AI is changing everything. From changing how citizens interact with agencies through omnichannel contact centers to the rapid advancement of digital twin technology for mission-critical activities, wherever there is AI, innovation is sure to follow. Except for perhaps cybersecurity, where AI practitioners are doubling down on fundamentals and best practices, as well as adapting to change.
This message of focusing on fundamentals and best practices while adapting to change was the core message of a recent conversation between Cheri Pascoe, Director of the National Cybersecurity Center of Excellence at NIST, Kynan Carver, Vice President, Cybersecurity at Maximus, and Sarah Sybert, Managing Editor of Gov CIO Media and Research.
The lively conversation explores both the impact of AI on cyberdefenses as well as the offensive activities, such as threat tracking and research that agencies must undertake to protect networks, systems, data, and the national interest. The most obvious way in which AI is changing cybersecurity is in the novel risks that it can introduce. Pascoe explained that some of the largest impacts of AI on cybersecurity come from new Zero Day attacks and emerging threats, unforeseen supply chain vulnerabilities, the rapid sophistication of identity access and management threats such as spoofing and deep fakes, and the introduction of agentic AI and its ability to self-authenticate. On the other side of the ledger, Carver noted that AI is also creating opportunities for enhancing cybersecurity, improving compliance, governance, threat detection, reducing alert fatigue, and facilitating secure software development.
Despite these new challenges and opportunities created by AI, Pascoe and Carver were eager to share that traditional cybersecurity fundamentals still matter and, in many ways, remain the frontlines of defense for federal agencies. Pascoe, who is leading the revision of the NIST Cybersecurity Framework, to create a 2.0 version that reflects our rapidly changing technology environment, explained the current NIST perspective. “I still believe that traditional cybersecurity standards are still valuable, and they’re applicable here … There is a lot of guidance in the cybersecurity space … the NIST Cybersecurity Framework 853 … they all enable agencies to think strategically and make informed decisions from foundational cybersecurity frameworks.” Added Carver, “[With] Zero Trust we were pivoting … to a proactive defense posture … and the standards that NIST is producing will help us achieve that … good cyber hygiene, good cyber practices are still fundamental and necessary to prosecute the operation and also maintain standardization across the federal government as these technologies are fully implemented.”
With many federal agencies at the beginning of their AI use case evaluation and implementation journey, this advice from Pascoe and Carver is prescient. By doubling down on the best practices and enduring guidance provided by NIST and the requirements of the Zero Trust mandate agencies can move forward and embrace AI with confidence.
To learn more about how AI is changing – and not changing – cybersecurity, click here.