ChatGPT And The Benefits For Cyber Security by Lorna Armitage

hi I'm here to talk to you about chat GPT and the benefits of AI in cyber my name is Laura Armitage I'm a caps look at co-founder caps Locker co-founder a co-founder at Council fever let's try it that way and I like to put this up when I'm kind of introducing myself because I think what it shows is that kind of nobody's just one thing we're not just a job title and people on their Journeys are really more like a network and kind of less like a linear um and straight folders as we sometimes think then and this is kind of mesh you can see their senior lecture it's quite nice to be back behind the lectern it's been a while it's been a while since I've done a talk in person actually um I think this might be the first talk I've done in person since clovid before covered so that's interesting um but yeah it'd be really good to be um a B-side in Yorkshire and it's really nice to see mostly because I'd have to travel very far to come to this one and I actually pull my back looking at suitcase around bloody London last week so it's nice to just be able to hop on a train for 10 minutes and get in here so I'm going to start with what is chat GPT if you've not heard of Chachi PT where have you been quite frankly but what is Chachi PT so it is an artificial intelligence power tool and it's designed to engage in conversations with people using natural language processing and basically what that means is that it generates human-like responses based on the inputs that it receives so it's looking at kind of having conversational um kind of results to things and when you prompt in so unlike a a kind of traditional search engine although they are getting more kind of focused on this kind of AI what what AI does is it gives you that conversational response and a little bit more tailored to what and a bit more intuitive I'm not human intuition but a bit more kind of intuitive to what you might want and kind of due to its nature it's trained on a on a wide range of topics and can provide information and answer questions and even offer different suggestions to what you might be asking it there so it's a quite a powerful um tool um AI in general is becoming more and more powerful we're not a true AI just yet if we ever get there Run for the hills quite frankly because we're not turning the machines off if we ever get there um but I'm going to talk to you about some of the benefits of using chat GPT in cyber security so one of the benefits is around improving user awareness and training and we can use chat GPT to develop interactive training programs it can offer some really creative and unique possibilities when designing training and awareness campaigns um it can be used to develop interactive training programs and simulations that help users understand really what cyber is about and how it can kind of relate to them in those terms as well and the importance of cyber security it can allow us to get a better understanding of an understanding of how to protect themselves and their organizations as well we've all had the training in organizations aren't we the Click Click barring training we're ticking the Box we've done it we've gone through we've not really learned anything from it and Chachi BT can help us get a little bit more creative and give some new and novel ideas um to that training and the awareness that we developed within organizations when we look at things like threat intelligence as well and we can use AI quite a quite well in threat intelligence AI has a real unique ability to be able to analyze really large volumes of data and for us and it can generate generate insights into emerging cyber threats and attack Trends and it can really help organizations proactively identify and respond to potential threats um that they faced it can also be leveraged as a a kind of intelligent virtual assistant um to analyze security logs to help us identify and respond to potential threats that that are there for the organization and look at how kind of we mitigate risk around those and look at detecting anomalies and things and it can also help us automate the the monitoring and the responses around those as well going forward and you know indicate those potential security breaches all that malicious activity that the organizations might might face overall it can help improve an organization's security posture as well so when we're looking at developing security policies and procedures it can really help us in assisting and developing those security policies and procedures that align with those industry-based practices and compliance standards that the organizations to need we've all used templates and I don't believe anybody is telling the truth if they're selling outlooked and used a template so that's all is it throws a template out for us that we can then use and put together and help us develop those policies and procedures and like I say you pop in what what um compliance regulations you've got there it can help you to align with those as well it can provide guidance on risk assessments access controls incident response and different businesses need to adhere to different things we understand that they've all got different right risk appetites but it can really help you bring those together and help an organization really kind of establish a a strong security posture over overall and what I mean by a strong security posture for those who might not be familiar with that is that kind of of encompassing the various aspects of um security including those policies the procedure the technology the the people element of it and it it involves that combination of preventative detective and responsive measures and designed to protect the organization's assets there information and education as well and this is an interesting one chapter really answers quickly answer questions for people and provide the information on on the vast range of cyber security um topics that you've got there from the basics of you know a good password management to the complexities of network security and how do we secure against that um you know it's like a more direct Google you're getting you're not getting a thousand different articles so actually you're getting a more direct response to the question that you're you're asking there you know you can put into it what is risk and you're getting a detailed response that you can read through you can follow up with you know further clarification on that and it really is like having more of a conversation um than kind of just a traditional um Google or any other search engine that you may use I'm not affiliated to Google in any way but a much sort of natural conversation on that as well and it really can help users sort of better understand the risks and challenges of cyber security so they can not only protect themselves personally as well but also help protect the organization that they're that they're working so the benefits of chat GPS well it seems there are lots of them so you know overall Chachi BT can be a really valuable tool in helping organizations and users better understand Sab security and manage their cyber security risks more effectively however and however is just a fancy book quite fancy don't let anybody tell you any different what if I actually told you that kind of despite agreeing with some of it that was all written by chat GPT every bit of him was written by chat GPT there so and I did struggle with elements of that I was wanting to put kind of different like little I don't know allegedlys in there but I thought it's probably going to spuff it spoil it it's like okay I'm just gonna have to get through it I'm not sure I agree with all of this but yeah so it was all written by Chuck GPT we're not there yet we're not there yet it is a fantastic and it is a powerful tool but humans are still essential in the security process for several reasons um that we're going to go through so when we look at contextual understanding really important to any business that you're looking at um anybody who is a consultant or has definitely been on the capsule course we'll we'll know the phrase it depends and it absolutely depends on the business on their risk appetite their profile what assets they're protecting all of those things you need that contextual understanding to be able to make better decisions and to be able to look at actually the solutions that you provide into the problems um and you know humans really have that ability to understand the context of a situation that AI just doesn't have um yet to that level you know it's um it's still a critical role in everything that we do there we've got what else we've got investigative skills so it is great you know it's great analyzing data and there's different elements of that and but you know you've still got to um have skills that the technologists just can't replicate when you're looking at a vest investigated breaches instance you need to be able to go and speak to people you need to be able to have um some level of kind of understanding not of just the context but it might be interviewing Witnesses it might be understanding patterns of behavior and that we need to look at there again that the AI just doesn't isn't able to replicate they are not it's not at the point yet in AI where it can actually fully replicate intuition and that human intuition that is you know absolutely essential to a lot of what what we do in security when we're looking at things like investigating and an incidence the communication and collaboration again effective security requires that collaboration and communication between different teams you know you've got the security team you said it earlier you've got to be able to effectively communicate with all the people within the business your HR your security the business your exec team that is essential to be able to really fully get that that security posture within an organization um and it requires Source interaction again that AI just whether we like it or not it requires social interaction the AI just doesn't doesn't have and is not able to to be able to replicate and that emotional intelligence that is needed in some of those situations you know to be able to have conversation sometimes very difficult conversations um it's just not able to do that security decisions often involve as well ethical considerations and that is really important now I know there's a lot of talk around ethics in general when we're when we're looking at Ai and how it's developed but what I'm talking about here is actually when we're making judgment calls when we're looking at situations and we're you know we're thinking about the ethics and within situations and and things like that you know the the human element is still needed there we need to still make those ethical and judgments the AI can't make because ethics is really around based around um subjective viewpoints you know it's based around a lot of times subjective viewpoints it's based around our moral reasoning um ethics are based on potentially how we've been brought up what kind of um Society we live in um you know our history as well as kind of where we are at the time the communities that we are a part of so it's really difficult again for AI to be able to replicate all those things um so we we need to kind of look at how do we combat all that when we are looking at AI because it is great and like I said it's a powerful tool for to be able to help us in our decision making and in our learning and across the board but not all decisions can be logical um again like you know it needs that emotion it needs that ethical reasoning and things um like that going forward so in summary amazing fall I'm going to faster I've asked Chris Rosie told me I needed to be quick because I'm gonna before the keynote and I'll fight panicked um so I think in summary what what I would stand and say today is that you know technology plays an essential role in ensuring security systems you know but humans are still essentially in the whole process um we really can't be replaced not yet anywhere like I said and if we if we are ever replaced then we don't need to need to really run for the hills because it's going to be scary out there and but we can't be replaced yet and um you know chat GPT didn't like that last bit I did it who knows thank you thank you any questions [Applause] the way around the world so touchy if it is quite early on yeah and we talk about the different ethical issues but humans made mistakes as well and see like the law the lawyer the US lawyer who used tragically research on May and obviously got thrown out because verify validated yeah into a point where you know always say so humans trained as well as the church you can see engines yeah it's an it's an interesting one isn't it I think I think it comes back to exactly what your point actually you've got to validate you know you've got to be able to validate some of this stuff and you know my my back I've got an academic background so you know around research it's all about you know making sure you're validating you're looking at um ensuring that you've got the reference in and you can back up everything that you're talking about I think AI um chat GPT in particular is fantastic for that initial kind of element of research or or learning um but you still need a level of understanding and knowledge to be able to take those results and interpret them in the right way and and validate them and know that it is telling you the right thing so if we talk about the the policy template great templates are great but you can just take a template and Britain or business you need to be looking at that template and tweaking it and understanding okay that bit's relevant here that bit's really not relevant for us so it's a good starting point um but I think it is it is just that it's a starting point and you still need a lot of a wrap around you know around it to to ensure that um that it is valid what it's telling us and and I think a hell of a lot more training around the humans that are using it as well um for sure uh just pull it back first and then yeah oh no but that would be an interesting uh yesterday to say I've Not I've not seen anything on that but it is interesting I mean it is becoming more prevalent I know it's something we need to look at at caps lock as well because you know Learners are starting to use it um and it is as initial tool as I said it's it's not that different from you know gilgling or you know using the search engine you can still find out this stuff and probably a quicker process but then there is the there is the element around it I said but I've not seen it in the context that you're talking about and that would be interesting right is that like a chatbot sense yeah yeah I mean that's an interesting concept isn't it because actually what you're doing there is enhancing the kind of the human resource in that in that instance which yeah it's a really interesting way to use it sorry there's just one here first and then uh so you make a comparison um requests I have lots of thoughts around that I think I think yeah I mean we're talking about kind of the debt protection um issues with that yeah there and there obviously is um lots of issues around that I think templates in the sense that I'm I'm talking about really are just the static ones that you're saying but um you know I would be cautious of what you were putting into um chat gbt and AI special if it was business um you know daily intelligence then yeah we'll be definitely cautious about that for sure that feels like here a whole different chat on it and lots of training I think the shops yeah [Music] yeah and then you um associate responsibility I appreciate it as a national person instead yeah but at the same time it's good yeah um I've probably got to be careful what I say on camera to this just it's gonna be there I'm in the recruitment in my opinion and this is my personal opinion the recruitment process is flawed anywhere it's very much different boxes so do you know what if you can find an easy way to get around that then I say why not as long as you know you're not you're not explicitly lying um about your experience and what you do you know everybody what's the word exaggerates a little on their CVS and things that's just how it is and I think when you've got such a potentially convoluted process that takes so much time and it is a numbers game so you're having to put a lot of these things in especially if you wanted to personalize a little bit and tear a little bit then you know I can't see much harm I might regret saying this in uh in getting a little bit of help doing that to make it a faster process yes and that's what I'm saying as long as there's no kind of explicit live on that um that you're telling that you know I fit if itself makes it sound but then you know you've got the plan to write for sure yeah that kind of social experience useful yeah and that's always the problem right with any kind of technology or any new Advance you know it can do great things but you know as we know they can always do um bad things and there's always some there someone there to to exploit that um but I think yeah just to reiterate you right you've got to be careful what you're putting in and there is a lot more training and awareness that needs to be done around teams using this and and making sure it's appropriate but what's putting it I mean it's collecting data right yeah I mean I generally use it for like stuff like this so it's like you know just putting in a bit of fun so I've not I've not seen any personally but this Horror Story is um around something they said you know my view on on AI in general is um and this is this is coming again from kind of an academic background it is it's still a very new um thing there's still a lot of research to be done on it um and it can be really powerful tool but I think it could be a really dangerous one as well in the wrong hands and you know when we see the advancements you know it it could potentially get very scary have [Music] the thoughts well there's an idea well to be fair he's actually teams is building in a function to do that now right so our natural Microsoft teams there is a function now to do that okay so you mean on unauthorized box yeah right [Music] [Music] with everybody else yeah businesses and this is the problem with with anything any kind of technology and if we all want to do things quicker and more efficiently and more effectively but there's often consequences and payoff for for doing those things for sure yeah [Music] yeah well I mean it's um when you look at how much of it's all consult it's not it's not although the security the apps obviously taking a lot to carry into into account That's not internet function s yeah yeah when your history is on there you literally gone there as you're using it it's not you know it's not it's not deleting it's staying there that starts so much it's not just starting off with um absolutely and I think that is that is the key thing isn't it it's it's just to feel like any other tool you know it's got some magic here that we're dealing with it's still like anything that day is going somewhere so you need to really be careful what we're putting in there one last quick question at the back um and I better not say anymore on camera about that okay thank you I just need to say the keynote is downstairs in the big big room next one thank you everyone thank you