AppSec Resolutions

Join us for the final episode of The Security Table for 2023. Chris, Izar, and Matt answer fan mail, make fun predictions for the upcoming year, discuss their resolutions for improving cybersecurity, and make a call to action to global listeners. Highlights include the reach of the podcast, explaining Large Language Models (LLMs), Quantum LLMs, Software Bill of Materials (SBOM), and the importance of teaching secure coding from high school level up. Chris, Izar, and Matt share their passion for making cybersecurity more accessible, practical, and effective through critical discussions and innovative ideas.

FOLLOW OUR SOCIAL MEDIA:

➜ X: @SecTablePodcast
➜ LinkedIn: The Security Table Podcast
➜ YouTube: The Security Table YouTube Channel

Thanks for Listening!

Transcript

Copy Transcript Copied

Chris Romeo 0:10

Hey folks, welcome to another episode of The Security Table. In fact, the final episode of 2023. We'll do more after, you know, when 2024 comes around. Ah, this is Chris Romeo, always glad to be joined by my friends Izar and Matt.

Matt Coles 0:26

You didn't do it right, Chris. It's Izar. Izar. Tarandach.

Chris Romeo 0:30

sorry. Izar.

Izar Tarandach 0:31

I'm still going for the one

Chris Romeo 0:33

The one?

Izar Tarandach 0:33

word.

Chris Romeo 0:34

Okay. Izar. Sorry. Izar is in the building. Uh, he's just, he's just moved from the green room to the camera spot that you see him here after consuming all the green m and ms that we had available in

Izar Tarandach 0:47

the crowd goes wild.

Matt Coles 0:49

Where's the popcorn when you need

Chris Romeo 0:50

well, that's a, that's a good point there about the crowd. So we got to see some statistics about the security table from, uh, from the time we launched early in 2023. And as it turns out, we're big in. Dublin, Ireland. That's our number one, uh, city around the world. So shout out to anybody in Dublin, Ireland, who's listening to us. And we also learned that we're, we're gigantic in Australia. So let's see, Perth, which I want to visit Perth. It's on the west coast, right, of Australia. So, um, Auckland. These are two places in Australia where we have a number of listeners. So

Matt Coles 1:24

Good thing, good thing Auckland is not in Australia and they're not going to be

Chris Romeo 1:27

Oh, it's in New Zealand. Sorry. Sorry. I knew that better. I knew that better than

Izar Tarandach 1:30

Wars have begun for less.

Chris Romeo 1:32

That's true. That's true. So thank you. So let's, uh, yeah, that'll be, no one will ever hear that because I'll have it completely cleaned up. No, I won't. It's fine.

Izar Tarandach 1:39

Only in Australia.

Chris Romeo 1:41

Sorry Auckland, I've been to, I've been to New Zealand. I spent a, a, a roaring 16 hours in New Zealand and I need to get back for a longer period of time. Um, but yeah, super excited to see we've got people listening to the table from all over the world. Um, something about our wacky, zany banter is, uh, what's, what's drawing people into the conversation here. Uh, we're going to talk about Resolutions, but also, eh, predictions. But, I'm going to talk about resolutions and then maybe Izar and Matt are going to talk about predictions. And then I'll make fun of predictions. But, we did get some fan mail here on the security table, which is pretty exciting. Like, we have our, I think this might be our first piece of fan mail. Alright, here, I'll read it to you

Matt Coles 2:25

Could have been

Izar Tarandach 2:26

the only one. It

Matt Coles 2:27

Could have hate mail, so, you know.

Chris Romeo 2:29

but we just, you know, we just kind of leave that alone. But, okay. Hi! I'm a big fan of the Security Table podcast, and I listen to it every time I'm at the gym. Sometimes your opinions contribute to elevating my heart rate, so thank you. I don't know, is that a good thing or a bad thing? I don't know what, I don't, uh, I don't know if that's like, you know, I'm so mad and furious that you people are just missing the boat so badly that it's raising my heartbeat. But, after listening to many episodes, I think I can predict what will happen next. Like right now. I think the next episode will be about predictions for the year 2024. Now, I am that good, or is it just due to information disclosure? Only two people know. Um, I don't know who the two people are, but

Matt Coles 3:12

that's a good

Chris Romeo 3:13

I thought there's three of us, so like, did two of the three of us know this is an inside job? But this, uh, this fan did provide us with a prediction for 2024, so let's start there, and we'll, we'll consider this prediction and decide whether we, uh, Want to attack it, agree with it, or something else. We will have our first large scale security breach on the pipeline, or leak, of a popular AI. People will get disclosed on previously unknown details such as how the AI is tied to their privacy. Major worldwide outrage will ensue, but will last four days. It's very specific that it's going to last four days. So, all right, what do you, I mean, how do you guys respond to this? What do you, what do you think about this prediction?

Izar Tarandach 3:59

But, uh,

Matt Coles 4:03

Crazy, crazy fan mail.

Chris Romeo 4:05

It is very, very specific. But I mean, is there a chance this

Matt Coles 4:08

I'm sure, I'm sure this is, it sounds like an inside job. Like there's something, something gonna happen. You know, this person knows that they're, maybe they're the culprit.

Chris Romeo 4:17

mean, let's push beyond

Matt Coles 4:19

last four

Chris Romeo 4:19

let's, let's push beyond that as, as far as who may have actually done this. And is it, is this, is this a potential problem?

Izar Tarandach 4:27

look, at this point, and again, connecting to what we did on the last episode, where we sort of got to the conclusion that, uh, AI is nice, LLMs are great, but they're just one more piece of software, right? And uh, the same way that every single other piece of software out there, at some point the controls failed and breaches occurred, I think that it's a matter of when, not if.

Matt Coles 4:52

Yeah, I agree. And, and, you know, it is, it is highly likely, I think from, from the discussion, the attack is not going to go through the prompt,

Izar Tarandach 5:01

Yeah,

Matt Coles 5:02

The attack is going to come from a database breach. Somebody's going to leave something on, you know, unprotected in the cloud. You know, we've seen that a time and time and time again, uh, or some piece of device, some hardware will get lost or something. So, I mean, these are classical computer systems. They have classical security vulnerabilities.

Chris Romeo 5:20

What about the privacy tie in, though? This, the, like, he's, he's making this conclusion, or drawing this conclusion that AI, LLMs, have more private data in them than we realize. That was part of the prediction, so do we think that there is a collection of personally identifiable information included within some of these big time LLMs?

Matt Coles 5:49

I think if an LLM has any source, any sort of history, right, understanding what was asked of it by a set of users. Uh, and if then, if that information is unfiltered in any way, uh, then, then I think yes, I think it could certainly draw conclusions. I, I imagine somebody could ask it, uh, and, and maybe in a way that would bypass the, the injection filters. Uh. You know, who, who's been asking you questions, what type of questions have they been asking you, right? These are all great ways to start drawing conclusions about the user base.

Izar Tarandach 6:30

But

Matt Coles 6:30

give you potentially identifiable information. We know that, we know that with IP addresses or, or even, even secondary data with respect to health information, right, to put you into a population. So we know that that exists today for privacy.

Izar Tarandach 6:46

that assumes that all the basic rules of security and multitenancy have been broken, that the LLM knows about all the sessions that are happening at the same time, things that we wouldn't do in any other SaaS or shared application.

Matt Coles 7:01

Who, where, where do you get the, where do you get the sense that, that, that it's a multi tenant, segregating multi tenant enforcing system? It should be, it should be, yes.

Izar Tarandach 7:12

you shouldn't have access to any kind of context or whatever happens in my session. So, if what you described ever were to happen, I would say that, hey, somebody here got more problems than an LLM.

Chris Romeo 7:25

But I think that's what's happening right now though. What Matt just described is, what you've described is what you, what we want to see, but that's not how these things work right now. If you use ChatGPT through the, through the web interface, the user, the license agreement allows them to Repurpose your requests as trading data for future, uh, future brightening of the model. So if you give up some information in there, you, you could accidentally give up personally identifiable information, which then technically they could insert as trading data back into the model.

Matt Coles 8:00

Well, even if they, even if it's not injecting back into the model through the, again, through prompt data, let's go back to the original training data. I mean, it was fed, The internet, right? So in theory, it has access to Facebook posts or, you know, IRC channels or other session information, things that might have identifiable.

Izar Tarandach 8:23

no, no, no, wait,

Matt Coles 8:24

No, no, no,

Izar Tarandach 8:25

there is something, I need to get my head around here. A bunch of some things. So people are saying, oh, this thing went and slurped Reddit and got everything from there. Okay, fine, cool. But when you start saying this thing went to Facebook and slurped out there. Went to

Matt Coles 8:42

suggest, I don't know if it is or not.

Izar Tarandach 8:44

No, but other people have said that in the past. It went into Facebook and got whatever is public. It didn't go into Facebook as some admin and slurped everything that's out there and whatnot. All the private stuff that people should, to the extent that people do, keep private on a place like, uh, like Facebook, didn't do it, didn't make it into the training data, right? Because it's still private,

Chris Romeo 9:11

Yeah, but Meta is building their own models, right? So are they using Facebook and Instagram data to teach their own internal models?

Matt Coles 9:20

Or WhatsApp.

Chris Romeo 9:21

data that's bigger than what you could get via the public interface.

Matt Coles 9:26

Also, remember all those, remember all those stored databases, remember all those databases that get breached because somebody leaves them exposed with no credentials? If you have a, if you have a bot that's, that's, uh, you know, indexing the entire internet for training data, something, almost certainly some of that data is going to be pulled in. If it goes to haveibeenpwned. com,

Izar Tarandach 9:49

But how is that different from, uh, the engines that we had? The, the internet way back machine, uh, Google itself, that also indexed the whole internet. What? Like, uh, uh, confession, up to, up to last week I've been using LLMs as like a glorified Google. Go find me stuff and I'm going to figure out if what you're saying sounds like truth.

Matt Coles 10:09

I think it's the potential for the correlation, right? The search, I think, I think, very naive thought here, that the search engines are basically SQL queries. Here's a term, get me the term, find all the pages that match this term. And it does very little heuristics. It does some, I know it does some because you ask for certain, certain words and it goes, Oh, I think you actually meant this word over here. So I'm going to give you that result instead. But the ability, the power of the LLM to understand not only the words that you use in your query, but the intent behind your query and the, Sort of the predictive nature of what it thinks you want makes it much more powerful than just basic search engine. And that's where I think the risk would come in.

Izar Tarandach 10:56

I, I feel like I'm missing something here, cause, it's almost like people ascribe Magical powers to LLMs, and I simply don't see it. Look,

Matt Coles 11:06

I think the other problem we have right now is LLM's work in a, in a mysterious way. I, I, you know, the, the idea that multiple people have said, you, you ask it stuff, we know what the code is, we know what the code is, but we don't understand how it gets to the results. And. Yeah, I, it is almost certainly something we could know, but people don't.

Chris Romeo 11:35

That's really scary.

Izar Tarandach 11:37

from college days I already learned that the fact that I don't understand something doesn't mean that it's not explainable. That's for sure. But, I start getting worried when people who actually understand the thing, people who actually wrote that thing, look at me and say, yeah, we can't really trace the path between The conclusion and the, whoop,

Chris Romeo 11:59

Oh, that's an AI

Izar Tarandach 12:00

Physical control. That's it. The machines are coming after me. That's it. But

Chris Romeo 12:05

gotta, we gotta silence Izar, he's gotta be done now.

Izar Tarandach 12:08

But this one is actually physical. I have a physical control there. But So now I forget what I was saying. So explain explainability, right? So People to me and say, yeah, we can't draw a convoluted line between the conclusion and the premise. It got there somehow, lord knows how. So that worries me, not because of the thing itself. which, hey, cool, technology, yay, there are people who understand it, I don't, but where people are going to take those conclusions and go forward with, right? So, uh, a bunch of the, of the, the examples that came up last, uh, last week. The, the, the chatbots doing the travel thing, okay, fine, sure, yeah, whatever, do something with your, with your tickets. But the AI systems doing, uh, uh, weapon targeting, that, that's a bit more worrisome to me. If you can't explain to me what happened. between clicking the mouse on, uh, uh, a UAV camera feed and a missile landing on that site, that, that, that takes some, some minutes of sleep off of my night.

Matt Coles 13:22

So I asked, I did ask BARD for some insight into how it gets to the answers that it gets to. And of course, you know, they're not going to tell me, tell me the algorithms and everything, right? That's, that's IP right there. But, but one thing I think I noticed from, from its response, from what I did get out of it, was there were a lot of things in the pipeline, right? There's a lot of things in the information processing pipeline from training to responding to prompts. A lot of filters, a lot of passing data back and forth. Very classical system problems that we have where you have, uh, you know, say a microservice development where you have lots of microservices that do different things and do data passes along this chain. And it follows a path, and you could probably trace that path. Uh, if you so desire, but, but most people probably don't. Uh, and, and so there's, or the problem of APIs where you call different APIs and, and you sort of lose track of the, of the processing flow. Um, and possibly that you're calling APIs that other people own or wrote that you don't have visibility into. So all classical system problems. I, I'm, I'm yes, I agree. I'm nervous that. Not knowing, and hopefully, and I know that there is research going on to know it, um, but But boy, somebody put, I think you said it, you said it best in a private, you know, when we were talking offline, you know, some well placed print statements would really go a long way here to figure this out.

Izar Tarandach 15:00

You know,

Chris Romeo 15:03

Maybe, maybe that's our homework for, uh, for the holiday break here is try to figure out how LLMs actually work. Cause somebody has to understand somewhere.

Izar Tarandach 15:12

listen, the moment that we figure out how they do work, we get the, the, the keyword for next year, which is going to be quantum. And now soon we're going to have quantum LLMs. So we won't know how that stuff works on two levels, right? We don't know how the hardware works. We

Chris Romeo 15:29

Is a prediction? Is this your first prediction? That quantum LLMs, you heard it here first, are the new thing for 2024?

Izar Tarandach 15:36

I for one, welcome our quantum LLM overlords.

Matt Coles 15:43

You can know where they are or when they are. But not both at the same time.

Izar Tarandach 15:48

If we, if we're going to start predictions here, I have to get into Nostradamus mode, so let me know beforehand.

Matt Coles 15:54

Wait, wait, Heisenberg, right? You need Heisenberg for this.

Izar Tarandach 15:58

Or I don't.

Chris Romeo 15:59

Are we talking about the Heisenberg reference from Breaking Bad or the original scientist?

Matt Coles 16:05

I was talking to the original scientist,

Izar Tarandach 16:06

We're talking quantum, why do you, why do you continue using or? It's always and.

Matt Coles 16:13

also need to bring in Schrodinger, right?

Izar Tarandach 16:16

And his cat,

Chris Romeo 16:17

And his cat, which

Izar Tarandach 16:18

That must be one pissed off cat.

Matt Coles 16:20

Yeah,

Chris Romeo 16:21

That's true.

Matt Coles 16:22

Or not.

Chris Romeo 16:23

Alright, so I'm gonna, I'm gonna book that though as your first prediction. That quantum LLMs

Izar Tarandach 16:29

Quantum LLMs.

Chris Romeo 16:30

and I'm, you know what? I'm going to do the same thing that everybody does with predictions. I'm not going to write them down and I'm not going to think about them after we finished recording this and we're never going to talk about them

Izar Tarandach 16:38

Oh, and I'm gonna do what everybody does with predictions, I'm gonna qualify it. I'm not talking about a full LLM, I'm talking about an experimental two qubits thing that knows how to throw a coin and basically tell you what color the coin is. What the?

Chris Romeo 16:52

you're throwing cryptocurrency and Bitcoin into this?

Izar Tarandach 16:54

Oh, do I have to? Wait, wait, wait, there's, there's

Chris Romeo 16:58

about a traditional coin, but I'm like, if you can bring somehow blockchain into this as well.

Izar Tarandach 17:03

a startup in the making there, wait.

Chris Romeo 17:05

No, there's a prediction in the, you might, you might have a unique prediction that no one else has said. It's a quantum LLM stored on the blockchain.

Matt Coles 17:13

I think you just invented a new cryptocurrency, a quantum cryptocurrency.

Izar Tarandach 17:18

we need a quantum, uh, a quantum ledger. Your money may be there. Perhaps

Chris Romeo 17:24

might not.

Izar Tarandach 17:25

It may be going up, it may be going down.

Chris Romeo 17:27

know,

Matt Coles 17:27

isn't that all cryptocurrency right

Chris Romeo 17:29

I was going to say there's a number of legal cases going on right now that are making that particular argument that that's what cryptocurrency exchanges were doing was like, maybe your money's there, maybe we've used it for something else. It's, you know, it's, it's

Matt Coles 17:42

Flip a coin and you have a better result.

Chris Romeo 17:46

Alright, well,

Izar Tarandach 17:46

What is money, after all?

Chris Romeo 17:48

It's true. What is money? What

Matt Coles 17:50

Just an instrument of exchange, that's all, that's all money is.

Chris Romeo 17:54

That's true. Alright, Matt, you gotta go next now, but Izar has dropped the first one in conversation. He didn't even we didn't even, like, he just made it appear in the context of the conversation so he is Nostradamus after he

Matt Coles 18:06

I think, I think,

Chris Romeo 18:07

outfit. Oh, boy. Well, Matt, you go ahead. Well, the audience is entertained by some fun. Tomfoolery? I don't know if that's the right word that's happening in the

Matt Coles 18:17

Izar, Izarfoolery, it's Izarfoolery.

Izar Tarandach 18:23

I,

Chris Romeo 18:23

right, Matt. What's your, what are your, what are your thoughts, Matt? Give us one to keep us moving.

Matt Coles 18:28

So I think, so very, probably very tongue in cheek, but also probably very true, that, uh, our, uh, darn.

Chris Romeo 18:39

It's Nostra Izar.

Matt Coles 18:42

Nostrizar.

Izar Tarandach 18:43

It's Nostradamus.

Chris Romeo 18:49

Nostraldamus.

Matt Coles 18:50

to all

Izar Tarandach 18:50

for predictions.

Matt Coles 18:51

to, to, for all of our, for all of our listeners who are listening and not watching the video, you are missing,

Izar Tarandach 18:57

Nostradamus has entered the building.

Chris Romeo 19:00

Izar is in full costume here with a hat, hair, and a

Izar Tarandach 19:05

I need a renaissance thing.

Chris Romeo 19:07

Yeah, it's,

Izar Tarandach 19:08

wanted to do that.

Chris Romeo 19:09

uh, you lost the hat

Izar Tarandach 19:10

Lost a head.

Chris Romeo 19:11

yeah,

Matt Coles 19:12

It's behind you.

Chris Romeo 19:13

I don't

Matt Coles 19:14

The closest, closest

Izar Tarandach 19:15

Oh my god! It's behind me! It's behind me!

Chris Romeo 19:18

All right, Matt, go ahead. What's your, what's your, you were kind of in the middle of it and then we

Matt Coles 19:22

Oh, darn. I don't know. You know, predictions are resolution, you know, I kind of like your idea of resolutions. Predictions are so, predictions are so challenging. I mean, and I don't want to get into a lot of trouble with these. Uh, I think a prediction, I'll make a prediction, uh, about our, one of our favorites. SBOM that, uh, SBOM will be, will, will reach, reach its peak of, of acceptability, but also its peak of, of whether it's valuable or not. Uh, so we've done a lot in 2023 for hyping this thing called SBOM like SBOM's gonna solve, you know, world hunger. Uh, and I think like the AI cycle, SBOM will reach a, a a point where. Um, first off, I hope we, we also start introducing other terms, right? So, in addition to SBOM, we'll have HBOM, and we'll have, uh, uh, potentially other things as well. Attestation is gonna get big. And I have a feeling that what will end up happening is that SBOM will sort of take, go off of people's tongues as the next big thing. Uh, and, um, and be replaced by, by some realism that SBOM is just an inventory and that, uh, or HBOM is just an inventory and that attestation of that data is really the important part, not necessarily the, not necessarily the production of an, of a JSON based document.

Chris Romeo 20:57

Yeah, and

Matt Coles 20:58

so that's my, my prediction is the value will really come out of that and we'll, we'll stop the hype of everyone producing SBOM and really everyone has now a better handle on what they actually are building.

Chris Romeo 21:07

all right, Nostra Izar looks like he wants to say something,

Izar Tarandach 21:10

I predict that in an office somewhere, somebody is going to finally look around and say, SBOM, I found a use for it! And then the whole industry that started last year by talking, we need SBOMs, we need SBOMs, we need SBOMs, will finally close in an harmonious ecosystem that will actually get those SBOMs and do something with them, rather than just go around showing to people, I have an SBOM, I have an SBOM, I have an SBOM.

Chris Romeo 21:37

I'm gonna, I'm gonna take it a step further, and I'm gonna, I'm gonna continue on this thread

Izar Tarandach 21:41

Okay, doesn't bother me.

Chris Romeo 21:42

and I'm gonna make a prediction, okay, I'm gonna make a prediction here, not a, not a resolution. My prediction is that SBOM is gonna be used as a swear word in 2024. So people are going to be like, SBOM!

Matt Coles 21:59

Totally doing that right now,

Chris Romeo 22:01

just for those that are of the same vintage as the three of us here, if you were fond of a particular television show in the 90s, it was kind of called the television show of the 90s, Seinfeld had this, whenever he saw, yeah there you go, my threat model is better than your SBOM. But what happened whenever one of the neighbors, who happened to be a postman,

Izar Tarandach 22:23

Hello, Newman!

Chris Romeo 22:24

Exactly. So, you know, Newman was kind of a cuss word in Jerry's vernacular there. And so my prediction is that SBOM, yes, SBOM is going to be the same thing. It's going to be, people are going to be sitting in their office going, Mmm, SBOM!

Izar Tarandach 22:38

but that's the thing, that's the thing, I think that's what Matt said. Uh, bears, bears, uh, uh, uh, repeating. I think that finally it's going to become like, uh, a useful thing, of course. But, uh, uh, there'll be distinctions and there'll be the understanding that, uh, the practical value that comes out of it is only what you make of it and not, uh, or perhaps what somebody asks you to attest that you will make that value out of it.

Chris Romeo 23:06

Well, attestation is a whole new animal, right? Because now this is a legal thing. That's

Izar Tarandach 23:13

The lawyers have entered the chat. Hmm.

Chris Romeo 23:16

And everybody else is muted or left because attestation, it's all fun and games when I'm just sending you an inventory. But when I have to make a statement about it, now it's, now I gotta have my whole building filled with lawyers write, now all of a sudden SBOM's gonna be 10, 000 pages. Or it's gonna be a paragraph.

Matt Coles 23:37

going to have that giant legal disclaimer on the metadata.

Chris Romeo 23:40

That's probably actually the real truth is what's going to happen is there'll be a legal disclaimer that says use at your own, uh, peril will be the, the

Izar Tarandach 23:50

Or it's going to be cryptographically signed and that's going to give it value and we are going to have one more secret to protect and one more secret to be leaked and one more secret for people to run with and we're going to have the whole certificate signing drivers

Matt Coles 24:06

What do you, are you going to, are you going to have timestamping for SBOM digital signatures?

Izar Tarandach 24:12

Y yes. But if the time spa, uh, timestamp has expired, there would be a whole different thing saying that at the time of attestation, the timestamp was good. So the attestation is still good. It's almost like this happened before

Matt Coles 24:24

It never, never, never happened before. I have another prediction that

Chris Romeo 24:28

Okay, here we go

Matt Coles 24:29

want to make before I forget it. Somebody, somebody will have listened to our podcast, multiple episodes now, and listened to your take on that nasty four letter, begins with a D word,

Chris Romeo 24:46

with a D word.

Matt Coles 24:48

DAST, and try to build and actually be successful at building a DAST tool that you find valuable. Uh,

Chris Romeo 25:07

I might even invest in it. Who knows?

Izar Tarandach 25:09

Look, I can predict that. If there's a person, like what Matt described, there's another person who happened to work at some. company that likes to actually make predictions, that's right now thinking about a new acronym to call that old thing called DAST, and create a whole new branch of the industry that does exactly the same thing,

Chris Romeo 25:33

Now I'm

Izar Tarandach 25:33

a completely new name!

Chris Romeo 25:35

I'm trying to, I'm trying to dream it up myself now, right now on the fly, as far as what would that new acronym be.

Matt Coles 25:41

uh, here's a, here's a shout out to the person who wrote us the fan mail to use his, his or her AI skills to come up with some suggestions.

Izar Tarandach 25:53

yeah,

Chris Romeo 25:54

Alright, so that's, I mean, I would love to see that. I would, I would even invite that person on as a guest of the podcast to enlighten

Izar Tarandach 26:00

Wait, his or mine?

Chris Romeo 26:03

his or mine, what.

Izar Tarandach 26:04

His, his person or my person?

Chris Romeo 26:06

Now I'm talking about if somebody invented, yeah, either

Izar Tarandach 26:08

yeah, his person.

Chris Romeo 26:09

yeah, I mean his one, his would be probably more interesting, but I, because if somebody, if somebody showed up here and brought a new acronym, I think I might just fly off the screen, you might see me

Izar Tarandach 26:18

Which I'm going to predict happen. The new acronym, not you flying off

Chris Romeo 26:25

yes, yes, I probably will fly off the screen though, but all right, so let me change, let me change the direction here and give you a resolution, okay, not a prediction. You guys already covered two of my resolutions, by the way. I had four written. Two of them have already been covered as predictions. But here's one that I think we can all get, uh, get behind and be passionate about. Resolution, teach secure coding at the university level. Secure coding education at the corporate level is an excellent programmatic approach. Levels everyone's security knowledge. However, it's still, we're still in a world where at the university system they're not being taught secure coding.

Matt Coles 27:00

Oh my god. So, do you want, uh, do you want Izar or me to go first on the, on responding to you?

Chris Romeo 27:05

I think you can both speak at the same time and I'll just put you in. No, go ahead, Matt. You're first.

Izar Tarandach 27:11

I'm guilty of that. We usually do speak at the same time, but it's because of me, not Matt. Yep,

Chris Romeo 27:18

polite gentlemen here of the security table.

Matt Coles 27:21

Uh, you've already missed the boat if you're talking the university level.

Chris Romeo 27:24

Ooh, okay. Good. Good.

Matt Coles 27:27

also, and, and second, and second, uh, how many people, especially new people entering this field are going to university first?

Chris Romeo 27:37

Okay. I like

Izar Tarandach 27:38

So here's the thing. As in all so many fields, and as Matt said, college is too late. People take classes in college to pass those classes, not to, sorry, learn most of the stuff, Especially at the, at the, the bachelor's level. And then when you go up in, in other levels, you get to know more and more about less and less. So unless they are heading into a cyber security field, they are going to have less and less of that expertise. And then you fall into the, okay, so what do we teach? Which language do we teach this week? I don't know what colleges are teaching this week. I think it's, could be even Python. I think that

Chris Romeo 28:20

A lot of Python is what I've heard.

Matt Coles 28:22

Java and Python, I think. Nobody does C anymore, I don't think.

Izar Tarandach 28:29

resolution into teach security principles, the same way that you teach CS 101. That's the same way that you teach data structures, then teach security principles. But at the same time, I'm going to pull it the way that Matt pulled to earlier than college.

Chris Romeo 28:50

Yeah.

Izar Tarandach 28:50

there are many high schools out there that have electives for Intro to Computer Science. And, uh, I know for a fact that security is not even being considered there.

Chris Romeo 29:00

But I mean, if we can't, if we can't consider security at the university level, here's my counter to that. I, I, I would love to see that. I love, what you're describing would be awesome. If we could say, hey, in our, um, STEM programs around the country, s security is a, is a foundational piece of how we're approaching computer science. That would, I mean, I'm not arguing against that being the, the dream, right? But if we can't even do this at the university level How could we possibly do it at the, at the secondary school level where those teachers are paid less and they have less resources and less.

Izar Tarandach 29:31

Yeah.

Matt Coles 29:32

I have a thought. I'd like to issue a challenge. And I don't know how many people are listening to our podcast that can take up this challenge, but I would issue a challenge that So, you mentioned STEM programs. Even if we get a portion of them, we can't certainly get all of our secondary schools. There's just too many of them in the country, here in the US at least, and we're not even talking about the rest of the world. But if folks in our industry reach out to their high school, local high schools, and even do a seminar, You know, a couple hours, uh, total, even into a STEM program, if there's a, if they're doing any computer science, you know, work, just introduced those principles and to introduce, say, threat modeling as a practice, then, you know, that, that's a start that gets people interested, perhaps at least gets things in the top of their head. Uh, and, you know, so maybe the challenge here is that, you know, if, if security folks are looking for volunteer opportunities, See if there's an opportunity to volunteer at a local school. Um, you know, even a small portion starts to get the ball rolling.

Chris Romeo 30:48

So we as an industry need to, your suggestion is it's, it's on us as practitioners in the industry to go and, and try to, try to offer our assistance anywhere we can.

Izar Tarandach 30:59

So, had you people voted me in at OWASP, not bitter at all, had you people voted me in,

Matt Coles 31:07

not bitter at all, no.

Izar Tarandach 31:08

not bitter at all, one of the, the, the, one of the basis of my program was to, to actually close in, into this gap between a high school and local industry, right? So, The idea comes from my son. He's taking an intro to computer science now at high school, and how could, would it be, how could, would it be if, as part of that four year computer science elective program, we would have a security even parallel track, right, that in the first year would teach the basics of cyber, cybersecurity. And the second year would expose them to open source tools. On the third year, they would have the ability to go to a local. company, a local place of work, and actually help that become part of that place. Hands on. On the fourth year, they might have an internship in a bigger place, and that internship would be a ramp up into going straight into the job. Jump the college, right? So, for people who already plan to go to college and become computer scientists and not, perhaps it wouldn't make a difference. But I have the feeling that this could change the way that a lot of people consider what they're going to do during and after high school. And it would solve that gap that we talked about in one of our first episodes.

Chris Romeo 32:27

Um, my local high school here in North Carolina has that program now. They don't have the security focus. They have a, um, they ha it's like an IT academy is what they call it. And the kids enter it as freshmen. They have to, they can apply to get into the IT academy as freshmen and it's a, it's, it's part of their curriculum for four years. And to Matt's point, I had the opportunity, they invited me to come in and just talk about cybersecurity. I probably talked, I just really told stories. I wasn't, I didn't have, I'm like, I'm not going with slides to talk to high school kids. Like, I just told stories about things I'd seen happen in my career and, and famous people that I had a chance to chase, a different area of my career. Um, where the more interesting stories come from. But, I sat there after, they probably hit me with questions for probably 30 or 45 minutes. Good questions too, like, like just asking about how, you know, just, it was a, it was, you know, probably the best set of questions I've received in the last couple of years from an audience, because they just, they were, they were just pinging me about how this all fits together.

Izar Tarandach 33:28

They are an audience that's not yet cynical enough to just look at a job and say, These are the dollars that I can make with this. These are the kids that they listen to your stories, to our war stories, and they still get that Romantic war games hackers and Matrix vibe of, ah, I'm doing something amazing by TikTok on my computer. Right? So that, that's, that's the audience that we have to, to, to reach out to. That's why I wanted OWASP to like, put forward the curriculum that could support teaching this in high schools and then make the, the, the link between industry and those, those pipelines and bring those kids in as interns. At the end of their high school move,

Matt Coles 34:16

We, we used to have that program when I was in high school. I was a member of Boy Scouts and we used to do that program. It wasn't, it wasn't part of the Boy Scouts directly. It was something related to it, but, uh, where we, we would go and go visit companies, uh, to learn about what they do and then, and then eventually, um, Uh, you know, there was intern opportunities perhaps later, um, so it doesn't have to be necessarily with the high school itself, but I'm sure, so I'm sure those programs exist, um, other areas like that, where we have opportunities to influence, and by the way, I'm not big on kids, but. This is where we need, this is where we need to put the effort in order to make, to solve this problem, right? The university is too late and people are, are less, less inclined to go to university these days with, with the costs and whatnot. So, and companies are starting to relax those requirements for having a university degree, uh, to, to get at least an entry level position as a developer. So, um, you know. Maybe we need to focus on curriculum. Maybe we need to focus on a set of people. I know here in our area, I think a votech school, a vocational school, is probably a better place to get a larger group of people who, a group of students, um, as opposed to the local high school. Um, but, uh, yeah, things like that we probably have to be innovative about as an industry, not just as teachers.

Izar Tarandach 35:49

let's take a joint resolution and a call for action to the people in Australia that are listening to us right now. Reach out to us if you have ideas, if you can, if you feel that you can influence something like this. And let's at least put a plan in place that, uh, who are the people that we need, what we need to define, and see if we can spend 2024 making something like this become a reality. Because we can change some lives here, people.

Matt Coles 36:15

Is, uh, does OWASP, does OWASP have a track, does OWASP have a, have an education or

Izar Tarandach 36:20

They have an educational committee, yeah, and I had a chance to speak with them. Amazingly supportive people, but at the time OWASP wasn't, uh, uh, equipped to embark into something like this. So I spoke to some other people who are more on the educational side of the thing, people with hands in high schools and stuff like that, and everybody expressed an interest, right? But first of all, I, I, I don't think that it should be just on a US thing. It should definitely be a global thing. So I would welcome more opinions and visions on, on, on the subject. And, uh, second, at some time I looked around and I said, hey, you know what, I would need some program management skills in here that I definitely don't have. I can barely program manage myself to go from bed to breakfast. So

Matt Coles 37:12

Well, so the other thing I would, I would just add there is there are other organizations, of course, that maybe there's a concerted effort that can be done here,

Izar Tarandach 37:20

Yep.

Matt Coles 37:21

So OpenSSF as an example, right? There's, there's a large, good number of, of well funded companies that, that are, that are helping to support that effort. And education is a, is a recognized challenge, right? Having developers who are aware of secure coding practices or secure design patterns, or the processes, even running SAST or DAST or IAST or whatever, um, having those skills when they are, Singular maintainers of open source components that large enterprises around the world rely on,

Izar Tarandach 37:57

Yep.

Chris Romeo 37:57

Yeah,

Matt Coles 37:58

of opportunity, I think, there.

Chris Romeo 37:59

this is one of those things, and Izar, you mentioned this a bit in your explanation. This is about changing the future. This isn't something that has a, even a, even a one year return, two year return, maybe not even a five year return. This is something that'll take ten years to watch it blossom. and, and impact the industry. And yeah, it does definitely seem like something OWASP should be behind as far as driving this. So, yeah, I mean, I think that's something that we, we're, we're calling all, all of our listeners out there, no matter whether you're in Australia, Dublin, or somewhere else around the world to, uh, to join us in this, let's, let's take this on as a security table mission and see what we can do in, in 2024 to, uh, cause I'd love to, to do something with this too. Um,

Izar Tarandach 38:43

Told you guys you should have voted on me.

Chris Romeo 38:45

Yeah, I mean, I wish I would've remembered to vote. I'm so sorry that I

Matt Coles 38:49

I wish I had, I wish I had tasked my, I wish I had

38:51

tasked the AI to, to

Matt Coles 38:52

submit, uh, many, many votes on your

Chris Romeo 38:54

I can admit I did vote for you, Yar. I did. I was, I was behind

Izar Tarandach 38:57

Oh, so you were

Chris Romeo 38:59

I was the one,

Izar Tarandach 39:00

were the one,

Chris Romeo 39:00

my vote is the only one. No, I'm kidding. You did. You did, you did Well. You, uh, you're poised for a 2024 move. That's, that's how I see it right now as your unofficial campaign manager. So

Izar Tarandach 39:12

I want to go for the, uh, the, the comedians this year. Yeah.

Chris Romeo 39:14

There you go. So let me, let me read my, my final resolution here. And I feel like it kind of sums up a lot of the noise that I may have generated in 2023. So here's what it is. Think outside the AppSec box. Stop doing things because it's the way we've always done it. Stop adding tools to your program because these are the tools a serious AppSec program has. That should have been in the air quotes. Think for yourself. Understand the risk and threat a given tool and technology provides. Factor against the ROI versus cost, and then build a program that makes sense for your organization.

Izar Tarandach 39:49

Yeah. Yeah. I mean, I, I see programs that collect tools the way that, uh, we used to collect those small cars when we were kids, you know what I'm talking about? Yeah. Matchbox cars. Like, one more shiny tool after another, and when you ask them what they're getting out of them, they'll go, uh, Uh, I have a secure program! So, having the tools is not enough, and, and, Letting the tool dictate how you're going to work might not be the best solution. So, perhaps, I would extend that resolution with ask of vendors to provide People with tools that enable them to work the way they want, not the way that the vendor wants.

Chris Romeo 40:27

Yeah, and work efficiently. So I don't know if you saw Brooks, Brooks Schoenfeld's post yesterday on LinkedIn. He said he'd been having a conversation with somebody else in the AppSec industry that was running a program. And this program leader said, I'm no longer, I'm no longer allowing tools that generate noise without value.

Matt Coles 40:49

Uh, noise without value, or was it require care and feeding?

Chris Romeo 40:53

Requiring, I'm sorry, you're

Izar Tarandach 40:54

Both. Both, both,

Chris Romeo 40:55

I think it might have

Izar Tarandach 40:56

No, just both.

Chris Romeo 40:57

yeah, okay. Require care and feeding, yeah. So I thought that was a very interesting take, though, on the frustration of someone who's running a successful program and dealing with tools that, and I think his point was that he had to tune, he's not buying anything, he has to tune all the time and

Izar Tarandach 41:12

Yeah,

Chris Romeo 41:13

Like, he wants it to just execute and go. So Matt, you gotta look on your face like

Matt Coles 41:17

yeah, I do,

Izar Tarandach 41:17

a problem with that,

Chris Romeo 41:18

Okay,

Matt Coles 41:19

I'll, Izar go, Izar go first,

Izar Tarandach 41:21

That's asking for the silver bullet,

Matt Coles 41:24

right?

Izar Tarandach 41:25

it just freaking doesn't exist. The question here is not if the care and feeding needs to be done, the question here is the amount of care and are you feeding the right things, right? Because, you know, the smell of what comes out depends on what you put in.

Matt Coles 41:40

Yeah, having a tool, having a universal tool that can, that can do everything without you, you telling it what you need. That sounds wrong. Uh, I mean, we, as Izar said at the silver bullet, right? We've been chasing that for years, for decades, um, and you get what you get. I mean, you get the, you get the kit, everything in the kitchen sink and you get all the noise that comes with it. Or you get results that you don't know what to do with. And so, you know, we know this with SAST as an example. If you're having, if you have custom code constructs, or you're doing things slightly differently, you're going to have to tweak it to get value out of the tool. Otherwise, you're just going to get garbage. And, and so, The care and feeding, the care and feeding should be, should be, give the, have the ability to do the tweaking effectively and efficiently for what you need to contextualize it, but not, but not require care and feeding to make it operate, right? If you have to continuously supply hardware, you know, resize databases in order to make it function. have a constant, you know, internet con, uh, connection to some, you know, strange cloud service somewhere to get rule updates on a, on some, you know, two o'clock in the morning every day. I, I can imagine that's the care and feeding that we, that we want to start, avoid, you know, look to try and minimize or avoid. The tweaking and the contextualization, though, I think we absolutely critically need still.

Izar Tarandach 43:10

I think that this also goes towards what we had back in the 60s. With the, you know, if you wanted to talk to the computer, you had to go into the basement and talk to people that wore, uh, uh, white, uh, smocks and had, uh, ties because they, they were basically the, the, the prized hood of the IBM, right? And they knew how to translate your stuff into cards that went into the machine and, and then people said, okay, we need to popularize this, democratize this. And we ended up with the computers that we have today. But it's not like you don't care and feed for them, you do, but you get directly what you want from them. And I think that tools are the same thing. As Matt said, if you have to keep special people just to feed the tool, the prized hood of that tool, the people who know how to speak the language that that tool knows, and that you have to keep worrying about resources and give it one more terabyte and one more terabyte and

Chris Romeo 44:08

hmm.

Izar Tarandach 44:09

one more agent into 1, 000 other places. Then you are working for the tool and not the tool working for you.

Chris Romeo 44:15

But I mean that's, a lot of what we suffered with from tools perspective is over the last two decades is tools that require almost constant care and feeding.

Izar Tarandach 44:27

so you're working for it.

Chris Romeo 44:28

yeah, so I mean that's, so I get where, I don't even remember who the, I don't even know if Brooke ever said who the original person was, I don't think he did, but I get where that person is coming from though, about historically, I can see where that, how that conclusion was reached, because we have dealt with a lot of technologies and tools that required, that just generated constant noise, required constant care and feeding to get any amount of value out of them, and that's what this person was concluding is not going to be acceptable

Matt Coles 44:55

and SAS doesn't, SAS does not automatically solve the problem, by the way.

Izar Tarandach 45:00

and that's why we need,

Matt Coles 45:04

oh, you just have a different, you have a different set of problems, right? You have a different set of care and feeding that has to occur.

Izar Tarandach 45:09

and that's why we need quantum LLMs.

Chris Romeo 45:13

I thought you were going to land the plane with reasonable application security, which would have been a, which would have been such a great ending to this episode and the, and the ending of 2023 for our recording process, if you would have just said, and that's why we need reasonable application

Izar Tarandach 45:28

No, but that's the thing. That's the thing. We still need reasonable application security. But at this time, because of the tools and the care and feeding, and because we haven't yet taken the time to look into that, we still can't quantify and we can't define what's reasonable, and that's what we should, that's what we should, do

Matt Coles 45:46

That's the best prediction of 2023. That's the best prediction for 2023. We will still be, we will still be debating what reasonable application security

Izar Tarandach 45:55

but I, I could say that working together by the end of 2024, we could have a very good. Approach to what that is.

Matt Coles 46:03

And if

Chris Romeo 46:03

we could continue that prediction every year. At the end of the year, we will probably still be discussing and debating what reasonable

Izar Tarandach 46:10

no, I don't think so. I don't think so. And actually, perhaps we should do an episode with more people coming in and asking ourselves what's reasonable.

Chris Romeo 46:19

What is reasonable? Well, gentlemen, this is the end of our wrap up episode for 2023. So it's been a true joy working with you throughout this year to bring our opinions and discussions, debates, and even a little bit of argument to, uh, around the security table. But I know that's, uh, we, we've heard from our audience. That's what they enjoy about our

Izar Tarandach 46:43

The joy of security.

Matt Coles 46:46

And, and, and we should, we should thank, we should thank the various guests we had over, over the course of the year. We should, we should do that more. We don't bring enough guests on, but

Chris Romeo 46:53

Yeah.

Matt Coles 46:54

yeah.

Chris Romeo 46:54

definitely. Thank you to all those guests that took their time to really educate us. I can say every guest we brought on the security table brought my knowledge of something further or challenged my thinking or did all those good things. So

Izar Tarandach 47:07

which reminds me of the two things that we Try to go back to all the time. Nobody knows everything and we should always be learning more and don't take yourselves too seriously, people. It's just security.

Chris Romeo 47:19

that's a good way to end the episode right there. Thanks folks for listening to security table all year. We'll be back in 2024 to provide more witty. things and wisdom and whatnot along the way. So thank you.