Cybersecurity expert warns AI is making online threats harder to spot

9.14 on your Sunday night. This is Weekend Live. Jim Locke alongside Kaylin Norwood here on a Sunday night. It is Cybersecurity Awareness Month. Happy Cybersecurity Awareness Month to you. I mean, it's a huge issue, right? It's a major issue. Something that does need to be talked about, and now people bring awareness to it, right? Yeah. We're going to talk about ways to keep yourself safe and some other big topics happening nationwide. Let's bring in Bob Costello. He is with Merlin Group. He is their chief information officer. Bob, by the way, you come with some bona fides here because you were formerly with CISA, the Cybersecurity Infrastructure Security Agency, as their CIO. Welcome to Weekend Live. It's good to see you tonight. Thanks for having me tonight, Jim. We appreciate it. All right, let's talk about it. This is something that comes up every year. It takes shape in many ways, shapes, and forms. And this is something that every year, almost by the day, we hear of new threats impacting whether it's us, whether it's our workplace, whether it's our computer, whether it's our phone. And I imagine on the professional end of things, it can be a challenge sometimes keeping up with everything. And if it's tough on your end, it's tough on everybody. Yeah, I absolutely could not agree more. I think on that subject, you know, there are simple things that I think people can do to protect themselves. Things like multi-factor authorization on your banking apps or on your devices, updating your software and devices regularly, and using things like a password manager. But I definitely agree the world is changing very rapidly right now, and it can be hard for even those of us in the cybersecurity profession to keep up. And I know a big concern for a lot of folks right now is AI and just how rapidly things are changing. So how is the speed and growth of AI impacting what you're seeing every day? In my professional life, we're seeing vulnerabilities in software devices discovered a lot faster due to the usage of AI. I think for the vast majority of Americans, what you're seeing now is those phishing emails that you receive. They're a lot more they're a lot better constructed now. We are even seeing AI be used to simulate people's voices. So we're seeing it used in a lot of different ways. But we're also starting to employ it to protect our systems as well. A lot of that is kind of learning on there and learning from how the cyber crooks are trying to get ahead. Are these domestic threats or the international threats? Where where's the bulk of these coming from? Well, I think you're kind of seeing it all over. I mean, we saw just this week, you know, France had a pretty severe cyber attack that affected refrigeration units in their supermarkets. And you can just imagine going to the supermarket and seeing, you know, tons of food just having to be disposed of because the refrigeration units had been, you know, changed so that they were essentially heating up over here in the states where we're seeing it as well. The operator of giant supermarkets this week also had a cybersecurity incident that affected their mobile apps and, you know, online ordering. Luckily, it didn't affect their physical stores. And I think we're seeing activity both from, you know, foreign adversaries as well as some homegrown cyber hackers as well. When you were talking about password managers and the tools that we have accessible to us, you know, every now and then I go through, I take a look, you know, whether I get a reminder to change a password, and I go through my password manager. And it's astounding to see how many places I've saved my information, I've logged into, I've tried to be good with pass keys, I've tried to be good with two-factor authentication. But it's amazing where you make one wrong mistake, you give your information to one wrong source, that could change everything. Yeah, absolutely. And, you know, I wish I could say I was any different. There's days that I'm going through the same thing that you are, trying to, you know, get into, you know, one of my accounts and changing the password. I do think it's really important to highlight some of the things that you just mentioned, things like pass keys or even using a password manager. PassKeys can actually make it a lot easier once they're implemented on your applications to log in, whether it's your banking app or, say, something for, you know, seeking care through a medical provider. One thing I do encourage people, you know, technology can be frustrating and changing all the time. There's nothing wrong with calling your bank or visiting a branch and asking for help for the most secure way that you can configure your mobile device or your banking app. to log into. You know, this has been something that's been very interesting, I think, for even leaders and businesses, small businesses, to really get through this dynamic and the ever-changing challenges that come with, you know, we were talking about AI earlier. I mean, what is your message to leaders in this new age as they try to prevent some of these cybersecurity incidents from happening? Well, I think it can be twofold. From a lot of the large companies, particularly manufacturers of software or information technology devices. You know, when I was back at Cisco, we did encourage them to produce more secure software and make sure that it's hardened before it shipped. It shouldn't take more effort to make something secure than it takes to make it more insecure. I think for small and medium-sized businesses, you know, I'm a big advocate of the small businesses out here for America, and most businesses are small businesses. I think agencies like my former agency, CESA, have good guidance around how you can secure your systems. And then working sometimes with a managed service provider that can manage your IT for you and secure it if you do not have the resources or the expertise to do that yourself. That in and of itself is a critical and fast-growing sector of the industry. Absolutely. I think we're seeing that more and more. And we're also seeing, and I think, you know, what we were talking about earlier, whether it's in France or here, technology affects everything in our life. We're using it all day long. You can't ride the metro anymore, you know, without employing some form of technology. So I think what we're seeing is as businesses are deploying, whether it's AI or modernizing their services, you know, the doctor's offices that are rolling out electronic health records, We're going to see an increased growth of the the systems that we utilize every day and as well as the exposure when something goes wrong. I don't think there's any American who hasn't received a letter or an email, you know, saying that their personal data was lost in a cyber incident. It seems like we're getting those, you know, almost on a daily, if not weekly basis. You know, when you mention health health records, it's an important question that I wanted to ask, because, you know, I think we we have a cursory knowledge or we know fairly well how to keep our information safe here. These are conversations, though, as our parents, our parents, our grandparents get into not just social media, but they're finding themselves not being forced, but using a lot of these apps, ways to keep tabs on their health as well. What kind of conversations? Because I know we've talked all the time about parents have a conversation with their kids about being safe online, but it has to work the other way as well these days. Yeah, absolutely. I mean, you know, my parents are quite active in their 80s, and it's something that we have to discuss. You know, in one case, it was, you know, I encouraged them, go to your bank, they'll help show you how to set up the app. But it does take a lot of conversations. And I do think there are some services out there where you can help, you know, monitor your family members, which I think is very important. We have to have an understanding of, you know, what our parents and children are doing in cyberspace. But it's absolutely an increasing issue because more and more often now you can't even schedule an appointment without going through some form of technology. And obviously, that can be very challenging for not just seniors at times. You know, I'm curious, too, as we're seeing this change in our society, it seems like cybersecurity has obviously become way more important and more focused on just in the last few years. Where do you see this industry going in the next five? Yeah. Oh, wow. Next five years. I think right now, you know, one of the areas I'm concentrating on, we're definitely seeing an increase right now in vulnerabilities being discovered by artificial intelligence. I think the other area that I'm seeing is we're all kind of becoming a little bit of cybersecurity professionals. So you're seeing more and more companies invest in their cybersecurity posture. And I think, unfortunately, like the events in France that we saw, that is going to have an effect on that industry, because if that were to happen with a regular, you know, in a regular periodic manner, those supermarkets would no longer be in business and nor were those food manufacturers. So I think that you're starting to see now cybersecurity be taken much more seriously across many industries. With your experience with CISA, and now that you're in the private sector, I know governments across the country, maybe not necessarily on the federal level, but on the state level, it's a hodgepodge of systems. Often when you go state to state and taking care of all sorts of sensitive information out there. So when you look at the state level, how well equipped are our local and state governments as they evolve and as they find ways to keep the information of state business and taxpayers safe? Sure. And I would say, unfortunately, it is not homogenous. We have some very well-resourced states and localities and others with almost no resources. And we saw earlier this summer attacks on the water sector in parts of the country, and often those particular sectors do not have money to invest in cybersecurity. And that's where I think it is important for services like that CISA provides for free to state and local territorial and tribal governments, as well as looking at grant programs that can be used to fortify cyber defenses in those areas. But there is definitely a need across the country to provide better cybersecurity for the nation's critical infrastructure. You were mentioning that there was Minnesota where we had water, water, water services, water systems interrupted there by a cyber attack and something. Again, I think it seemed almost fanciful when we were looking at movies in the 80s and 90s where hackers get into the water supply. How is that possible? And then you realize how online those systems truly are, more so than I think a lot of us who aren't involved with the system really know. Yeah, absolutely. I mean, we've seen an explosion in devices being connected to the Internet. Often they're called control systems. You know, going back to France or some of these others, they're connected and they have like default passwords on them or no passwords. Yeah, and they're very easy to get into. They also have very long life cycles, sometimes 10, 20, 30 years. So you can imagine something that's, you know, been connected up to the Internet, you know, from based on technology from 20 or 30 years ago. It just does not have the capabilities to defend against today's modern threats. But it is why we do encourage, you know, change default passwords. And there are things you can do to protect older legacy systems. We have to head out very shortly here, Bob, but I just wanted to ask you last thing. Let's say somebody is watching this. They wake up tomorrow morning. They see $2,000 or $3,000 gone from their bank account. What's the first call you make? I think the first call you make is to your bank. Uh, you know, I think that is, you know, the, the, the one important thing, uh, and, you know, going back to when we were talking earlier about how phishing emails or text messages look very real now, uh, it's important to do your best to remain calm because a lot of those messages that lead to those types of issues, uh, you know, people losing money are because they come with a strong sense of urgency. So you need to, to read it. Don't call the number that comes in on the email you know call the bank number on the back of your card or that you get from their website and confirm that these things are real uh before you take action that's that's usually the first the earliest signs that we've been hacked or our information has been compromised is almost the moment that it's too late and that's that's absolutely that seems to be the the catch 22 there is that sometimes it almost seems too late but i had a friend who she was in that situation just last week bob we were getting ready we were going to a hockey game and she looks at her bank accountant realizes she was hacked thankfully thankfully called the bank and they took care of it for but you know you panic in a moment like that you wonder where you go from there and these are all important tips and hopefully you know we're taking notes but hopefully those watching are also taking notes it sounds like bob is going to be in high demand bob costello from the merlin group bob we really appreciated you and your colleagues uh always helping us out here on fox 5 it's good to see you tonight thanks for having me tonight our pleasure