code vulnerabilities which can certainly be used by CISOs to find out common code vulnerabilities in their applications. ChatGPT can also be used to train young cyber professionals on how hackers create interesting phishing bait emails. For example, I could ask my team to use ChatGPT to think like an attacker, and use the learnings to improve our overall security posture.