Notes for my Capstone Address at the 2026 New York Metro Joint Cyber Security Conference

 Thanks to our speakers.  Their presentations were thoughtful, useful, and well communicated.

World order is deteriorating, in large part because of a failure of US leadership.  Our historic allies are now afraid to rely on us.  

Kinetic warfare is now automated, persistent, and continuous; while the scale is smaller than the great wars of history, we are killing a thousand civilians for every soldier.

The application of AI to vulnerability detection has demonstrated unequivacably what I have long asserted:  our software sucks and our insfrastructure is so fragile as to constitute an existential risk.  

We need strong authentication for applications, clients, services, devices, and users.  I like passkeys for security and convenience.  All authentication schemes are limited by the security of the end points.  

The single most talked about application for quantum computing is cryptanalysis.  Google speculates that by 2030 we may be able to solve for a private RSA key, from a cryptogram and the public key, in hours.  During any hour we generate thousands of RSA key pairs.

We have always cautioned against sharing of IDs and passwords.  The IDs most likely to be shared are privileged.  Privileged Access Management is an application and there is great software for it.  

A human individual or enterprise is, and must be held, responsible for everything that a computer is asked to do.  For AI they are responsible for the training, goals, data, weights, and, prompts.  They are responsible for all the results, i.e. action, uses, and properties including accuracy, correctness, and purpose.

The responsibility must include criminal or civil accountability.  Consider OpenAIs  attack against Hugging Face. Open AI lacked Mens Rea so they were not criminally liable.  However, they were reckless and therefore they are civilly liable for any and all damage that their experiment caused.  It is essential that they not be allowed to escape that responsibility.  I am encouraged that the state of California is suing Open AI.  However, they have the burden of proving standing and damages.  I wish Hugging face, the immediate victim, would join the suit.  We must limit criminal and reckless use of what is only a tool. 

We worry about AI going rogue but that is not the problem.  The problem is what someone or some enterprise asked the AI to do and what precautions they took.  It is clear that we are not very good at that.  If we want to enjoy the benefits of AI while avoiding unintended consequences we must hold each other scrupulously accountable for its uses.  

We should restrict the use of LLMs to applications where we can predict, evaluate, and control the results. I continue to recommend IBM's stated approach: application specific uses, curated, application training data, and transparency and governance built in from the ground up.  I like the approaches of Apple Siri and Microsoft Co-pilot, that use AI to assist with specific tasks in a known context.   

Be careful what you ask for!   Most of our problems in AI are rooted  in the limitations of natural language and are peculiar to LLMs.  Much of the increase in productivity will come from other models.

AI is goal seeking; you must express both goals and limitations.   So, do not think, or even talk AI.  Think productivity, applications, use cases, and tools.

Two presentations dealt with leadership.  

There is no budget fairy.  Those who have budget, asked for it.  They were often told no.  They were undeterred.  They redid their proposal and justification and asked again, as many times as required.  

Incidentally, those with budget are the same one's that are getting promoted.  Management loves those who tell them how to spend in such a way as to decrease risk and improve profits.  

Continuous Third Party Risk Management (TPCRM) can be viewed like an application, a measurement system.  Science and technology advance with our ability to measure.  William Thompson, Lord Kelvin, taught us that if you cannot measure it, you cannot recognize its presence or its absence.  W.  Edwards Demming taught us that if you cannot measure it, you cannot improve it.  Security is the job of the business units; the job of the security staff includes continuous measurement.  Evidence.  

The responsibility for the protection of an asset rests with the executive or manager who exercises the enterprise's ownership rights in the asset, the line of business executive.  Not the staff executive.  Because each is achieved at the expense of the other, one cannot separate the right to use from the responsibility to protect.  

Staff is about goals, measurement and monitoring, methods, tools, and operation.

One use of policy is to express the enterprise's risk tolerance in such a way that all executives and manager's understand their responsibility and how they are to behave.   

Fraudulent e-mails authorizing payments (BEC)mand billion dollar digital currency thefts demonstrate the need for multi-party controls and out-of-band confirmations of all changes and transactions.  

I had been teaching and writing on personnel controls, supervision, training, job rotation, mandatory vacation, compensation, etc. for a decade I before learned the two most important ones, please and thank you.   

Special thanks to our Chairman.  "If you want a job well done, give it to a busy man."  If you want it especially well done, give it to John Checco.