Quick Buzz Feed

Successful implementation of AI tools must start with integrating cyber capabilities

Gary Lloyd | Oct 17,26 | 01:38 EST

Technology

Federal and industry experts say agencies applying AI capabilities to both IT and OT systems can analyze more data more quickly to mitigate risks faster.

Three-part lens for AI and cyber Both public and private sector organizations are increasingly using AI to analyze data for proactive cyber mitigation. Rudy Rojas, an IT manager and security specialist at the Department of Agriculture, explained that their cybersecurity and privacy operations center leverages AI tools for network monitoring, continuous monitoring, and threat analysis, generating reports for human review. This ensures human oversight in decision-making, such as whitelisting or blacklisting, preventing AI from having total control. USDA’s vendor-based tools are significantly advancing in predictive analytics through AI, aligning with the agency's zero trust initiatives, particularly in prioritizing endpoint protections for data security and software updates. At the Idaho National Lab (INL) in the Energy Department, cybersecurity leaders approach AI opportunities through a three-part framework: 'secure from AI,' 'secure with AI,' and 'securing AI.' Scott Bowman, INL's technical lead for cyber-physical systems, emphasized their COGNITO program, which assesses the consequences of AI adoption, including its impact on workflows and system dependencies, before implementation. This involves understanding the criticality of AI functions and potential disruptions if AI services become unavailable. Furthermore, INL secures AI tools by performing a 'mechanistic analysis' of models' architectures, utilizing AI to comprehend complex AI systems. Bowman cautioned that achieving complete comfort with AI dependencies is unlikely, and a perpetual state of vigilance is necessary. The U.S. Army Corps of Engineers, for instance, integrates cyber with AI in monitoring operational technology (OT) for critical infrastructure protection, using digital twins to mitigate constant foreign cyber attacks and employing AI-powered threat detection to filter alerts and focus on real risks. Start small with SMMs Chris Cardran, a federal security advisor for defense and intelligence at Splunk, advises federal clients to initially adopt AI tools using a Smart Machine Model (SMM) approach due to the inherent complexity of larger AI models. He explained that SMMs allow for the creation and training of custom models on specific agency data, using tailored searches to extract necessary information. These models are then graded and operationalized for very specific tasks, requiring less computational power compared to large 'frontier models' trained on vast, general datasets. The self-contained nature of SMMs simplifies updates, retraining, and context additions, as they can be taken offline, modified, regraded, and re-operationalized efficiently within one location. Cardran highlighted the significant benefits of SMMs for protecting operational technology (OT) systems, as they can be trained on machine-based data for forecasting and automation, moving beyond cognitive data analysis. Kevin Dorsey, director of federal solutions development at Optiv+Clearshark, echoed the challenge of identifying practical use cases for bespoke Large Language Models (LLMs) that effectively support mission success while adhering to customer-required AI governance. He noted the necessity of finding small, capable models that can run within constrained data center environments and still deliver desired capabilities, especially given budget limitations for resources like GPUs. The focus is on leveraging AI to assist in the detection and collation of information, including tactics, techniques, and procedures, or standard operating procedures for customers, demonstrating the value of targeted AI implementations in cybersecurity.

Three-part lens for AI and cyber

Both public and private sector organizations are increasingly using AI to analyze data for proactive cyber mitigation. Rudy Rojas, an IT manager and security specialist at the Department of Agriculture, explained that their cybersecurity and privacy operations center leverages AI tools for network monitoring, continuous monitoring, and threat analysis, generating reports for human review. This ensures human oversight in decision-making, such as whitelisting or blacklisting, preventing AI from having total control. USDA’s vendor-based tools are significantly advancing in predictive analytics through AI, aligning with the agency's zero trust initiatives, particularly in prioritizing endpoint protections for data security and software updates. At the Idaho National Lab (INL) in the Energy Department, cybersecurity leaders approach AI opportunities through a three-part framework: 'secure from AI,' 'secure with AI,' and 'securing AI.' Scott Bowman, INL's technical lead for cyber-physical systems, emphasized their COGNITO program, which assesses the consequences of AI adoption, including its impact on workflows and system dependencies, before implementation. This involves understanding the criticality of AI functions and potential disruptions if AI services become unavailable. Furthermore, INL secures AI tools by performing a 'mechanistic analysis' of models' architectures, utilizing AI to comprehend complex AI systems. Bowman cautioned that achieving complete comfort with AI dependencies is unlikely, and a perpetual state of vigilance is necessary. The U.S. Army Corps of Engineers, for instance, integrates cyber with AI in monitoring operational technology (OT) for critical infrastructure protection, using digital twins to mitigate constant foreign cyber attacks and employing AI-powered threat detection to filter alerts and focus on real risks.

Start small with SMMs

Chris Cardran, a federal security advisor for defense and intelligence at Splunk, advises federal clients to initially adopt AI tools using a Smart Machine Model (SMM) approach due to the inherent complexity of larger AI models. He explained that SMMs allow for the creation and training of custom models on specific agency data, using tailored searches to extract necessary information. These models are then graded and operationalized for very specific tasks, requiring less computational power compared to large 'frontier models' trained on vast, general datasets. The self-contained nature of SMMs simplifies updates, retraining, and context additions, as they can be taken offline, modified, regraded, and re-operationalized efficiently within one location. Cardran highlighted the significant benefits of SMMs for protecting operational technology (OT) systems, as they can be trained on machine-based data for forecasting and automation, moving beyond cognitive data analysis. Kevin Dorsey, director of federal solutions development at Optiv+Clearshark, echoed the challenge of identifying practical use cases for bespoke Large Language Models (LLMs) that effectively support mission success while adhering to customer-required AI governance. He noted the necessity of finding small, capable models that can run within constrained data center environments and still deliver desired capabilities, especially given budget limitations for resources like GPUs. The focus is on leveraging AI to assist in the detection and collation of information, including tactics, techniques, and procedures, or standard operating procedures for customers, demonstrating the value of targeted AI implementations in cybersecurity.