But Tara, you love Jeopardy, right?
I do love Jeopardy.
Would you want to be a Jeopardy?
Yes, but Willa Fortune is the top of my game show host thing that it's not really a host
that I want to be on because I grew up watching it with my grandmother and I still watch it
to this day with my boys and it's our thing every night that we do that together.
So Willa Fortune has my heart right now.
That's awesome.
Love that.
Matthew, if you had to be on a game show, what would it be?
I'd not, practically.
Willa Fortune's good.
Jeopardy would be fun, but I think Jeopardy's one of those ones where the second you get
up there you'd forget half the things you know.
So I don't know which ones I'd be good at, but the idea of doing the amazing race has
always seemed really fun.
So yeah.
I like it.
Todd.
Family Feud.
It would be my opportunity for my stand-up routine.
You took my.
You're being the same team because that was going to be mine.
So true.
Coming soon to a podcast near you, Family Feud is the idea edition.
Family marketing versus security.
It'll be great.
What about you, Nate?
I totally agree with Matthew of the amazing race.
So I watched the first season and I really enjoy how those ones are so drawn out.
They didn't keep everyone right next to each other.
Marketing did ask which one do I think I could win?
I'm ahead of this and I did say the bachelor because I'd be the only guy making it to the
end, although I would not want to be on the show.
I know I'm stepping back in.
And I am married.
You've just reminded me there's a game show.
I suppose you call it a game show.
I watch called Um Actually that you can find a couple episodes off on YouTube that is basically
just nerd stuff that is incredibly fun if you're into that.
I think I would have a lot of fun playing.
That's awesome.
Now that everybody's stopped listening to the podcast to go on YouTube, pause that for
a second and come back to the podcast.
That sounds awesome.
What about you, Ariel?
That's great.
Oh, I don't know.
I don't know which one I would win, but I think I always wanted to try.
Is it a game show that like Ninja Warrior?
I just think that that's cool.
I just want to climb on all that stuff.
I would be out immediately though.
I would not make it far.
Just the experience.
Make it past like the first thing fall in the water and you did it.
Yeah, for sure.
Yes.
Oh man.
Nice.
Kelsey, you answered yours already, right?
I did.
You guys are going on Family Feud.
Yeah, I piggybacked here.
I was already did like lead up to it and then I was like, well, Todd took it.
So let's say it's over.
It's over.
But I agree with you, Ariel.
I think that would be really fun to do like Ninja Warrior.
And then I'm sometimes when I'm watching that, my partner will, I'll be like, oh, I think
I could do that one.
And my partner has to remind me that it's been a long time since I did rock climbing
of any significance.
The one that will get me is the pull up bar where you have to like jump.
The salmon one.
Yeah, the salmon one.
That one I would be done on.
Yeah.
Oh yeah.
They should just let us skip some.
Like just let me try out some of them in a different order.
And maybe I could, I could get through one or two.
There is no participation trophy here.
So.
Yeah.
Falling in the water feels like that's the participation trophy.
Yeah.
Love it.
Awesome.
Well, I guess speaking, you know, of a human's shortcomings is a little bit what we're going
to talk about today.
And our tech for business podcast.
And thank you.
Our joined by our daughter, CEO and CISO Nate, our director of cybersecurity and Matthew
RBC.
So and today we're posing the question, do we trust deep learning too much?
And I know before the podcast, Nate was kind of talking a little bit about what that is.
And I think we're going to start there is what is deep learning?
And I don't know if you could give us maybe an example so we can kind of connect it into
the real world a little bit more.
What is it?
Yeah.
So I promise I won't go too technical.
But it's a subset of artificial intelligence, a subset of machine learning.
It's just a very.
Big algorithms that traditional machine learning models couldn't address.
And so there's a great YouTuber.
He's the best speaker I've ever seen in person.
I highly recommend looking him up at some point, but Tanmay Bakshi, he has a YouTube
channel, Tanmay teaches.
He's been all around the world speaking on machine learning.
He's 19 years old, phenomenal, wildly smart guy.
Anyways, he has a lot of stuff where and the last time I saw him in person, he said artificial
intelligence is a user experience.
It's kind of what we perceive is these machines seem intelligent.
And then machine learning is the mathematics and algorithms that go beneath that.
And then deep learning is a method of machine learning that says there's new algorithms
to build relationships between databases or data that you wouldn't typically have.
Math and metal math equations between the two so it can make better, more accurate predictions.
And then that's where we start to see this really start coming into the fruition of new
technologies and the fruition of new methodologies to better predict really the outcome of whatever
we're trying to evaluate.
It could be cybersecurity, healthcare, whatever it is, but it's just a newer approach to it,
and it's using just different algorithms.
So I was talking with someone the other day about analogies to kind of get through all
three and I like your user experience description of how we interact with them.
But in terms of trying to visualize what this really looks like, for me at least AI is the
ability for a machine to solve long division without us having to do anything.
Machine learning is it learning how to, like when to do those equations versus other equations.
And then deep learning is knowing how to manipulate the equation so well that it can solve other
problems with that initial bit of information.
So it's things that we kind of do expanded schemas is kind of how it works for us.
We have plans and how we do things and then sometimes something breaks that and so we
have to work on the fly.
Computers obviously can't do that.
Deep learning is about giving it enough data that it can do that to an extent with some
calculations and everything else that go into that.
Yeah.
So I'm just going to quick reference that Tanmay, Bakshi one more time and then I'm done,
I promise.
But one of the illustrations that he gave was machine learning is taking the defined
mathematical models and saying, here's how we would calculate the difference between
a dog and a cat.
We can't really do that today.
Deep learning is going to try and figure that out saying what similarities, what math can
we put in place to calculate how similar these two are.
And we just input the different characteristics of it and it starts building all that data
together.
We didn't have to teach it that.
Very oversimplified, I promise.
Yeah, there might be some deep learning engineers who are raging a little bit at our simplifications
here.
But considering we're only seeing the outputs of them, we're not actually getting in there
and coding it, I feel it's fair.
We also have a lot of things that work in that machine learning side of things that are
very prominent in cybersecurity, such as a lot of EDR software runs at that machine learning
level and they're working on how to tie it into that deep learning side of things.
One thing I want to mention, just because it's, I like to point to negatives directly,
is a problem that we see all the time in tech.
And it's not so much a problem as it is a form of, I don't want to say ignorance, because
that seems a little too harsh, but it is just a lack of awareness really around where our
failings are.
So the whole point of deep learning is that we're feeding it data.
We're feeding it data that we have so that it can learn new things and make decisions
based on that data.
And one of the best bits of information as a reminder of this that I learned while going
through my degree was about research that was done on rodents and basically this is published
in 2014, early 2014.
And they found that basically whenever men are working with rodents during psychological
studies, their stress levels are really high.
And we only found this out after more women joined the field and we're working in the
research side of things.
And an old woman research team was trying to recreate some of the studies that have been
done in the 60s and 70s and found that they were having far lower stress levels and they
were releasing different chemicals while those studies were being done.
And so we found that there is basically an entirely different reaction and in some cases
completely different results to entire experiments based around who was involved in the study.
Now how this ties in for me is that up until that study came out and up until that was
found, the entire belief was that rodents were kind of stressed out the whole time and
we were just accepting that as part of what happened.
And it turns out that it wasn't.
So the deep learning that went into all of the, to follow those analogies, the way we
were calculating the equation in our own deep learning and how we were doing our studies
was wrong or at least biased, heavily biased.
And the same type of thing can and probably will and probably already is happening with
the deep learning that's in use.
So we want to take all of this with that in mind, keep in mind that there is a lot of
things we need to be aware of and try not to trust any of this as gospel, I suppose,
for lack of a better word.
We are still letting the computers make decisions based on information we're giving them and
we don't have all the information yet.
I wanted to expand on that a little bit too because I think there's a lot of different
biases that go into it.
And I think Matthew's point at the very, very beginning is quite frankly, we don't know
what we don't know.
And so as we're trying our experiments, we're kind of learning as we go.
I mean, there was an example very similar to the one that Matthew gave where I believe
Amazon created an AI program to help with their interviewing process and they didn't
get too terribly far into it before they realized that there was a heavy bias towards
males just due to the way that they were asking questions.
And it reminded me of another one where sometimes people do this in their normal communications,
you may say something like you guys where you think it's all encompassing, but that's
actually you excluded half the people that are on this podcast just by saying you guys
when the intent was supposed to be everybody, you all, right?
It should have been you all.
And it just happens across the board and it's not necessarily intended to be that way.
Maybe it was, maybe it wasn't.
We grew up with a lot of those kinds of biases in our lives, but it is something that's becoming
very, very prevalent.
Another one that's really interesting to me as well is how you can get some of that just
based on location.
So for example, if we ran an experiment in Alaska, Matthew may come up with some great
examples of how things are going, but it may not apply to somebody in Kentucky.
They may be in a totally different world just because of their locations.
And so again, not really fully understanding how we're gathering that data and how it may
impact something three, four steps down the line will drastically impact the results of
these types of tools.
So I think when we were talking about this at the beginning, as do we rely on this too
much, maybe, although I think it's still a relatively early, but just to be aware of
the context of what it looks like when those kinds of things are happening.
And again, I don't think that the intent originally was designed to be bad or negative.
It just happened because we're humans and we're fallible.
Yeah, Matthew, you had mentioned the 2014 study on the mice.
Todd, you carried on about the inherent human biases even today, right?
With the communication that we have, there's actually, and then kind of bringing tech back
into it.
I wanted to mention, back in 2019, there was a report that NIST, the National Institute
of Standards and Technology, which is a US government agency, they put out a report because
these organizations were trying to sell facial recognition software to the federal government.
And what MIT and NIST ended up doing was they analyzed all this data and said, there are
inherent biases based off of this facial recognition software because it's doing a better job recognizing
white males compared to people in other minority classes, children, elderly, people of color,
women, anything like that.
And so I don't know if women would be included because you guys make up 50% of the population
too.
But anyways, there were inherent biases in the data set because that was the training
model that was typically used to develop the software.
And we've seen that perpetually a little bit.
However, at least we are seeing that the biases are becoming a front and center consideration
as they start to develop new software.
It's not perfect yet, but Matthew, yours started all the way back in the 60s and 70s with just
the raw science.
And now it's taken all this time and it's really becoming apparent that bias in our development
has to be a core consideration.
Yeah.
One of the things I'll throw on there in addition to is it is a real problem, right?
I mean, I think that that problem is going to get worse before it gets better.
And as we touched on, there's all kinds of reasons.
It may be a non-diverse group that's pulling the information together.
You name it.
There's all kinds of issues with it.
But I will say, and we can share this link out too, is there's actually already an open
source tool set out there that's called the AI Fairness tool.
I think it's open AI Fairness 360 or something like that.
We can share the link.
But it's designed to kind of try and go back in time and try to peel back some of those
biases from the tool sets.
When I was kind of getting into the geographical stuff, we kind of at the beginning kind of
talked about tools and how they impact what we're doing today.
And in cybersecurity, there's a lot of AI coming, whether that's deep learning, machine
learning combination of all three is coming.
Matthew mentioned it right out the outchute that you're seeing it in EDR.
There are some very high-end tools that are out there that say very heavily, we are AI
based, right?
And you can see that it's not too terribly far into the future.
It's happening already that you're going to see AI attacking and AI defending.
And when that's the case, you could have some of those biases, concerns like, is it a nation
state?
Someone from Korea is attacking in this way.
Therefore, it might automatically be them.
Absolutely.
And you may get false positives from kind of that type of stuff that's going on.
So from a cybersecurity perspective, the biases are important, maybe not the most important.
I think my takeaway from that, and I might be going a little far, a field at the moment,
but one of my takeaways of that is while these tools are great, you can't use the tool and
depend on it wholly.
You're going to need that human being on the back end.
Exactly.
Go ahead, Matthew.
There's a very specific language you'll find if you are researching EDR software.
And a lot of them will say machine learning.
They will not say deep learning, but they'll also say supervised or unsupervised machine
learning.
And part of that is when we are tracking threats, when we are tracking behavior, there are so
many things that we as humans are, from a computer perspective, inherently chaotic.
We may do the same thing 100,000 times and then we'll randomly go, you know, maybe that
wasn't the best way to do it and just start doing it differently.
And from the computer's perspective, that doesn't make any sense.
So the machine learning side of things, they track that.
They say, actually, this is just someone doing something new for reasons that we don't know
about.
We spend a lot of time on those biases, but that's because that's what ties into all of
this.
We're feeding it data.
We're feeding it language.
And the people there helping with that supervised machine learning are doing the same thing.
They're clicking these buttons.
They're saying, yeah, that's normal.
That's not normal.
Let's try and find this.
Where deep learning really kicks in is when computers are acting autonomously.
Kind of like what Nate and Todd mentioned there, which is if it's doing its own research
and it's trying to make its own actions, deep learning is the way to track a machine doing
something strangely rather than a person doing something strangely.
We're creating systems where they're having to check on themselves, which has its own
problems.
We're just creating Skynet at this point, aren't we?
Those types of items and how we look at it, deep learning is a specific thing where it's
running itself and it's checking for itself.
It's learning on its own items from data that are being fed to it.
And as these become more and more integrated into tools that we use, whether it's network
scanning, whether it's anything else, we're going to start seeing times when a false positive
maybe knocks someone out of a system.
Maybe the CEO is traveling and signs into the wrong spot and so the system fully locks
them out.
There are things to keep in mind for that as well.
Are you and is your system and your SOC team prepared and ready to handle if a deep learning
change resulted in the entire system deciding something was bad that had previously been
good?
Yeah.
So, Matthew, you and Todd have both mentioned false positives already.
And while you guys are talking, and I promise marketing team that I'll give you a chance
to ask questions here shortly.
I tend to be a glass half full kind of person most of the time, right?
I embrace the AI, the machine learning, the deep learning, all that kind of stuff.
So do I think we trust it too much?
I'll summarize my opinion very early into the podcast is yes, I do, but I still want
to embrace it because the technology is phenomenal, right?
And so, but there are careful considerations, which we've been talking about, but kind of
getting back to the false positive versus that you guys have both mentioned.
I also want to mention false negative.
So for those that aren't familiar with it, we have false positive is something has flagged
and alert, but it was falsely correlated, right?
Maybe it wasn't something malicious that it thought wasn't malicious.
The more dangerous one is false negative, right?
Is saying that I thought something was legitimate or non malicious and it led it through.
And so, when we start talking about do we trust deep learning or AI or machine learning
too much?
Those are the considerations that I do want to have at least people aware of or, you know,
vendors that are developing this software being aware of saying as the tools are trying
to learn this stuff, we have seen cases where false positives are common, right?
Everyone wants to try and be as restrictive as possible.
So those are very, very frequent, right?
So maybe there's two anomalous activities that are miscorrelated that look malicious
together, but they are two independent events.
But the more dangerous one is that there's two independent malicious things happening
or maybe just one that slips under the radar that doesn't quite seem malicious, but maybe
it's a precursor to a larger attack.
And so that's where I guess I'm still glass half full, but we have seen cases even here
at CIT as we're monitoring customer networks that both could come into play.
But that's where Todd, you had mentioned the human element still has to come into play
to give that deeper review to confirm the potential inherent bias that the human put
into the first place.
Yeah, I agree.
I mean, for what it's worth, and I think we've talked about this in previous podcasts,
too, is I think we're all tech nerds and we love the technology.
And I think it's a game changer, right?
I mean, it absolutely has massive, massive upside.
Am I concerned about SkyNet?
100%.
Am I concerned it's happening today or tomorrow?
No, absolutely not.
I do tend to fall into the NAIC category, too, is I think there's a lot more good than
bad.
I think that when I'm bringing up the cautionary things that are coming up in it is, in my
opinion is, it means that there's a reason to pay attention.
There are concerns there.
You still need, you can't just flip it on and go, oh, we're all good.
We've got this magical computer taking care of us now.
There are things that you need to watch.
You need to continue to see how it's evolving, what's changing in the industry, et cetera,
et cetera.
So from that perspective, I think that awareness helps you with the risk categorization, if
that makes sense.
There are risks associated with it.
It's doing a nice job, but it is not infallible, just like the data that we fed it.
I promise marketing.
You promised and then I was like, dang, good questions ready.
Todd ruined that one.
Nope, Todd took over.
I promise to you.
Yeah, that's okay.
We let Todd talk, but I did have kind of a tangent question of, okay, so we've mentioned
EDR and the sake of that, right, CIT is a tech provider.
We work with other businesses.
We install these tools.
We monitor it.
In that case, how would you know if your tech provider is trusting deep learning too much
when you're not the person necessarily being that first line looking at the tool?
Ask.
Thank you.
I mean, I'm more than happy to answer those questions when they come through.
I mean, we do get them sometimes, we do have, you know, there's due diligence questions
that come through and a lot of the compliance stuff I'm looking at.
And so not afraid of it, right?
Any tech company, in my opinion, that's worth their salt isn't going to get upset or push
back when you ask questions about their process.
On top of that, fully support full vulnerability scans or, you know, penetration testing that
can be done by third parties to find out where things are going on.
And this is just part of that due diligence of we are doing our due diligence.
We're looking into it.
We're testing it.
We're finding that level that works for us.
So if you ask us about it, we'll have an answer.
My first step would be to ask them if they have a podcast called, do you trust deep learning
too much?
So yeah, I would, I would kind of add on to that.
I would say that you really should ask.
I think it's not as simple as saying, do you or don't you?
Because a lot of the tech companies out there are actually outsourcing a lot of their security.
And so they may not have a security team on board.
They may just send it to somebody else.
And so depending on how that question goes is who's handling that for you?
Is it is it people on your team?
To me that it does have some importance now.
We do have it on our team.
So that that probably again, going into the bias that probably biases me.
Specifically, but I feel like our customers turn to us very specifically and say, you
tell me, I this is not my field of expertise.
I need you to tell me like I'd go to a lawyer, right?
I'm going to go, Hey, you're my lawyer.
You can't just lob that back to me and say, I'm not going to answer your question or I'll
answer it with another question.
I'm coming to you because you're my expert.
And I think that's what our customers are doing.
So having that on staff, IT person or security individuals incredibly important.
So that's how I would find out the answer to that question.
Yeah.
And, you know, I had mentioned that I'm a glass half full.
I embrace the technology.
I am still very hesitant of it.
We have tools that are deep into the machine learning here at CIT to try and better detect
threats within our environment.
We've got layers on layers on layers of tech to try and identify security threats here.
Even then, I don't trust the vendors that start claiming AI, you know, they're going
to solve all the issues where one stop shop.
Security is all about the multi-layered approach.
And it's one of the things where even though I do trust it, so sorry, I don't trust it.
I just said that earlier, even though I embrace it so much, it's still one of the things where
if someone claims that their tool can stop either 100% of all threats out there, I don't
trust it.
And as your technology provider trying to educate, come ask us and we'll tell you, you know,
where are the potential pitfalls of a solution and where should you fill in with another
solution to accommodate that next threat, right?
Yeah.
So, it's all about the layers.
Yeah.
I like the analogy.
You can't put the genie back in the bottle just because you don't want the wishes, right?
These products are out there and they have a lot of the ones that, you know, OpenAI has
a very easy to use interface.
People are going to use it.
You can't put it away.
So let's find ways to figure out how to introduce it safely.
Come up with ways that you can have your organization either implement or specifically
say do not implement parts of what it does.
But it's out there and so we need to be aware and we need to be thinking about it.
It's going to keep happening.
There's going to be things that come out and there are things that come out like this for
us regularly staying on top of these things is literally the job.
As fun as it is sometimes to use these tools, there are things that I use for home that
I would never use for work and making that distinction and having those conversations
is a critical part of doing your due diligence.
Yeah.
I think part of doing your own due diligence as well as run the tool through its paces.
If you get a proof of concept on something, try and break it.
Try and figure out how you can bypass it.
We've taken a look at plenty of security solutions over the years and whenever I get a new one,
I say here's some common attack paths.
By the way, your tool didn't account for that.
Your tool didn't account for that.
Then eventually we find one that's, wow, this is a very phenomenal tool.
Otherwise, if you're talking about EDR, that's just one topic.
There's plenty of security solutions out there.
Taking a look at unbiased third-party testing solutions.
We've talked EDR many, many times in the past.
Go take a look at the MITRE Injunuity test results.
It's unbiased.
They just say, here's the results.
Vendors submit their tool.
There's no opinions about it.
Then from there, you can formulate your own opinions.
Take third-party research into consideration as well.
Don't just trust the vendor.
As a final caveat on all this, I want to add, remember Richard Sarah in the early 70s was
talking about television and said, if something is free, you're the product.
Please remember that.
Don't feed your business critical information into a product that they're giving you for
free because there's a good chance they're using that data for something else.
This is a nice little paranoid warning to end my part of the podcast.
Thank you and good night.
Ah.
I love it.
It feels like a great little closer, important to keep in mind.
I want to just echo communication is key.
Asking, and if you have a question or a concern, whether you're a customer or not, please reach
out to us at info at cit-net.com or you can head out to our website, cit-net.com, slash
podcast.
Thank you, Todd, Nate, and Matthew for joining us today.
We'll be back next week with an all-new episode.