Why AI Is Forcing a Rethink of Data Security

Hi, I'm Joan Goodchild with CSO. We are here today at the CSO Cybersecurity Conference & Awards in Nashville. And I'm excited to be joined by _Todd Moore. He is the Vice President of Data Security Products with Thales. Welcome, Todd. Thanks, Joan.

It's a pleasure to be here. Great.

So let's talk a little bit about one of the big topics that of course, everybody is talking about is AI. Why are traditional security models falling short in AI driven environments, do you think?

Well, I think that, you know, AI is just changing the whole paradigm. It's happening so fast. The tempo, the velocity, the amount, the scale of AI agents and just the type of AI activities that all of us are doing today.

You know, traditional models still have a place, but, you know, if you think about perimeter security, which was working years ago with identity and access and things like that, you know, with agentic AI, these agents have our identity, they have our permissions, they have our credentials, so they're able to get through what was traditional security barriers.

And then now they're able to get access to our critical data.

And without having the proper mechanisms in place to watch what that AI is doing or how it's being implemented, it really does change how traditionally were able to use a defense in depth to protect our information. AI has just been built differently.

It finds ways to work around what was a traditional model. So we have to think about a different one. We have to do some different things to really protect the information we have.

Okay, now what does a data centric security model actually change in practice, do you think?

Well, I think that it's always been around data and protecting the data. What's changed a little bit with AI is we do know that artificial intelligence is creating so much new data.

I mean, every prompt response, every time that we ask a question, every time that an agent goes into does anything on our behalf, it's creating new data. And that data is popping up everywhere.

It could be in the cloud, it could be in SaaS applications, it could be on. And you know what's happening when a data centricity type model is you're going to find that data first, you need visibility, and sometimes it's in the far reaches of where we don't see.

So getting visibility of everything is tough, but you want to get as much visibility about where your data is and characterize it properly.

But when you think about data centric, you know, the idea is we always want to protect what's important to us. You've got to find it first figure out what's critical and you want to protect it.

In this AI world, you want to see how AI is using the data. What's the, do they have the right consent? Should they have access to the data? But more importantly, what's the intent? What is these agents? What does this AI want to do with the data?

And so we have to really think about the data and building a control around it to say this is how AI is using this critical data and should I give access to it or I should not.

So it's really focusing on the data and making sure you know how it's being used, why it's being used, and you know, in any context that we're.

Working in today, how should organizations think about securing data that AI systems continuously access and learn from?

Well, I think that there's two aspects we talked about visibility and understanding what's important to you. And then you want to do a risk assessment of saying, okay, how important is this data to me?

And prioritize your risks around who can have access and why you would have access. We didn't really talk more about the protection piece. That's what you just asked about. In protecting data, there's a lot of mechanisms.

I mean, you can control access, but there's tokenization and there's data masking, there's encryption and there's secrets management. So you have key management with encryption and secrets management.

And so there's all these controls that you can put around data about who gets access to it and why they get access. We're seeing a very strong uptick at TALAS around tokenization and data masking.

So if you think about it, if you pre process your data, if you take what's critical to you and you tokenize it or you protect it in such a way, let AI touch it all day long, it's okay because you've already kind of protected the information, made it safe ahead of time.

So. But you need a protection mechanism. You need to have another gate, if you will. You just don't want to have one gate that AI can walk through and get access to your data. You do want to build some layer of protection around that. Yeah, yeah, Interesting.

So in your opinion, what does unified data awareness look like across teams and functions?

Wow, that's an exciting question to unified data awareness. Well, I think for me it's really around centralization of policy governance.

What we're finding is organizations that build silos and you have different guardrails, different policies, different, you know, different key management encryption, secret Management, just different pockets of the way you manage your information. It fails in this, you know, kind of unified world.

You want to have a full data lifecycle sort of approach where when data gets created, you find it, you risk, assess it, you protect it, and you control it through the whole life cycle. When the data is no longer useful, you get rid of it.

You know, that's the full data lifecycle. So from a unification perspective, it's really watching and mapping your data throughout the whole lifecycle and really centralizing, you know, what is that governance?

What is the way that you're auditing, the way you're looking at managing that data across your organization? Because at some point there will be compliance laws around AI, just like we have around other types of activities today.

And you're going to be able to show to auditors how you're managing your data. And if you don't have it centralized, it's going to be very difficult to kind of have a unified approach to how your data is being you know, used on a daily basis.

And how urgent do you think the shift towards crypto agility and post quantum readiness is right now? Wow.

I think we're there. I think we've started to see this year really a shift. We've seen the actual shift to a worry about what a quantum computer is and what does it mean when it shows up and how does it impact our systems.

And I think there's a good story there with AI. AI can help us look at our cryptography. Cryptography underpins all of our security systems.

Whether it's the math, the algorithms that protects our data, or it's the protocols of how we securely communicate within our systems into the Internet and to SaaS applications.

And if that cryptography can be broken, then that's going to cause a huge storm that's going to cause a huge issue for us. So I think we can leverage AI today to help us find where the gaps are, where traditional cryptography might be at risk.

But we have to do something about it. We do have to go implement this post quantum cryptography. These new algorithms, the new protocols are being ratified. We have to implement that. And I would tell organizations the time is now.

I mean, the pivot point is occurring at this point in time and we'll never know. I mean, a state actor may already have a quantum computer or they may have it in two years. We just don't know.

And I think it's important that we're prepared now, so when that moment does happen, we've protected the foundation of our IT security, and therefore the building doesn't fall down. We've put all the right controls in place. Okay.

_Todd Moore with Thales. Thank you for joining us today. Thank you, Joan.

Appreciate it. All right.

And thanks to you for watching. For now, I'm Joan Goodchild with CSO. We'll see you next time.