EPAM Cybersecurity Podcast

People are, belatedly, getting smarter about privacy—and there are all kinds of business and social ramifications here. This is what Jesse Redniss, Founder & CEO of Qonsent and Co-Founder of BRAVE Ventures, and Sam Rehman, our Chief Information Security Officer and SVP, are talking about in the latest #CybersecurityByDesign episode of *Silo Busting.* Pointing to some very recent research, Redniss says: “Nearly 90% of people actually don’t want to have their data shared with external third parties off of their applications.” How can organizations and brands  do better? “It comes down to value exchange,” says Redniss. We’re 100% certain that if you listen to this useful and informed conversation, you’ll learn much about Apple’s iOS 14.5, the new AppTrackingTransparency framework, the future of personally identifiable information (PII), and the challenges of privacy education. Just one click and you can jump on the platform of trust and transparency that is their dialogue. Welcome!

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer Ken Gordon

Silo Busting 25: The Future of Privacy with Jesse Redniss and Sam Rehman

On the latest #CybersecurityByDesign conversation, we’ve got our minds set on… hacking. Bruce Schneier, author of the recently published *A Hacker’s Mind: How the Powerful Bend Society’s Rules and How to Bend Them Back Again,* chats with Sam Rehman, EPAM’s Chief Information Security Officer and SVP, about the hacking mindset and what it means for security in the age of generative AI. 

Schneier gets the conversation rolling by defining a hacker as “Someone who finds a bug or vulnerability, a loophole in a set of rules, and exploits it to their advantage.”

He talks about hacking not just computers but tax systems, hockey, tax codes, and Formula 1 racing. Rehman mentions that he appreciated a couple of Schneider’s examples and Schneier replies: “There are a couple? There are dozens of examples! Examples are what makes the book fun!” (Reader: The book is fun indeed.)

Schneier notes that “hacking isn't necessarily good nor bad,” which might surprise some who live outside the perimeter of the cybersecurity world. “Hacking is how systems evolve. If I figure a clever way to use a system, to subvert a system that no one thought of before, there are benefits as well as costs.”

The guys then get into the inevitable topic of 2023: The costs and benefits of hacking in the context of AI.

“I think it's gonna be a big arms race in AI and security,” says Schneier, adding that in the near term, AI will benefit the defender. “The attacker is already attacking at computer speeds. Being able to defend at computer speeds will be an enormous benefit.”

While he’s generally optimistic that AI will be good for the good guys, Schneier says “The transition period will be very chaotic.”

This chaos will come from the idea of AI has a hacker. He points to the idea of accountants—human ones—poring through tax code looking for loopholes to exploit: “That feels like something that you can train an AI to do,” he says. “And what happens when AI finds vulnerabilities in tax codes or financial regulations or other sets of laws? How will that work? How fast will they be? How clever will they be? Will they find things that are just so complicated that humans would never have found them?”

Schneier says that AI will increase the speed, scale, sophistication, and scope of hacking and wonders if these differences in degree will make a difference in kind. Then he answers: “The advances in AI in the past six months have been enormous. The next six months will be even bigger. Conversations we have today aren't going to be true in six months.”

What won’t change, however, is the hacker’s essential mind, which Reman admits has always been part of him: “I have always looked at everything as: ‘What else can I do with this?’”

“That’s totally the hacker mindset,” replies Schneier. “I don't think you can train that. I think that is something you either are or are not.”

Host: Macy Donaway
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 59: Bruce Schneier and Sam Rehman on Hacking in the Era of Generative AI

The cloud creates “cloud cowboys,” says Yinon Costica, VP of Product and Co-Founder of Wiz. 

This creates, as you might imagine, security issues. 

“Cloud allows people to really own their stuff end-to-end. They can basically create whatever they want,” says Costica. But he says that security professionals need to ensure that the cowboys can “govern their environments in a way that is secured while they continue to build.”

These issues set the theme for this #CyberesecurityByDesign conversation between Costica, Sam Rehman, EPAM’s Chief Information Security Officer and SVP, and Aviv Srour, our Head of Cyber Innovation.

Rehman notes that the frequency of change in cloud is “great for software engineering,” but adds: “It also makes it very, very difficult for you to actually find your baseline, your footing,” regarding security.

One of the most useful things we learn in this episode is how cloud might help spread the responsibility for security. In the past, security was solely the problem of the security team but with cloud and its self-serve nature, Costica says: “Security now should be democratized to those who are actually managing the environments, running the resources, have the right context.”

As a group, the guys talk about the differences between on-prem and cloud security, the role of visibility plays in cloud, the pragmatism cloud brings to security, and more.

Understanding the manifold nature of cloud is critical, and it will require a lot more education than many organizations realize. Says Rehman: “If you don't have a good understanding of what your cloud looks like, which is majority of people out there, then you still have a huge problem.”

Be part of the solution: Listen.


Host: Kenji Ross
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 61: A Clear View of Cloud Security with Yinon Costica, Sam Rehman, and Aviv Srour

Sam Rehman—a frequent voice on this podcast network and EPAM’s Chief Information Security Officer and SVP—was in the classroom recently, teaching students, and in the process was “surprised by the density of PII that's in in the system.” 

This led Rehman to realize that “at least here in California,” higher education’s investment in cybersecurity is “substantially behind.”

Catching up is a theme of today’s conversation about privacy, education, and artificial intelligence. 

Speaking for the (cyber)defense, with Rehman, is today’s guest on *The Resonance Test,* Scott Loughlin, Partner and Global Co-Lead of the Privacy & Cybersecurity Practice at the law firm Hogan Lovells. 

“It took a long time to get people to understand that the easiest thing to do is not always the right thing to do to protect the company’s interest and protect the company’s data,” says Loughlin. “And that is an experience that we'll all have with respect to generative AI tools.”

Loughlin and Rehman are put through their conversational paces from questions by Brian Imholte, our Head of Education & Learning Services.

They have much to say about data governance (“Data is not by itself anymore, it's broken up in pieces, combined, massaged, and then pulled out from a model,” says Rehman), data pedigree, the laws—and lack thereof—regarding privacy and generative AI. They also kick around the role that FERPA assumes here. “You’re trying to deploy this old framework against this new technology, which is difficult,” says Loughlin, adding: “There are some key areas of tension that will come up with using generative AI with student data.”

So where might an educational publisher or school begin? 

“Focus on your value first,” says Rehman. Do your experiments, but do them in small pieces, he says: "And then within those small pieces, know what you're putting into the model.”

This informative and spirited conversation is even occasionally funny. Loughlin brings up a court case about whether or not a selfie-taking monkey selfie would own the copyright to the photo. “The court said no,” notes Loughlin, adding that US Copyright laws are “designed to protect the authorship of humans, not of monkeys, and in this case not of generative AI tools.” 

Download now: It’s sure to generate some new thoughts. 

Host: Kenji Ross
Engineer: Kyp Pilalas
Producer: Ken Gordon

The Resonance Test 88: Scott Loughlin, Sam Rehman, and Brian Imholte on Privacy, Education, and AI

“There’s been an incident,” is a sentence no one wants to hear… except perhaps people like Ron Konigsberg, Co-Founder and CTO of Gem and our guest on *Silo Busting,* whose business is cloud incident response (IR).

We know what you’re thinking: What makes cloud IR different from all other forms of IR? 

Let’s let Konigsberg explain: “The challenge is that the cloud is technically simply different.” If you’re using legacy tools, “you're going to protect probably 20% of the cloud.”

Konigsberg is joined in conversation by Sam Rehman, EPAM’s Chief Information Security Officer and SVP, and the pair are pelted with questions by Aviv Srour, our Head of Cyber Innovation.

Konigsberg says that incident responders need to “adapt from network and agents to services and APIs, and constantly learn about new services and stay up to date and up to speed” with what the bad guys are picking up.

Oh, those bad guys! Regarding attackers, Konigsberg says: “They adopt innovation faster than defenders.” They can do so because they have fewer dependencies “and they care less [than defenders do] about breaking things.”

To illustrate, he asks us to think about migrating to the cloud: Imagine you’re an attacker and you simply never worry about any legacy systems from your previous environments. “They have much more liberty and they move faster.”

“They adopt techniques about new services that each cloud provider is releasing *tomorrow,*” says Konigsberg. 

So it is, in some ways, about playing catch-up. CISOs have had to adopt a new mindset and posture. “You can only block so many punches until you have to figure out [that] you need to move around, you need to counter, and so on,” says Rehman.

Rehman adds that CISOs have finally understood the “shared responsibility between you and the cloud provider.” But that’s not the only issue with the cloud. “It's much flatter than what you’re used to on prem,” he says. “Which means a lateral attack is a lot quicker, moving things around a lot easier, and the *simplicity* of people actually moving things around and infecting a large area is substantially higher.”

So how can an organization properly respond to, and learn to prioritize within, the cloud conundrum? One answer, says Rehman, is culture. 

“We have to adopt a learning culture in security,” he says. “They’re always gonna be one step ahead of us, but at least we're one step behind, not ten.” Pick up the pace of your learning and listen to the experts speak. Hit play!  

Host: Lisa Kocian
Editor: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 68: Cloud IR Readiness with Ron Konigsberg, Sam Rehman & Aviv Srour

Apps don’t just bring us our favorite music and allow us to engage in mobile banking; they present great opportunities for cybercrime. More than 80% of cyberattacks enter through the application layer. That’s why this #CybersecurityByDesign episode of Silo Busting is focused on application security, or AppSec, as the experts call it. One of them, Eugene Dzihanau, EPAM’s Head of Defensive Security Services, joins Sam Rehman, our Chief Information Security Officer and SVP, and Producer Ken Gordon to think out loud about what AppSec means right now. Dzihanau says that, in our cloud-driven present, “Applications became much more than applications” and that in this world “everything starts to become an application.” Rehman agrees and says that it’s a dangerous time because cybercriminals are looking vigorously for vulnerabilities. “Whenever there is change, there is chance for an exploit,” says Rehman. How to make applications more secure? Start at the start. Dzihanau says: “Thinking about security from an architecture perspective from the beginning will save you a lot of headaches.” Of course, it’s not simple to make this happen, and Dzihanau counsels us to approach this carefully and intentionally: “Don’t set the bar too high. Address the change in behavior of your developers and architects and make sure that the security steps are done throughout your SDLC, from the beginning to the end, from design to deployment.”

Host: Alison Kotin
Engineer: Kyp Pilalas
Producer: Ken Gordon

Silo Busting 14: Sam Rehman and Eugene Dzihanau on AppSec

EPAM Continuum's award-winning podcasts feature interviews with people practicing innovation in various forms, digging into their ability to deliver results. Repeatedly.

The Resonance Test 88: Scott Loughlin, Sam Rehman, and Brian Imholte on Privacy, Education, and AI

The EPAM Continuum Podcast Network