Every building you enter has a fire protection concept, fire doors, smoke detectors, an evacuation plan, or even a fire marshal. Nobody expects a fire, of course, but nobody wants to use the building without being prepared for one. Hello and welcome to The CISO Perspectives. I'm Berthold Kerl of KuppingerCole.
Today, our episode will talk about AI governance and why it may have more in common with fire protection than with compliance. And my guest today is Frank Fischer, Group CISO of DHL Group.
Frank, great to have you with us. Thank you for having me.
Frank, you work in security and you are obviously not a professional firefighter. How did you get into security? Perhaps our audience is probably very interested in understanding that.
Yeah, happily sharing that. Obviously, I didn't study it, right? Because at the time I started, there was no study like that. It was more accidental than nature. In practice, I was part of Tivoli's engineering team for a while and had the duty or the pleasure to be a product manager for integration of a monitoring solution. And in that context, I stumbled over Tivoli Identity Manager 1.0. It was back at the end of the 90s and that paved my way to security. And from there on, evolution after evolution came and went, but identity was always one of the pillars I worked around.
So I probably have a bit of a bias. I've seen a lot of large identity implementations at customers and companies I've been responsible for as a CISO. And so little by little and over the years, all the other cybersecurity disciplines were added from sales, from engineering, and eventually also from a consulting perspective, going through the years Tivoli, IBM, Accenture, Deutsche Börse, Deutsche Bahn, and then eventually DHL Group.
In a conversation I recently had, I outed myself as someone working in cybersecurity and my counterpart was puzzled because he had that other picture in mind of a young nerd with a baseball cap, but obviously not someone like me. Have you been a former hacker and do you have to be one to do this job?
Yeah, every one of us has been a bit on the offensive side for a while. That's at least my conviction. And it's important to have at least some grounding in tech to understand what needs to be done and where the limitations are. So I've done a little bit of pentesting in my life, working intensively in one of my last jobs with red teams, external and internal, and continue doing that, but not in an active role.
But clearly it was enough to understand the discipline, OSCP certifications done by other people, and eventually also understanding what's the typical approach to make a red team successful. But I guess being a CISO in a 600,000 people company is a lot more than just technology.
Yeah, probably I can shed a little bit of light on that one. I have a situation which potentially is a little special because I report into the CEO and he gives you a bit of a stronger business perspective than usual. So his steer often is we need to find a middle ground between what needs to be done and what we are capable of doing. And clearly it's a risk balancing activity.
Also, you end up doing jobs that reach well beyond cyber because you also try to understand what is the underpinning infrastructure needs. So how does a proper setup has to be structured across the organization from the, let's say, very low network layer all the way up to applications, including AI, right? How do we deal with change? Because a lot of what we do is related to change, changing not just technology, but changing the way we deal with security. And just out of the last couple of years, it's also evident that the speed of change is increasing.
So the teams need to adapt much more quickly because that's one of the efforts we have across the group. So sometimes it's also a big task in people development. How do you create skills forward looking for future changes yet to come? So we have more changes that are lining up. We need to get prepared. So that's kind of preparedness is the one side. So that's the people side. And then clearly always still the technology to a certain degree. How do you wrap technology and meaningful processes so it becomes sustainable? Because we all love tech.
And let's say at least the organizations I've worked with in the past, there were a lot of nerds who love to get the next cool gadget. But it's a lot harder to really put sustainable processes in place. So that's always the bigger ticket to deal with, not even talking about potential cultural changes. Thank you for these insights. In my intro, I mentioned that we want to talk about AI governance today. And you described AI governance as fire protection. Why this image and not something else like, I don't know, guardrails or compliance, etc.?
Yeah, I guess the other patterns are way too overused. We keep on using them and people get tired of it. So you sometimes have a better interaction if you choose an analogy everybody's familiar with, right? Because fire is around ever since people grew up from, let's say, the hunters and collectors state. And ever since people had to deal with fire hazards. So it became almost a DNA to deal with fire properly.
Lately, I believe everybody has been exposed to some degree of fire protection. So everybody can relate to it. And I guess that's always the beauty of using an analogy everybody's familiar with. Fire protection usually starts with building codes, meaning regulation and compartments or segmentation that stop a fire from spreading. What is the AI equivalent for that? I approach it slightly differently. So when you think about fire protection, you talk about fire loads and how fire gets ignited.
There's certainly lately a lot of climate-related topics that are dealing with special terrain or new materials, like think batteries that can't be extinguished the normal way. And very often you talk about access or escape paths, as we've seen from the wildfires. It could change quite quickly when wind directions are changing. And propagation paths are interesting. So if you translate that to AI, you see certainly similar issues. So when we think about AI, you also have ignition, which could be shadow AI that looms somewhere in the back. We have new capabilities.
We probably don't fully harness a lot to fire. And it's also a question of propagation. So as long as it's small, it can be easily contained. But once it starts spreading, maybe even invisible and then blows up at some stage, that becomes a problem. And we have fire loads in the ground. So when you think about the forest fires we've experienced, a lot of them happened in places where legacy ammunition was buried in the ground and people just conveniently declared it a natural preserve. But the fire actually ignited it.
So your equivalent to ammunition in the ground is a legacy IT that hasn't been treated for years and all of a sudden gets exposed to AI and with all vulnerability scans and blows up. So you have similarities. So when we think about the risk challenges, I'd say in both environments, you have underestimated situations. Traditional containments fail, right? So we often need to develop new techniques to contain the problem. We are often exposed to a lack of skills and capacity. So we can't get enough people with the right skills in place to respond to the risks.
And very often you get too many concurrent threats, right? Look at the vulnerability flood that is now being generated by the frontier AI model. So first responders are generally overgrown. So we have first responders on both sides. They need to somehow cope with that flood and that volume, which is almost exponential. And we have always a trade-off between short-term fix and sustainable improvement. So I guess those items are quite comparable. Let me try to structure the problem a little bit.
First, you need to do something as a precaution to make sure that the fire disaster does not occur. You need the capability to detect if something is going on. And of course, if in the worst case scenario, a disaster happened, what do you do then? So let's start with the first one. So what are your recommendations in terms of precaution? I guess it starts with a lot of transparency, right? So what's going on in my organization? Where do we use AI in whichever shape or form? It's incredibly important to get clarity about where we use it and which use cases are tapping into critical systems.
When we think about criticality, we often define it by three key items. One is, do I touch a system of record, right? Specifically in right axis, because that often is critical for both operation and resilience of my organization.
Second, what is the external communication link or links multiple? That often determines what information gets exchanged and what the data plane might expose to other third parties, which probably requires protection. And then last but not least, the human in the loop, right? So how much do I have in these systems, right? Am I in a position? Have I gained enough experience to allow more autonomy, right? That is often something that needs to develop over time. So we need to gain experience.
However, the whole thing develops very quickly. So speed is of essence. So we very often have to get our hands dirty to really understand the full dimension of what can and cannot be done, right? And then we need to allow for uncertainties because nobody has all the answers yet, right? Think about how do we deal with zero-day vulnerabilities that are popping up everywhere in the market while I have limited capacity to mitigate it because of operational restrictions. So all those items, they call for almost real-time situational awareness.
So I need to have a fairly well-defined, maybe AI-supported way of detecting and monitoring AI processes. Then something, I guess, which is close to our both hearts is how do we enforce agentic identities to be linked to a human? How do we recognize agents across the board? How do we register and lifecycle them? How do we understand what they're supposed to do and where they have restrictions? How do we define risk-based AI-level access to systems of record, but also to other important data fields or data lakes?
And I see very often that through managing access, you can cope a lot better with the degree of freedom an agent has or agentic in general than if you would just try to use traditional paradigms, right? So access is quite critical. So the access perimeter is even more important with non-human identities, namely agents that feel like a human. And then not to forget, we'd need security enhancements in the development lifecycle.
So when you have a DevOps-style approach that obviously layers into machine learning, AI development, every flavor of use case probably can benefit from what we So we need to have new ways of determining the context layer, the model layer, the interaction layer, everything that's coming on top in an agentic world, right? Specifically, the interaction with other systems and different modes of operation. And even more if you've got swarms of agents that work with each other to achieve a certain goal. And then clearly from a defense perspective, I see no substitute to add AI to defense mechanisms.
We need to look at the perimeter much differently than we did in the past, more from an attacker's perspective, right? So attack surface management, also focused response is necessary to really cope with the explosive growth of vulnerabilities, right? We can't just respond in a linear fashion to an exponential problem. So just to use the analogy further, a fire usually starts small with a space heater or a candle. So how do you notice when AI usage starts somewhere in your organization, for example, as a shadow AI or an agent built by business units without security sign-off, etc.?
Well, you approach it from different angles. One is certainly a governance angle that's by no means adequate because those items are moving way too fast. So we are deploying technology to understand where AI gets deployed, both using clouds but also local. So all aspects of AI deployment are in scope for that. So shadow AI detection is certainly one key item we're pursuing. We are also enabling the development teams, the ones that create, let's say, AI agents, enchanting context environments, right, where we want to leverage our own industry expertise.
That means how do you protect that IP properly? How do we help people to protect that? Because you don't want to have that leaking to, let's say, your next competitor, right? That's absolutely credible. So there's more IP to be considered than just code, right? There's also procedures and processes that come to bear. And then clearly monitoring, right? So how do we have a general conduit that everything what do, let's say, standardizing on certain platforms, standardizing certain processes as much as we can while we need to support division of flavors. But there's a common ground.
So you come up with a reference architecture, you come up with reference processes because what you'd like to avoid is to reinvent the wheel or if you flip it on the contrary, you want to encourage reuse of, let's say, sound and secure solutions. And a lot of that is by design. So we want to have security mechanisms and not building them in our development environments, but also in our runtime environments. So protecting both the development lifecycle as well as the runtime is the other areas that get a lot of attention right now. Yeah.
So fire protection exists so that people can actually safely use buildings and not to keep them out or keep the building empty. So how do you make sure that AI governance is not being a blocker, but enables the business instead of becoming in what they need to do, right? At the end of the day, we all have to use AI, but we have to use it safely. I think that is the trick. Yeah. I prefer to say responsible. We have to use it responsible. And the trick's really to allow for a lot of innovation in certain environments.
So you want to have sandboxes where people can really play around and explore new ways of thinking, which is certainly more with surrogate data or, let's say, confined sandbox environments, not touching into production. That gives people the opportunity to explore technology, explore new mechanisms, leverage existing items, but equally also distinguish between where does AI make sense and where do other mechanisms still have their right to be. So there's still RPI, there's still other degrees of automation. Deterministic in nature, of course.
So AI has its strength where things become unstructured or undeterministic, because that's where we need to combine multiple technologies for the benefit of the business. The other part is really look through the lens of the business, but equally try to define what is a value to our organization. So how do we define value? Recognizing risk is, or risk mitigation is a value, but there are other items. Can we scale an AI mechanism nicely across the organization? Can we reuse it in different contexts? So the broader reuse, the broader and the more effective the development efforts.
We have a whole field where we are not developing, where the entire SaaS agents, as you know. So vendors, third party and supply chain challenges we need to deal with, because those agents come with their own context, they come with their own abilities. They interface with us through MCP service. So we all of a sudden have a new structure of interfacing with the companies because the customers want to do that. They bring agentic activity and they want to interface with your agentic environment.
So there's a new way of interaction where we have to be conscious of what is the new way of transferring or interacting on critical data. So that's evolutionary, but fire protection is basically an intrinsic mechanism. So what we try to do is really to build the guardrails into the platforms, have standardized platforms and discourage people from using non-standardized platform and encouraging reuse. So if I have an approved solution and I start reusing that, the pathway to sign off is much quicker.
So the benefit for the business, leveraging building blocks that have been approved, so Lego principle is beneficial to them because it actually fast tracks the way the pathway to production. So it's more of an enabling function. And honestly, we wrestled with that question, right? Do we choke it or enable it? And we felt enabling is a better value proposition and it's more favorable for people to look into security as an enabler of speed, rather than something that chokes you and just tries to limit your innovation. So we're caught in that spectrum, in that tension field, right?
So we want to have a lot of innovation and fast track solutions, which are scaling properly across the organization. On the other hand, we want to protect the downside in an adequate fashion. And so allowing for certain degrees of freedom as a calculated risk, but clearly the more risk you bear, the more assessment and more implementation. If you identify something which is suspicious or let's say above your risk tolerance, do you have the authority to pull the plug on an AI system?
Yeah, we implemented that. And together with the CIOs who will have the eventual sign off, we clearly defined quality gates before built and before introduction and production where we can legitimately pull the plug. There might be reasons for that, either when it violates regulation, there are certain risk types that are tolerable. So we need to be able to, let's say, put them back to the drawing board. So people need to figure out how do we mitigate the challenges we have here, right?
And again, it's more to helping Hank to figure out how could we heal that in a way that the risks will be tolerable rather than just killing it. But in some cases, things just have to die because they're not manageable or it can't be fixed.
Now, last question or perhaps last analogy. Every large building has a fire marshal and an evacuation plan and also regular drills. Do we need something similar in the era of AI? And how is this different to what we normally do in the context of BCM?
Yeah, I guess BCM is, no offense intended, still pretty static in nature. I mean, obviously you adjust it, but think about how often do you rework your BCM plans? That's maybe on an annual basis. But this is much faster, right? So we need to be much more adaptive. We need to be much more agile in both how do we develop, but also how do we protect the environment. So we need to make sure that the speed of adaptation to fire hazards is at least as quick as the development speed. So resiliency and BCM procedures in an AI world have to be much faster than we've done it in the past.
And that means even those procedures require a certain degree of AI adjustment, not necessarily in its execution, because that's still deterministic. And I guess that's when the twist comes together, right? You want to have a high degree of adaptation using AI, but once it's clear in which direction you run, you need to have a certain degree of deterministic abilities. So we will combine both of those items to actually properly catch, let's say, AI fire before it starts spreading. And clearly, I mean, there are some basics, you need to continue to work on the basics.
So one example, you have to have a reasonable structured network. So even if fire gets ignited in one of the compartments, it doesn't spread to the entire organization. So you can still contain it within one of the fire compartments. So the fire compartmentalization is certainly a principle that we have to apply also because not all the important.
Yeah, thank you for your insights and also for this really interesting and unusual analogy with firefighting and fire protection. I think that makes a lot of sense and was fun to discuss as well. Now in the last couple of minutes, I'll fire some short questions to you and hoping for short and spontaneous answers. The questions will usually be sometimes serious, sometimes a little bit funny, sometimes even personal. So let's see. And I'm curious on your answers.
First one, more or less attention, one cybersecurity topic that gets more attention than it deserves. Yeah, I'd say automated socks. Okay. And one that deserves more? Absolutely vulnerability and patch management. Or let's say vulnerability management, which is not only patching, right? Password ban, which cybersecurity password would you ban forever? 1234567. Smoldering, which AI risk is still smoldering today before anyone sees the flames? I believe the intelligence we will see from agents, right? In an autonomous fashion, right? Operating visibly or invisibly is greatly underestimated.
I guess we will see agents that can re-transcribe themselves to other platforms. And I guess that's a big risk we haven't seen yet. Detect or respond. Where would your next euro go? Data detection or a rehearsed response? Rehearsed response, because the one is more on the paper side. The other one is the real action. And you only know if things work, if they have been tried operationally. So I definitely vote for response. Also in our DNA. Personal question. What was your very first job and what did it teach you?
I've been a database administrator and had to deal with, let's say, partially immature database software. And it told you really to be conscious of the operational impact of what you're doing. So touching the systems in the wrong fashion either gets you unexpected overtime because you have to fix it. So you get very sensitive and very careful about and organized what you do on a low system level. And you organize yourself for more automation. So without automation, you're dead. Now the next question is a standard question, which I always ask.
Your advice to someone starting a security career today? Understand the business and figure out how security can be a benefit to people in the business. And sell through value. Make sure security is seen as a value, not as a threat. Last question. What helps you switch off after a long day in the office? I do some sporting activities and they both demand absolute focus because otherwise you get immediate negative feedback and one is dancing with a partner and the other one is writing.
Thank you, Frank, for your spontaneous answers. I think today we heard a lot about AI governance and how it relates to fire protection. And there's actually a lot of analogy. So at the end of the day, it's actually, let's say, hard and disciplined management at the end of the day. It's no magic. That's what I heard. And I think we have to pay attention to that topic more and more, especially when more agents come around, including all the NHIs, etc. So there's more to come, but it was a very good discussion.
So Frank, thank you very much. It was a real pleasure to talk to you.
And yes, thank you all for watching the CISO Perspective. We'll be back soon with our next episode. Until then, have a good and safe time.
Thank you, Bert.
