Life as a CISO in Hollywood: Keeping New Films Leak-Free & 4 Black Hat Interviews - Dan Meacham, Ellen Boehm, Ronan Murphy, Frank Vukovits, John Hultquist - ESW #474
Summary
Dan Mechum from Legendary Entertainment discusses how AI and contextual awareness secure their cloud-first, external-heavy workforce, emphasizing distributed intelligence over centralized data duplication. John Holtquist from Google Threat Intelligence explores how AI accelerates threat actor capabilities, particularly in ICS environments, and the need for faster patching and automated vulnerability remediation. The episode also previews upcoming Black Hat interviews on securing the data layer, workload identity, and runtime authorization for AI agents.
Topics discussed
Episode intro: Dan Mechum and Black Hat interviews
Announcement: Attack Surface Management Summit
Dan Mechum intro: Legendary Entertainment background
Casual chat: Godzilla and film production details
Film industry secrecy vs. marketing needs
Shift from physical reels to digital content
Legendary's cloud-first history since 2005
Localization, AI innovation, and industry roots
User behavior analytics and 15-year data retention
Ad: Horizon 3 Node 0 autonomous hacking platform
Machine learning for access anomaly detection
AI agents correlating file and email activity
Challenges with cross-platform data summarization
Swivel-chair problem: fetching enrichment from vendors
Platformization: inward vs. outward focus
Analogy: Security teams vs. HR departments
Distributed vs. centralized AI models in security
Evolution of email security to contextual awareness
AI agents accessing non-security data (finance)
Detecting subtle anomalies in security operations
Recap of analyst days and industry speculation
Treating each film production as a standalone company
Film industry driving market innovation (CAPTCHA)
Closing Legendary segment and next episode preview
John Holtquist: AI-driven solutions for AI challenges
ICS background: Mechanical contracting and BACnet
Under-resourced OT environments vs. state actors
Speed of threat actors: patching to exploitation
AI in ICS: Code-native and stack-level differences
Complexity of ICS languages and manufacturer expertise
Building threat intelligence systems and underground intel
Project Big Sleep: Early AI vulnerability discovery
Security teams brought in late in the process
Predicting challenges vs. unexpected DefCon attacks
AI expanding exploitability of existing holes
Multi-model approach for cost-effective defense
Ad: Sonrai Cloud Permissions Firewall
Ronan Murphy: Identity as the new perimeter
Shift from closed to open-source AI models
Proliferation of non-human identities and agents
Data value definitions and AI co-pilot access
Data as water: Exponential growth and alpha
Challenges: Discovering, classifying, and risking data
Shadow AI and unsanctioned AI risks
Building runbooks for safe AI adoption
Not all data is created equal: Value tiers
Metaphor: Data assets as a menu (appetizer to dessert)
Identifying most valuable data assets by industry
Why 'no' doesn't work: Business pressure on CSOs
Defining red-line data assets for AI ingestion
Controlling ingress/egress and policy alignment
Ad: Octo AI Agent Security Platform
Black Hat experience: Hershey's and decompressing
Keyfactor: Trust infrastructure for AI identities
Identity validation for new employees and agents
PKI and certificate-based identity for workloads
Root of trust and verification for agent certificates
Post-quantum cryptography (PQC) migration
AI agents attacking cryptographic algorithms
Timeline for quantum threats: 2029-2030
Prioritizing PQC migration by business value
Dynamic credentials and short-lived tokens
Human vs. machine understanding of 'should'
Continuous business mindset for security governance
Closing Keyfactor segment and Black Hat coverage link
Frank Vukovitz intro: Delinea and AI agents
Runtime authorization for specific AI agent actions
Proving authorization regardless of tool or protocol
Controlling token costs via action-level checks
Tying agents to identities for accountability
Anthropomorphizing agents vs. daemon reality
Preventative controls for 24/7 agent volume
Just-in-time credentials for agent tasks
Visibility of agents via MCP servers vs. direct
The 'silver bullet' fallacy of MCP gateways
CSO perspective: Securing data via identity
AI governance and identity security survey results
Machine identities vs. human identities
Listen ad-free on Castria