1
00:00:00,057 --> 00:00:03,537
My name is Dawn Ely, and I'm the director of Enterprise Services with Cirrus.

2
00:00:03,537 --> 00:00:12,057
So Enterprise Services encompasses executive strategy, workforce, operational excellence, and supply chain are all in the area that I support.

3
00:00:12,377 --> 00:00:14,297
And just super excited to be at the AI conference.

4
00:00:14,497 --> 00:00:16,377
I'm 3 for three so far.

5
00:00:16,377 --> 00:00:21,217
Started at Cirrus in September of 2024, and luckily enough, started just in time to go to the first summit and

6
00:00:21,457 --> 00:00:22,537
to be here again today.

7
00:00:22,937 --> 00:00:26,137
And now I'm going to let Dave Mahusky introduce our speaker.

8
00:00:26,537 --> 00:00:30,737
Yeah, so I'm co-founder of Precision X Systems, so we're the premier sponsor for the AI Summit.

9
00:00:31,377 --> 00:00:32,937
Glad to be here, excited to be here.

10
00:00:32,937 --> 00:00:35,137
This is our first one, and I think we're going to keep coming back.

11
00:00:35,137 --> 00:00:38,457
This is just, it's a great time, great, great conversations.

12
00:00:38,457 --> 00:00:45,897
And so these sessions are really kind of eye-opening too as you listen to other speakers, and it's really informative.

13
00:00:45,897 --> 00:00:47,177
So you guys are in for a treat.

14
00:00:47,737 --> 00:00:48,937
And with this guy too.

15
00:00:48,937 --> 00:00:51,977
So our next speaker is Professor Doug Johnson.

16
00:00:51,977 --> 00:01:01,657
So he's the director of the Iowa State University Center for Cybersecurity Innovation and Outreach for, and also a professor of electrical and computer engineering.

17
00:01:02,617 --> 00:01:06,977
Professor Jacobson has been working in cybersecurity since the early 1900s.

18
00:01:06,977 --> 00:01:08,297
Nineteen 90s.

19
00:01:08,457 --> 00:01:08,777
OK.

20
00:01:12,937 --> 00:01:14,057
He got that right away.

21
00:01:14,617 --> 00:01:15,657
He got that right away.

22
00:01:19,337 --> 00:01:19,457
Yeah.

23
00:01:19,457 --> 00:01:24,057
So I gave a I gave a talk on Monday to Rotary and they said the exact same thing.

24
00:01:24,297 --> 00:01:28,937
So AI somewhere AI must have that must have been older than AI since 1900s.

25
00:01:28,937 --> 00:01:29,017
Why?

26
00:01:29,017 --> 00:01:29,377
OK.

27
00:01:29,897 --> 00:01:36,057
I thought it was like a funny thing.

28
00:01:36,057 --> 00:01:36,297
OK.

29
00:01:39,497 --> 00:01:41,497
Sorry, Doug, we love you, Doug.

30
00:01:42,937 --> 00:01:43,777
He has built.

31
00:01:44,377 --> 00:01:44,697
He has.

32
00:01:45,617 --> 00:01:50,457
He has helped build one of the nation's longest running university programs in the field.

33
00:01:50,937 --> 00:02:04,697
And he also directs the Iowa's Cyber Resilience Initiative, which provides cybersecurity services and training to more than 1,400 public sector organizations across the state of Iowa.

34
00:02:05,777 --> 00:02:12,777
In this session, AI security is not a brand, governance, risk, and the reality behind safe AI.

35
00:02:13,697 --> 00:02:33,017
He will offer a practical perspective on how to evaluate AI risk beyond vendor claims, and you guys will gain a clearer understanding of governance, data controls, and the key questions needed to make informed, defensible AI decisions.

36
00:02:33,577 --> 00:02:40,857
So on behalf of Cirrus and the PrecisionX System, welcome, please join me in welcoming Professor Doug Jacobson.

37
00:02:45,977 --> 00:02:47,417
All right, cool.

38
00:02:48,377 --> 00:02:58,497
So yes, and this will kind of, for those of you who've been in the first two sessions, this will kind of piggyback off of the first two, and Aaron will keep me, it's just like I kept Tim honest.

39
00:03:00,217 --> 00:03:09,497
So what I want to focus on today is really talking much more about the processes and systems that you should be putting in place.

40
00:03:10,857 --> 00:03:13,737
as you're looking at deploying AI.

41
00:03:14,137 --> 00:03:18,217
And so I don't know how many people have heard this.

42
00:03:18,417 --> 00:03:22,137
was anybody here from Iowa leadership in Iowa State?

43
00:03:22,937 --> 00:03:31,657
This was my world up until a little while ago that the only thing you could use is copilot because that's the only thing that's safe.

44
00:03:33,137 --> 00:03:36,297
Sometimes I fight my administration, sometimes I don't.

45
00:03:36,297 --> 00:03:37,577
I just ignored them on this one.

46
00:03:39,017 --> 00:03:40,697
Shadow AI, right, Aaron?

47
00:03:43,737 --> 00:03:50,057
So, in this, I noticed the case of Iowa State, it wasn't really a security argument.

48
00:03:50,057 --> 00:03:51,497
It was a control argument.

49
00:03:51,817 --> 00:03:52,857
It was a money argument.

50
00:03:52,937 --> 00:03:54,097
It was several other arguments.

51
00:03:54,097 --> 00:03:55,337
It had nothing to do with security.

52
00:03:57,017 --> 00:04:02,617
And, you know, it really, what we ended up at Iowa State is that everybody was out buying their own licenses for their own AI.

53
00:04:04,377 --> 00:04:04,777
So

54
00:04:05,617 --> 00:04:14,937
Taking this sort of a stance to start off with, again, starting with the tool and saying good tool, bad tool, really that's how it shuts down the conversation.

55
00:04:16,777 --> 00:04:23,817
and as was pointed out earlier, you get a lot of innovation from the people who are allowed to do cool things.

56
00:04:24,657 --> 00:04:29,257
And also, I think one of the biggest things, it creates a false sense of confidence.

57
00:04:29,857 --> 00:04:34,137
When you say this is the only thing, focus on that tool, say this is the only good tool, this is the only thing that's safe.

58
00:04:35,977 --> 00:04:45,337
I argue, I argue over and over again that in cybersecurity technology does not solve the problem all by itself.

59
00:04:45,977 --> 00:04:51,577
Actually, it's in my anymore, it's a small part of the solution to the problem.

60
00:04:53,177 --> 00:05:01,737
So we need to replace and start thinking about other things before we start thinking about tool selection.

61
00:05:03,497 --> 00:05:06,177
This is not a vendor comparison.

62
00:05:06,177 --> 00:05:19,417
This is not anti-Microsoft, only because that's such an easy target to do that it's not fun to be, well, it's fun, but it's really about risk decisions in government and governance.

63
00:05:20,857 --> 00:05:21,337
And so

64
00:05:23,697 --> 00:05:27,577
If we think about, security is not determined by brand.

65
00:05:27,577 --> 00:05:34,577
So if we think about security in general, and this is true not just in AI, this is true across security in general.

66
00:05:35,657 --> 00:05:45,737
So much of what we see is driven by vendors out there saying, I have the best this, whatever that is, and it will solve this problem.

67
00:05:48,297 --> 00:05:50,777
And a lot of people are driven by that.

68
00:05:50,777 --> 00:05:54,217
They're driven by the fact that the vendors are out there doing that.

69
00:05:55,097 --> 00:05:57,817
But security really is a lot more than that.

70
00:05:58,217 --> 00:06:07,977
Security is really understanding what you have, what's unique about you, coming up with that process and those methods to handle what you have.

71
00:06:07,977 --> 00:06:10,537
And in the case of AI, we're worried about data.

72
00:06:11,657 --> 00:06:14,297
And in the case of general security, we're also worried about data.

73
00:06:14,777 --> 00:06:21,337
So a lot of it is about understanding our data, putting governance around that data.

74
00:06:21,977 --> 00:06:25,657
And the same governance we put around general data, right?

75
00:06:25,657 --> 00:06:31,257
You think about your business and not everybody gets to see the recipe for Coca-Cola, right?

76
00:06:31,497 --> 00:06:42,537
So the same sort of governance we put around that, the same sort of identity and access, who has access to it, the same type of controls that we talk about with our data,

77
00:06:43,017 --> 00:06:46,537
Those are the same sorts of things we need to think about with AI.

78
00:06:48,137 --> 00:06:52,297
And we need to also think about an architecture, that kind of comes a little later.

79
00:06:52,697 --> 00:06:55,977
And one of the things that we need to talk about are agreements.

80
00:06:56,137 --> 00:06:58,617
Aaron mentioned some things about agreements.

81
00:06:58,617 --> 00:07:05,817
There was a question in one of the earlier sessions about, oh, we got something new and now all of a sudden it's doing AI things and we didn't know it was doing AI things.

82
00:07:07,097 --> 00:07:10,617
So again, we need to focus on

83
00:07:11,337 --> 00:07:13,577
this part of the process.

84
00:07:14,937 --> 00:07:16,617
But this is how it usually plays out.

85
00:07:18,217 --> 00:07:23,657
We find a tool, everybody finds a tool, the shadow AI people find tools, and there's a new tool a week.

86
00:07:24,257 --> 00:07:26,217
There's a new model a week.

87
00:07:28,177 --> 00:07:29,257
And so we start with the tools.

88
00:07:29,457 --> 00:07:31,257
And I said, that's where Iowa State started.

89
00:07:31,897 --> 00:07:34,057
We all use Copilot because we're a Microsoft shop.

90
00:07:35,657 --> 00:07:38,857
All the other tools, no, can't use them, shouldn't use them.

91
00:07:40,057 --> 00:07:47,177
without even talking about anything about how, why we should be doing that.

92
00:07:49,097 --> 00:07:50,857
We then kind of focus on implementation.

93
00:07:50,857 --> 00:07:56,257
We pick a tool, we implement it.

94
00:07:56,297 --> 00:07:59,017
Again, Iowa State, it was undefined.

95
00:07:59,017 --> 00:08:01,417
They just kind of, copilot just showed up one day.

96
00:08:03,737 --> 00:08:07,737
Didn't tell anybody it was there, other than a little while later, they said, this is what you should use.

97
00:08:08,937 --> 00:08:10,377
Then there was a big question, do we have it?

98
00:08:10,617 --> 00:08:12,217
Most people didn't even know they had it.

99
00:08:13,097 --> 00:08:23,177
Of course, this was well after like, 30% of the people I knew on campus were already had their own licenses for ChatGPT and other things.

100
00:08:23,177 --> 00:08:29,417
So we were already way down the ship in running our own AI.

101
00:08:33,497 --> 00:08:37,177
Then they sat there and said, okay, don't put sensitive data on it.

102
00:08:39,257 --> 00:08:50,217
Iowa State's never really told us rank and file people what sensitive data is, other than student records, only because the federal government said those student records shouldn't be shared with people.

103
00:08:53,657 --> 00:08:55,257
Identity and access, yeah.

104
00:08:57,417 --> 00:09:02,457
We, well, we have access to most everything except for the stuff we really need.

105
00:09:04,457 --> 00:09:07,657
So, but that's a big issue.

106
00:09:08,537 --> 00:09:13,337
And then, again, I keep using my place as an example.

107
00:09:14,937 --> 00:09:17,257
I think we have policies and agreements.

108
00:09:18,777 --> 00:09:22,857
We're never privy to any of those, unless you break one of them.

109
00:09:25,257 --> 00:09:25,737
So,

110
00:09:27,977 --> 00:09:30,217
and they now, they've come out later.

111
00:09:30,217 --> 00:09:34,857
We now have some policies and governance around AI after the ship's already sailed.

112
00:09:36,457 --> 00:09:38,857
So this was our deployment.

113
00:09:42,697 --> 00:09:44,537
This is probably the better deployment.

114
00:09:47,497 --> 00:09:50,057
And really, again, involved, you know, flipping this around.

115
00:09:51,177 --> 00:09:55,497
We just talk about data, we talk about it, you know, having AI, having access to your data.

116
00:09:56,137 --> 00:10:02,697
And AI has access to all data that your people who use AI have access to.

117
00:10:03,657 --> 00:10:13,897
So if a person has access to the data, AI will have access to that data, unless you have some processes and methods in place.

118
00:10:14,057 --> 00:10:18,777
So from a governance standpoint, you need to understand your organization.

119
00:10:19,497 --> 00:10:22,537
You know, at Iowa State, we obviously have legal and compliance issues.

120
00:10:22,937 --> 00:10:24,457
We have FERPA data.

121
00:10:26,297 --> 00:10:28,217
Iowa State as an entity.

122
00:10:29,377 --> 00:10:31,577
we have a medical center, little one.

123
00:10:32,617 --> 00:10:34,857
Those went to Iowa State, remember being called student death.

124
00:10:37,497 --> 00:10:40,217
And, we take money.

125
00:10:42,777 --> 00:10:50,937
So we have a arm where we have to deal with money, all sorts of agreements, et cetera.

126
00:10:51,097 --> 00:10:53,977
So those things need to drive how

127
00:10:55,577 --> 00:10:57,097
how AI is used.

128
00:10:57,417 --> 00:11:06,057
We also have another interesting issue that they've kind of come out a little late into, is we're a research institution.

129
00:11:07,657 --> 00:11:15,097
We're just now starting to train our faculty and researchers about the ethical use of AI in doing research.

130
00:11:15,577 --> 00:11:23,337
That's come out a little on the behind side, but at least we now sort of have that in place.

131
00:11:25,497 --> 00:11:34,137
We don't do too bad of a job on identity and access because they do lock down what we can't have access to, except for the things that we ourselves create.

132
00:11:34,217 --> 00:11:37,497
So that's the interesting dilemma we have in our organization.

133
00:11:38,137 --> 00:11:43,857
You know, I don't have access to student records except for the students in my class.

134
00:11:43,857 --> 00:11:47,177
So every faculty member does have FERPA data.

135
00:11:48,377 --> 00:11:50,217
We generate a lot of our own data.

136
00:11:54,457 --> 00:11:56,217
Data control and classification.

137
00:11:56,697 --> 00:11:59,697
Iowa State does have a classification policy, how to classify data.

138
00:11:59,697 --> 00:12:06,937
I don't remember the last time I looked at it, nor do I think half the faculty know it exists.

139
00:12:07,897 --> 00:12:16,297
Data retention, it's forever at Iowa State, at least as far as the data faculty maintain.

140
00:12:18,417 --> 00:12:27,897
But then we now start, then you start to should be moving into implementation, integration, guardrails, monitoring, et cetera, and finally down into the tools.

141
00:12:29,337 --> 00:12:33,017
So that's really the kind of discussion that we should have had.

142
00:12:33,257 --> 00:12:39,657
Now, many of you in this room have probably already deployed and been through that, so you're probably more in the first picture.

143
00:12:41,017 --> 00:12:43,497
But all these pieces are very important

144
00:12:44,617 --> 00:12:50,217
for how to have a secure AI implementation.

145
00:12:50,937 --> 00:12:59,897
So I really haven't focused on Aaron did a good job of talking about some of the tools that will help with some of these some of these pieces.

146
00:13:02,537 --> 00:13:06,497
So we all kind of know how AI works.

147
00:13:06,497 --> 00:13:12,377
So this morning I'm going to say that it may be soon it'll start to think after hearing this morning's talk.

148
00:13:14,297 --> 00:13:17,017
Be nice to your AI so you're not working in a lithium mines.

149
00:13:18,937 --> 00:13:28,697
And so basically AI is a predictive system and it generates response.

150
00:13:28,697 --> 00:13:30,457
It really doesn't think.

151
00:13:31,737 --> 00:13:38,177
So really, again, it's the risk comes in, depends on how you use it, where you use it, what kind of models you use.

152
00:13:38,177 --> 00:13:42,137
And again, back to this, how is the data governed?

153
00:13:43,497 --> 00:13:46,537
people talking about closed models and so on.

154
00:13:49,657 --> 00:14:04,617
So when we think about AI and AI's use, and again, this morning we had the talk about, fully autonomous agents running everything.

155
00:14:06,297 --> 00:14:12,137
I do want to ask that company that had AI overwrite their database, what was it, two weeks ago or so, how that,

156
00:14:12,777 --> 00:14:13,977
how well that worked for him.

157
00:14:16,857 --> 00:14:25,977
So, and we had some good questions at keynote about this whole, humans involvement in AI.

158
00:14:25,977 --> 00:14:37,737
And I kind of like to look at it from two sides, the human assisting the AI and a human assisted AI and AI assisted human.

159
00:14:41,017 --> 00:14:54,217
And so again, this kind of plays into that security piece of being able to kind of always know what AI is doing or try to know what AI is doing.

160
00:14:55,217 --> 00:15:02,777
And that really helps us understand, especially when we start turning it loose to do things.

161
00:15:04,377 --> 00:15:07,097
So security is not just about AI.

162
00:15:09,577 --> 00:15:17,097
feeding data into the model and having that leak, whether it leak from your organization to outside or leak within your organization.

163
00:15:17,497 --> 00:15:23,817
But it is also, as I mentioned, the company that had AI overwrite their database because they turned it loose.

164
00:15:23,977 --> 00:15:31,737
So security is also being careful of how you deploy AI and what you let it do all by itself.

165
00:15:34,617 --> 00:15:38,617
So always wanting to be able to do that sort of checks and

166
00:15:38,857 --> 00:15:42,057
checks and balances with AI.

167
00:15:47,417 --> 00:15:52,337
So again, there's a questions of, then this is back, this is to what I just mentioned, this idea of,

168
00:15:52,577 --> 00:15:56,777
of data moving around when you use your AI models.

169
00:15:57,897 --> 00:16:04,617
And it depends on the platform, the configuration, the agreements, et cetera, of how does that data move.

170
00:16:05,897 --> 00:16:16,937
And not all tools remain the same, not all agreements look the same, and not all users treat it the same.

171
00:16:16,937 --> 00:16:21,737
It was really interesting, it was about a month ago,

172
00:16:23,257 --> 00:16:32,377
One of the chat, but one of the systems out there that you could build your own agent, there's a big announcement.

173
00:16:32,377 --> 00:16:35,417
Somebody released an agent called Einstein.

174
00:16:37,257 --> 00:16:46,537
Einstein was an agent that you gave it your login credentials to your, as a student, you gave it login credentials to Canvas.

175
00:16:46,537 --> 00:16:48,457
Canvas is the learning management system.

176
00:16:49,577 --> 00:16:50,937
It would log into Canvas.

177
00:16:52,057 --> 00:17:01,097
It would grab all your assignments, you grab all the lecture notes, all the videos, and then they would automatically do the assignments for you.

178
00:17:01,657 --> 00:17:06,057
It would do the exams for you, it would write the papers for you, and it would do everything for you.

179
00:17:07,017 --> 00:17:07,737
That was released.

180
00:17:08,137 --> 00:17:11,817
It lived for about two days, three days, and then it disappeared.

181
00:17:12,297 --> 00:17:16,697
My guess is that Canvas brought more lawyers than exist in the United States.

182
00:17:18,937 --> 00:17:31,497
But there was a case where an outside entity created a agent in an AI system that an internal user could voluntarily give access to all its data.

183
00:17:34,217 --> 00:17:35,817
That's a scary thing.

184
00:17:38,857 --> 00:17:43,137
And, you know, when this came out, our IT people are going,

185
00:17:44,737 --> 00:17:50,617
There's no really way to stop this because the students are giving it the login credentials.

186
00:17:51,097 --> 00:17:53,137
This thing looks like a student logging in.

187
00:17:53,137 --> 00:17:56,377
There is no technology that's going to fix this.

188
00:17:59,177 --> 00:18:01,177
So, but it went, like I said, it went away.

189
00:18:02,457 --> 00:18:08,057
Now the students have to download the assignments by hand and the lectures by hand and feed it in the model by themselves.

190
00:18:08,617 --> 00:18:11,337
So, a little more work.

191
00:18:12,617 --> 00:18:13,497
Same outcome.

192
00:18:16,137 --> 00:18:17,657
Oh, it doesn't do it for them automatically.

193
00:18:23,577 --> 00:18:25,257
Yeah, probably.

194
00:18:27,337 --> 00:18:38,417
Yeah, we won't even get into the whole, students and yeah, I will for a second.

195
00:18:38,417 --> 00:18:41,817
The bottom line is, at least how I treat it,

196
00:18:43,017 --> 00:18:48,377
AI is a tool, just like calculators were a tool, and I need to let the students know how I expect it to be used.

197
00:18:48,377 --> 00:18:50,057
And I lean into it heavy.

198
00:18:50,057 --> 00:18:52,937
I use it, and I tell them where I use it, and I tell them where they can and can't.

199
00:18:53,177 --> 00:18:59,177
But I have faculty members who want to hang every student that even looks at the AI.

200
00:19:00,337 --> 00:19:03,337
And you can't not look at the AI anymore, right?

201
00:19:04,297 --> 00:19:05,417
Stupid Google, right?

202
00:19:05,417 --> 00:19:07,097
Your search engines are AI.

203
00:19:07,257 --> 00:19:08,257
The entire world is.

204
00:19:08,257 --> 00:19:11,337
So anyway, but off that soapbox of my colleagues.

205
00:19:13,657 --> 00:19:22,297
So I want to kind of go through four types of risks that we want to look at quickly.

206
00:19:23,057 --> 00:19:27,017
And so we have the cybersecurity risk.

207
00:19:29,097 --> 00:19:31,337
been in cybersecurity since the 1900s.

208
00:19:32,137 --> 00:19:35,417
So long time, long time.

209
00:19:36,537 --> 00:19:39,537
Hey, that Babbage engine, that was a hard thing to secure, let me tell you.

210
00:19:41,577 --> 00:19:45,977
All right, who's the old people in the room?

211
00:19:46,577 --> 00:19:49,977
So, again, we've talked about several of these things.

212
00:19:50,217 --> 00:19:52,137
data leakage is an issue.

213
00:19:54,457 --> 00:20:04,137
Even with internal models, we have issues of identity compromise and data leakage, even across your own internal models.

214
00:20:04,137 --> 00:20:09,817
I've talked to people in the medical field that are really concerned about those internal models.

215
00:20:10,137 --> 00:20:18,857
And by making certain queries, what information can you accidentally learn that you shouldn't be learning?

216
00:20:20,897 --> 00:20:22,377
Obviously, misconfigurations.

217
00:20:24,617 --> 00:20:34,857
We have the various forms of APIs and MPCs and all these cool acronyms of how you can interconnect to your AI.

218
00:20:35,777 --> 00:20:39,097
I'm very worried about that sort of misuse.

219
00:20:41,577 --> 00:20:51,177
Actually, one of the things Iowa State did, which actually upset a lot of people, the Canvas system I mentioned, faculty used to have API access to Canvas.

220
00:20:51,177 --> 00:20:55,657
And we'd write little apps to do grades and things like that.

221
00:20:55,977 --> 00:20:58,697
Well, they decided that was a security risk and they took it away from us.

222
00:20:59,657 --> 00:21:01,057
So now we have to do all this up by hand.

223
00:21:03,017 --> 00:21:04,297
Issues of bias.

224
00:21:04,577 --> 00:21:07,337
And then, you know, the issue we always run across is validation.

225
00:21:07,657 --> 00:21:09,177
When is it hallucinating?

226
00:21:10,657 --> 00:21:11,977
When is it not hallucinating?

227
00:21:15,497 --> 00:21:21,897
So again, always, I always hate slides, always talk ahead of the slides.

228
00:21:23,577 --> 00:21:31,497
So again, you know, it's a little more beyond feeding the model as far as data leakage.

229
00:21:32,457 --> 00:21:35,337
As I already mentioned, we have internal exposure.

230
00:21:37,737 --> 00:21:44,857
So it gets a little complicated if you're worried not only about data leaking outside your organization, but data leaking across your organization.

231
00:21:48,057 --> 00:21:53,257
Bias, this is part of a kind of more of an education piece to your users.

232
00:21:56,057 --> 00:22:00,937
But again, it has obviously has bias based on, you know, in the data and the prompts itself.

233
00:22:02,697 --> 00:22:06,137
I know, you know, Aaron mentioned something about

234
00:22:07,657 --> 00:22:10,697
tools out there that will help sanitize the prompts.

235
00:22:11,337 --> 00:22:26,537
Now we as faculty, many of us have talked about, I know some faculty have tried this, when you hand out an assignment in a PDF to a student or some other document, you will embed hidden prompts

236
00:22:27,097 --> 00:22:27,937
in the document.

237
00:22:27,937 --> 00:22:35,097
So when the students feed it into the AI, it will feed garbage back out or feed a keyword back out.

238
00:22:35,337 --> 00:22:40,697
Like, make sure the word banana shows up somewhere in the output.

239
00:22:40,697 --> 00:22:43,457
So now there's none of my students are in here, I think.

240
00:22:43,457 --> 00:22:44,097
So, sorry.

241
00:22:45,017 --> 00:22:46,417
Well, these are being recorded, isn't it?

242
00:22:46,417 --> 00:22:46,697
Oh, well.

243
00:22:48,457 --> 00:22:48,777
Oh, oh, well.

244
00:22:51,017 --> 00:22:54,537
But there have been discussion, you know, there have been

245
00:22:55,737 --> 00:23:00,217
People have talked about this as another way for an adversary.

246
00:23:00,537 --> 00:23:05,337
That's by sending you documents and you feed those documents into your model and now you've poisoned your model.

247
00:23:05,897 --> 00:23:09,577
So this is a real, you know, even when I talk about my students, this is a real threat.

248
00:23:10,217 --> 00:23:14,097
Of course, AI doesn't always have the most recent answer.

249
00:23:14,097 --> 00:23:18,697
This is the things we always try to get across to our students, that AI is not always right.

250
00:23:20,537 --> 00:23:23,577
And obviously, to review the results.

251
00:23:25,497 --> 00:23:26,697
this kind of ties into that.

252
00:23:28,057 --> 00:23:32,217
Most of us realize that AI hallucinates, gets bad data.

253
00:23:33,217 --> 00:23:34,057
It's fun to argue with.

254
00:23:37,257 --> 00:23:39,097
My wife won't be listening to this either.

255
00:23:40,457 --> 00:23:44,777
But the other day, my wife's just now getting into AI.

256
00:23:44,777 --> 00:23:46,937
She's, you know, the last several months.

257
00:23:47,337 --> 00:23:50,377
And she came up and she says, I'm going to quit arguing with AI.

258
00:23:50,377 --> 00:23:51,897
So I spent an hour arguing with AI.

259
00:23:53,177 --> 00:23:53,577
Okay.

260
00:23:54,057 --> 00:23:55,337
We shouldn't spend an hour arguing.

261
00:23:59,417 --> 00:24:04,737
So but but again, you know, it does it does hallucinate.

262
00:24:04,737 --> 00:24:10,697
And you can, you know, sometimes if you beat on it hard enough, you can win your argument, even though it's wrong.

263
00:24:14,537 --> 00:24:17,857
Kind of a side side note.

264
00:24:17,857 --> 00:24:20,857
I'm going to talk about that.

265
00:24:21,737 --> 00:24:27,657
How many find it kind of creepy slash reinforcing the way it talks to us?

266
00:24:28,537 --> 00:24:42,217
So affirming, which, you know, I think hopefully somebody today is talking about that aspect of AI, because that's a that's a whole different AI, a whole different aspect of AI is it's how many have named their AI?

267
00:24:45,497 --> 00:24:47,617
You got what?

268
00:24:47,617 --> 00:24:47,857
OK.

269
00:24:53,817 --> 00:25:03,257
OK, so mine mine said it was named OpenAI said she wanted to be called Athena and Chad GDP wanted to be called Pixel.

270
00:25:04,297 --> 00:25:04,777
So I got it.

271
00:25:04,777 --> 00:25:05,977
So yes, I've named both of mine.

272
00:25:06,377 --> 00:25:09,137
They came up with those on there.

273
00:25:09,497 --> 00:25:17,577
Yes, Now, I'll give OpenAI a little bit of credit because it came and said, I'm not a person.

274
00:25:19,297 --> 00:25:24,377
so giving me a name, it doesn't really do much, but if you really want, I can give you some suggestions.

275
00:25:25,097 --> 00:25:26,297
So I said, okay, give me suggestions.

276
00:25:26,297 --> 00:25:31,497
And Athena was the first one, but it will use its name when I talk to it.

277
00:25:31,497 --> 00:25:35,577
Pixel will, a copilot will almost always say it's pixel when it's done.

278
00:25:36,137 --> 00:25:38,937
So, okay.

279
00:25:42,057 --> 00:25:42,257
Yeah.

280
00:25:44,137 --> 00:25:47,977
Then we can talk about some perceived risks.

281
00:25:49,057 --> 00:25:56,697
a lot of fear driven by various headlines out there, misunderstanding, over-restriction.

282
00:25:57,097 --> 00:26:03,337
Aaron mentioned some of the worst things that can happen is when government tries to legislate technology.

283
00:26:04,697 --> 00:26:10,377
There were several AI bills that tried to move forward this year.

284
00:26:10,697 --> 00:26:17,497
None of them, well, one of them did deal with minors and chatbots, which was much more of a, not really an AI thing, but

285
00:26:18,857 --> 00:26:21,017
It was, but not directly.

286
00:26:23,257 --> 00:26:34,777
And so, but one of the things that we, several of the legislators have talked to me are really, they hear a lot from their constituents and their constituents are afraid.

287
00:26:35,657 --> 00:26:39,617
And so there was a, there was a bill that just got out and only got out of the IT.

288
00:26:39,617 --> 00:26:44,857
Actually, I think it may have gotten all, may have gotten all the way through the House side.

289
00:26:46,777 --> 00:26:52,417
to where there would be literacy, AI literacy in K through 12.

290
00:26:52,617 --> 00:26:54,537
and the general population.

291
00:26:55,497 --> 00:26:57,657
So that's some of the entrance that's shown up.

292
00:26:57,657 --> 00:27:00,377
We can have discussions about unfunded mandates and other things.

293
00:27:00,377 --> 00:27:01,897
I see Samantha over there.

294
00:27:02,457 --> 00:27:09,657
But that is something that I know are, you know, rank and file in Iowa are concerned about.

295
00:27:13,737 --> 00:27:15,417
And then compliance risk.

296
00:27:16,297 --> 00:27:18,857
And this, of course, being very dependent on your organization.

297
00:27:19,457 --> 00:27:23,657
what regulations, what's out there for data handling, retention.

298
00:27:25,177 --> 00:27:33,737
I know government agencies are worried about retention and the Open Information Acts and those sorts of things.

299
00:27:35,097 --> 00:27:39,337
Audits, disclosure, ownership's an interesting question.

300
00:27:40,697 --> 00:27:42,337
Who owns the output of AI?

301
00:27:42,337 --> 00:27:48,137
That was actually a bill that was trying to work through also through the Iowa State House of AI ownership.

302
00:27:49,017 --> 00:27:51,977
yeah, that one, that one, that one, thank God, that went away.

303
00:27:54,217 --> 00:28:08,937
But that's an interesting discussion we even have in Iowa State is now who owns, because it's even fuzzy who owns who owns the materials you produce as a faculty member, let alone you as a faculty member using AI to funded by the university to create materials.

304
00:28:10,497 --> 00:28:16,377
And then the various legal exposures that you may that you may have, again, depending on your

305
00:28:16,857 --> 00:28:17,897
your organization.

306
00:28:20,777 --> 00:28:32,937
And so again, a lot of places, a lot of you probably already have some data governance as far as the type of data you may keep, your credit cards and other types of information.

307
00:28:33,977 --> 00:28:38,937
Those same sort of things that you thought about from an AI standpoint.

308
00:28:40,137 --> 00:28:42,657
You kind of treat AI somewhat as a

309
00:28:44,457 --> 00:28:51,097
maybe not, maybe an employee or in some cases start to think about AI as sort of being an outsider.

310
00:28:51,897 --> 00:28:58,137
When you start thinking about data governance, if you start from that position, then you can always work back into giving it more rights.

311
00:29:00,737 --> 00:29:07,337
And then obviously policies, and then do your employees know those policies?

312
00:29:08,897 --> 00:29:12,057
Like I said, Iowa State has a data governance policy.

313
00:29:12,937 --> 00:29:15,737
I'm sure that 99% of the faculty have never read it.

314
00:29:17,497 --> 00:29:23,977
I only read it because when they started to create it, they had no, everything was restricted.

315
00:29:23,977 --> 00:29:26,057
There was no I don't care bucket.

316
00:29:27,097 --> 00:29:35,337
So that meant that any piece of material I produced at Iowa State, lecture notes, et cetera, had to be classified and protected.

317
00:29:35,937 --> 00:29:38,457
It's like, that ain't happening.

318
00:29:39,577 --> 00:29:43,057
First of all, the students all have access to their, that ship has long since sailed.

319
00:29:44,297 --> 00:29:49,577
And so, and then of course, your vendor vendor agreements.

320
00:29:51,737 --> 00:29:54,657
So the other thing that kind of drives what we do is vendor comfort.

321
00:29:54,657 --> 00:29:57,257
And there's nothing wrong with being, you know, the familiar vendors.

322
00:29:59,737 --> 00:30:02,777
But comfort doesn't always equal equal security.

323
00:30:04,377 --> 00:30:06,417
And sometimes comfort is almost mandate.

324
00:30:06,537 --> 00:30:09,897
Iowa State is basically 100% Microsoft shop.

325
00:30:11,257 --> 00:30:12,297
All our phones went away.

326
00:30:12,777 --> 00:30:14,377
So now my computer rings.

327
00:30:15,257 --> 00:30:17,017
Boy, is that an obnoxious noise.

328
00:30:17,337 --> 00:30:20,017
Man, scares me every time it does, I'll tell you.

329
00:30:20,017 --> 00:30:31,897
And especially when it's a telemarketer, but so again, you know, every day there's probably another dozen or more vendors added to this list.

330
00:30:32,217 --> 00:30:40,937
So that's where you, if you're kind of new into this, that's where you really need to kind of go back to your trusted, who's your trusted IT vendor, who's your trusted security vendor.

331
00:30:45,017 --> 00:30:48,697
So, you know, what makes AI safe?

332
00:30:49,737 --> 00:30:58,057
Been thinking about, you know, identity, who has access, data classification, how do we, how do we,

333
00:30:58,857 --> 00:31:16,297
decide what data it can have, what data it shouldn't have, what data certain types of models can have, monitoring it, watching what's going on, governance over how you interconnect with it, APIs, MPCs, et cetera.

334
00:31:16,617 --> 00:31:27,017
As much as I was upset with Iowa State's policy of removing the APIs for Canvas, they are now taking a position of, okay,

335
00:31:27,737 --> 00:31:35,177
We're going to rethink that, but we're going to think about how and where and putting some, because you pretty much had open access to Canvas.

336
00:31:35,417 --> 00:31:41,137
So I agree that the API, if somebody who didn't understand programming could easily ripe out all their grades.

337
00:31:41,137 --> 00:31:43,657
You couldn't hurt anybody else's, but you could do yourself harm.

338
00:31:44,137 --> 00:31:47,417
And then if you did yourself harm, then the IT department has to fix it.

339
00:31:48,617 --> 00:31:54,777
So, you know, the kind of questions you ask,

340
00:31:56,497 --> 00:32:00,617
When you're talking to vendors, when you're talking about deploying AI, and where's the data go?

341
00:32:01,537 --> 00:32:02,617
Who has access?

342
00:32:03,657 --> 00:32:04,857
Is it stored somewhere?

343
00:32:05,657 --> 00:32:07,017
Is it used to train the model?

344
00:32:07,017 --> 00:32:09,257
And what are the contract terms?

345
00:32:09,657 --> 00:32:12,777
It's not always bad that it trains the model.

346
00:32:12,777 --> 00:32:15,257
I use AI daily.

347
00:32:16,977 --> 00:32:24,217
One of the things we do is we create music videos for teaching cybersecurity.

348
00:32:24,857 --> 00:32:26,057
I want the model trained.

349
00:32:26,777 --> 00:32:30,057
Because I want it to keep doing what I do.

350
00:32:30,457 --> 00:32:32,217
It understands what I want to do.

351
00:32:32,937 --> 00:32:37,817
And it probably feeds into other people, which I don't care if other people mimic what we're trying to do.

352
00:32:38,337 --> 00:32:42,777
But in other cases, I know that I don't want the model fed with my data.

353
00:32:46,297 --> 00:32:48,617
So again, kind of final takeaways.

354
00:32:49,497 --> 00:32:53,897
You know, security is not all, it's not just about the vendor.

355
00:32:54,897 --> 00:33:09,657
There's a lot of other pieces and things that are part of security, things that you have direct control over, things that should be your processes and procedures in place, the governance and how you handle that.

356
00:33:12,377 --> 00:33:16,457
again, many of us in security argue tools are very important.

357
00:33:16,457 --> 00:33:23,217
Security tools are great, they're wonderful, but if the security tools all worked, Aaron and I'd be out of a job.

358
00:33:24,657 --> 00:33:25,497
And we're not out of a job.

359
00:33:25,817 --> 00:33:27,337
We need about a dozen more of us.

360
00:33:28,537 --> 00:33:33,177
So technology is great, but technology doesn't fix it.

361
00:33:33,657 --> 00:33:36,377
Technology is, again, also one of those tools.

362
00:33:36,777 --> 00:33:45,497
AI is a tool, all the rest of your security pieces are a tool, but it also revolves around having strong internal processes.

363
00:33:45,897 --> 00:33:51,257
Many of the security things we see are not a technology failure, they're a process failure.

364
00:33:53,097 --> 00:33:55,177
And so the same thing with AI.

365
00:33:55,497 --> 00:34:00,297
It's you not having the right, thinking about the right processes in place.

366
00:34:03,417 --> 00:34:06,577
So questions?

367
00:34:06,577 --> 00:34:10,737
I don't know how much I'd like to have you used the microphone just because we are transcribing this.

368
00:34:10,737 --> 00:34:13,337
So the person closest to me gets to go first.

369
00:34:14,377 --> 00:34:21,817
If you had like 15 seconds to convince leadership of the importance of governance and their role in it, what would you say?

370
00:34:25,097 --> 00:34:36,857
So, you might, data governance, you asked the question, what would hap what would happen if somebody walked in and took took out walked in and took everything out of your file cabinets and shared that?

371
00:34:39,097 --> 00:34:43,097
do you have controls to even who can walk into the file, you know, whatever system you use?

372
00:34:43,257 --> 00:34:50,297
So, that's that same analogy, I think that's the same analogy that you're giving computing systems access

373
00:34:50,777 --> 00:34:57,337
Computing systems that you don't have full control over, access to stuff that you would never give.

374
00:34:57,497 --> 00:35:01,097
So maybe the better way to ask that question is the way I phrase a lot of times in security.

375
00:35:02,617 --> 00:35:06,057
If somebody walked up to the street and said, would you give me your social security number?

376
00:35:06,057 --> 00:35:06,857
You wouldn't do that.

377
00:35:08,057 --> 00:35:12,937
Why would you do that when some computer system in essence asks the same thing?

378
00:35:16,377 --> 00:35:16,697
Great.

379
00:35:19,817 --> 00:35:20,937
Yeah, I'm the enemy.

380
00:35:22,777 --> 00:35:26,057
Now, at Iowa, we also use Copilot.

381
00:35:26,057 --> 00:35:35,257
I am assuming that you use the Enterprise Copilot, which does not allow your prompts to be used as inputs for anybody, any training for anybody else.

382
00:35:35,257 --> 00:35:35,857
Yep, that's correct.

383
00:35:35,857 --> 00:35:37,977
Yeah, we have Enterprise, we have Enterprise Copilot.

384
00:35:40,697 --> 00:35:45,417
And, yeah, and that is a big advantage of using Enterprise Copilot, which doesn't train the model.

385
00:35:46,137 --> 00:35:55,257
But their argument was that that's the only thing we could use because that's, they use security as a way to force us to not use other things.

386
00:35:55,817 --> 00:36:00,697
And using security as a baseball bat is not a way to use security.

387
00:36:06,257 --> 00:36:08,857
I have the question, whether it's you or someone else in the room.

388
00:36:09,577 --> 00:36:13,417
So I lead HR and right, so we get to write the policy on AI, right?

389
00:36:14,377 --> 00:36:25,977
How do you, how are other companies thinking through something that's developing so rapidly that, you know, that guideline and policy or expectations today in six weeks could be obsolete, right?

390
00:36:25,977 --> 00:36:28,257
And especially when we all have this.

391
00:36:28,257 --> 00:36:30,137
And so I know my employees are using this.

392
00:36:30,177 --> 00:36:35,737
And yeah, and I'm not a rigid person, but we have to have some guardrails, right?

393
00:36:35,897 --> 00:36:39,337
Yeah, and I don't know if people are going to ask how companies handle that.

394
00:36:40,137 --> 00:36:40,617
You know, we're

395
00:36:41,737 --> 00:36:47,577
Iowa State's probably the worst case example for a lot of the nature, by the way we are, right?

396
00:36:47,577 --> 00:36:52,457
The faculty love being faculty because we can consider ourselves independent contractors.

397
00:36:54,377 --> 00:36:59,057
Yeah, we are, we are, we're, yeah, we're, yeah, we're, we're bad cats sometimes.

398
00:36:59,057 --> 00:37:07,817
Yeah, I get my policy, somebody's always gonna break something, but this one's.

399
00:37:08,337 --> 00:37:10,937
It's different than giving someone a key card, right?

400
00:37:11,057 --> 00:37:11,177
Yeah.

401
00:37:11,577 --> 00:37:15,257
You're giving them the whole key, the house.

402
00:37:15,417 --> 00:37:15,657
Yeah.

403
00:37:16,057 --> 00:37:25,977
Well, I think a lot of this was some of the discussions we had earlier and what we've learned from Pella is, you know, AI needs to be part of the entire organization's conversation.

404
00:37:25,977 --> 00:37:28,337
This is not a siloed IT thing.

405
00:37:28,337 --> 00:37:31,257
This is not, this needs to be part of your overall culture.

406
00:37:31,657 --> 00:37:36,217
So the culture, if you're going to lean into AI, which I think everybody needs to lean into AI,

407
00:37:36,937 --> 00:37:39,337
then this needs to be part of the culture, part of the discussion.

408
00:37:39,977 --> 00:37:50,457
And in doing so, this is rapidly changing, but if it's something that the organization's bought into, this is something you can have continuing discussions about.

409
00:37:50,457 --> 00:37:52,417
Oh, this is this new thing, this is this new thing.

410
00:37:52,497 --> 00:37:54,857
something, this is this new great cool thing.

411
00:37:54,857 --> 00:37:57,177
It doesn't have to be, this is this new bad thing.

412
00:37:59,257 --> 00:38:12,297
So it's really building that culture around the fact that, and then the time when your talk this morning about, the fear and employees losing their job, and I hear that all the time from students, right?

413
00:38:13,257 --> 00:38:14,097
I'm going to lose my job.

414
00:38:15,897 --> 00:38:19,897
You're only going to lose your job if you don't embrace and if you don't brace and die into AI.

415
00:38:20,057 --> 00:38:25,017
You know, we now require AI in our in my department and our majors.

416
00:38:25,657 --> 00:38:27,017
We lean into it heavily.

417
00:38:27,897 --> 00:38:31,697
Students are always asking me about, you know, is you're going to lose cybersecurity jobs because of AI.

418
00:38:31,697 --> 00:38:33,417
And I said, no, we're going to need double and need.

419
00:38:33,737 --> 00:38:37,497
We're going to need twice as many of you because of AI, not half as many.

420
00:38:46,217 --> 00:38:50,457
So with HR, they definitely have full dictated access.

421
00:38:52,057 --> 00:38:54,217
And the other is to educate people.

422
00:38:54,537 --> 00:38:58,617
If you're in a situation like education, that's HIPAA guidelines.

423
00:38:59,657 --> 00:39:01,497
HIPAA guidelines don't force.

424
00:39:04,177 --> 00:39:07,017
Yeah, like are you guys have are you?

425
00:39:07,537 --> 00:39:14,137
Or some companies actually blocking some other AI tools within their network, so that usually, OK, that's what I assume, right?

426
00:39:14,137 --> 00:39:20,137
It's like blocking if you don't watch at GT or these certain ones, and it's just take that opportunity out.

427
00:39:20,497 --> 00:39:32,297
What's hard is the rogi AI when you've got it on your device, yeah, you know, bring a separate tablet or laptop to work to the code if they like the way they did it better.

428
00:39:32,657 --> 00:39:34,777
Still, we enable the cloud enterprise license.

429
00:39:34,777 --> 00:39:36,897
Yeah, like that kind of crap can't happen there.

430
00:39:36,897 --> 00:39:38,977
We've got to stop that, but how can you stop that?

431
00:39:39,017 --> 00:39:40,297
And that's what we're looking at, right?

432
00:39:40,297 --> 00:39:42,697
It's because each agent has their own strengths.

433
00:39:43,017 --> 00:39:49,497
So, like, yes, everybody's Microsoft system, so Microsoft out of the gates gets that because they're in your platform, right?

434
00:39:50,057 --> 00:39:52,017
I'm a huge block of public, so we're trying to save.

435
00:39:52,577 --> 00:39:55,057
How do you leverage these different agents the best?

436
00:39:55,057 --> 00:39:58,457
And at the end of the day, they always have to be logged in as an enterprise plan.

437
00:40:05,257 --> 00:40:07,417
I'm sorry, two cents on the table.

438
00:40:09,257 --> 00:40:10,937
I think it's about inclusiveness.

439
00:40:11,177 --> 00:40:15,257
I think if you treat your employees like idiots, that's usually how they'll behave.

440
00:40:15,737 --> 00:40:22,457
I think if you, you're in HR, so you're in a really, no, you're in a unique position to help.

441
00:40:22,937 --> 00:40:36,377
If you find champions within the organization and say, you and you and you are coming to my private AI party, not only have you given a little bit of credence to what they're doing, they also know they're not getting fired, which is a thing.

442
00:40:36,457 --> 00:40:39,577
I get asked about that all, like if I touch this shit, am I going to get canned?

443
00:40:40,697 --> 00:40:42,377
It gives them an invite to the party.

444
00:40:42,377 --> 00:40:47,417
And to me, this is a big part of what Doug and I talked about, visibility.

445
00:40:48,137 --> 00:41:02,457
If you get access, if you can't manage it if you don't know what it is, the better you can invite those folks into the tent, no matter what crazy bad shit they're up to, the better you're going to have a chance of like maybe winning some of this game.

446
00:41:04,097 --> 00:41:04,857
How's that pronounced?

447
00:41:05,177 --> 00:41:06,937
Maybe winning some of the game.

448
00:41:06,937 --> 00:41:08,537
I think we're at that point though, right?

449
00:41:11,977 --> 00:41:13,097
No, it's not.

450
00:41:15,897 --> 00:41:16,257
at all.

451
00:41:16,297 --> 00:41:18,457
I had a question back here and then I'm going to come back up to you.

452
00:41:18,697 --> 00:41:19,177
Sound good?

453
00:41:20,857 --> 00:41:21,817
Thank you, Professor.

454
00:41:22,457 --> 00:41:23,657
I'm in cybersecurity too.

455
00:41:23,657 --> 00:41:30,297
So one of the biggest things that I see it, it's not about the data leakage or the actually BIOS.

456
00:41:30,537 --> 00:41:39,577
Can you touch a little bit more deeper on validation and that synthetic truth the AI is creating that almost

457
00:41:40,217 --> 00:41:52,377
70% of organizations and taking as a face value and not putting that human in the loop and those feedback loop and that creating a complete distorted reality of their organizations.

458
00:41:53,257 --> 00:41:55,897
Yeah, that's a, that is a really tough one.

459
00:41:56,217 --> 00:42:00,857
And that, it's how do you educate people that AI is wrong?

460
00:42:03,577 --> 00:42:06,857
And, you know, I've seen some of that,

461
00:42:07,657 --> 00:42:08,697
it takes education.

462
00:42:09,097 --> 00:42:20,457
I saw a really cool example, one of our faculty who teaches CS1, basic programming, which is, a AI agent could pass CS1 with an A.

463
00:42:21,657 --> 00:42:23,577
Cloud code could pass CS1.

464
00:42:25,097 --> 00:42:31,737
But what this faculty member did was leaned into it at the beginning and had them, gave them prompts to write three different programs.

465
00:42:32,457 --> 00:42:35,897
Third program was something that Cloud code couldn't write.

466
00:42:36,617 --> 00:42:40,737
got it wrong and trying to emphasize that it got the wrong answer.

467
00:42:40,737 --> 00:42:45,857
But that's hard to, especially, code's a little easier because it, in some cases, doesn't work.

468
00:42:46,217 --> 00:42:55,977
When you have to start to put together documents and materials and those sorts of things and you don't check it, you got to, yeah.

469
00:42:56,137 --> 00:43:03,337
And so it's how do you, how do you instill that of what AI is really doing for you and how you use it as a tool?

470
00:43:05,577 --> 00:43:25,937
And so that's back to maybe having these champions and the, when we first got into AI in our department from as a teaching tool, I taught a few seminar, a few things to my, to the faculty who were interested on ways you could use it and some of the ways it lies and some of the ways that you shouldn't, shouldn't use it as a faculty member.

471
00:43:25,937 --> 00:43:32,937
And it really is unfortunately, well, that's unfortunately, but it takes education and, but people get in a hurry.

472
00:43:35,417 --> 00:43:42,777
And how many times I've seen students write though inadvertently copy the praise sentence that AI always gives you, right?

473
00:43:42,777 --> 00:43:44,337
Yeah, that was a really good question.

474
00:43:44,337 --> 00:43:45,337
Isn't my answer cool?

475
00:43:46,577 --> 00:43:47,017
Okay.

476
00:43:47,017 --> 00:43:51,097
Is that kind of like the speaker bio, Doug?

477
00:43:51,097 --> 00:43:54,577
You need to change speaker bio.

478
00:43:54,577 --> 00:43:55,137
Take a response.

479
00:43:55,217 --> 00:43:56,137
I have one question.

480
00:43:57,577 --> 00:43:58,617
I have one, two.

481
00:43:58,857 --> 00:43:59,097
Good.

482
00:44:01,897 --> 00:44:08,537
Yeah, I just, on the previous conversation, we're going into it with AI champion groups.

483
00:44:08,537 --> 00:44:14,137
And one thing that we're leaning into with people is just that you already know that you have to protect data.

484
00:44:14,137 --> 00:44:15,337
We have resident data.

485
00:44:15,577 --> 00:44:17,257
You already know that you have to protect that.

486
00:44:17,497 --> 00:44:19,737
You already know you can't share this information out.

487
00:44:19,737 --> 00:44:21,497
You already know we have security practices.

488
00:44:21,657 --> 00:44:24,297
This is just another tool where this applies.

489
00:44:24,657 --> 00:44:28,977
and just continuing to have that open conversation and not trying to hide behind it.

490
00:44:28,977 --> 00:44:38,617
And one of the big things, and Curtis and I have been talking a lot, is getting people to open up with where AI has not worked for them.

491
00:44:38,857 --> 00:44:44,777
Because then everybody kind of says, oh, okay, I can fail with this and I'm still okay.

492
00:44:44,777 --> 00:44:45,897
We want to talk about it.

493
00:44:45,897 --> 00:44:47,097
And it's just,

494
00:44:47,417 --> 00:44:51,337
almost like a sigh of relief for people to say, okay, this is all right.

495
00:44:51,417 --> 00:44:52,337
I can do this.

496
00:44:52,337 --> 00:44:54,457
We're not going to be locked down or whatever.

497
00:44:56,857 --> 00:44:57,817
All right, one more question.

498
00:44:57,817 --> 00:45:08,617
All right, so I come from a unique position as a credit union examiner, so I'm more of the make sure the policies fit.

499
00:45:09,737 --> 00:45:16,377
How do you go about if a financial institution doesn't know where the data is going, but they're not misusing

500
00:45:16,697 --> 00:45:25,097
The AI, how do you, how do you make them tell you, not make them, how do you get them to understand they're supposed to data is going?

501
00:45:25,097 --> 00:45:34,297
Like, is there somewhere, some place where they can look that up or is there a contract they should have or how does that go about?

502
00:45:35,417 --> 00:45:44,697
Yeah, I mean, the different types of AIs, you know, and it's going to be a little different, you know, I don't know how you'd read, I've not tried to read through the free version.

503
00:45:45,577 --> 00:45:49,657
license for ChatGPT, for example, other than everything you do is theirs.

504
00:45:50,337 --> 00:45:54,617
But the enterprise licenses, you're going to have, you're going to have a contract.

505
00:45:55,097 --> 00:45:57,177
Legal is going to be able to look through that contract.

506
00:45:57,737 --> 00:46:01,577
You know, as mentioned, you know, the enterprise copilot, no data.

507
00:46:02,137 --> 00:46:03,257
That all stays.

508
00:46:03,737 --> 00:46:08,497
Now you have issues of data within your organization and how it may be compartmentalized.

509
00:46:08,777 --> 00:46:11,417
But it really comes back to that whole legal agreement.

510
00:46:11,657 --> 00:46:14,777
The free stuff, there is no, you have no rights, you know.

511
00:46:15,817 --> 00:46:17,817
because nothing's free on the internet.

512
00:46:18,057 --> 00:46:19,897
Your data pays for everything that's free.

513
00:46:21,577 --> 00:46:26,617
So, but yes, you would have a, and you need, that's where I guess you need to find the lawyers.

514
00:46:28,577 --> 00:46:28,937
Awesome.

515
00:46:29,337 --> 00:46:30,537
Well, thank you all for being here.

516
00:46:30,537 --> 00:46:32,937
Let's thank Doug for an excellent presentation.

517
00:46:36,857 --> 00:46:39,817
Really appreciate the wisdom, the sense of humor, and the Q&A time.

518
00:46:39,817 --> 00:46:40,857
That was fantastic.

519
00:46:40,857 --> 00:46:44,377
So we'll let you go to your next session, and the next one starts at 2.15.

520
00:46:44,457 --> 00:46:45,177
Thanks so much.