Ep 18: AI & Human Error: How Technology Secures the Future with MGM Resorts International SVP & CISO Stephen Harrison

‍Evan: Hi there and welcome to Enterprise Software Defenders, a show that highlights how enterprise security leaders are using innovative technologies to stop the most sophisticated cyber attacks. In each episode, fortune 500 CISOs share how the threat landscape has changed due to the cloud real-world examples of modern attacks in the role AI can play in the future of cybersecurity. I'm Evan Reiser, the CEO and founder of Abnormal Security

‍Mike: And I’m Mike Britton, the CISO of Abnormal Security

Today on the show, we're bringing you a conversation with Stephen Harrison, Chief Information Security Officer at MGM Resorts International.

MGM Resorts International is a global hospitality and entertainment leader, operating some of the most iconic destinations in Las Vegas and beyond. MGM boasts an annual revenue of over $16 billion and employs more than 70,000 people worldwide. 

In this conversation, Stephen explores cybersecurity complexities in the entertainment sector, the deployment of AI – in both safeguarding systems and enhancing attack methods, and the escalation of automated exploits targeting human error.

‍Evan: Do you mind giving us a little background about kind of your career, kind of what you do today and how you got there? 

Stephen: So I'm the chief information security officer for MGM resorts international. And sometimes when I say that people think immediately of like the MGM grant, but the corporation owns, I think about 48 percent of the Las Vegas strip and they have like golf courses, sports arenas, restaurants, entertainment venues. We have like sport joint ventures and sports betting and iGaming and things, things around the globe we've been investing in growing in it's a, it's probably the most diverse company I've, I've worked in. 

I did some stuff for Adidas, uh, doing cyber for North and South America before here. LabCorp Global Holdings was a good one, out of North Carolina. Chobani, they're the yogurt company and stuff. Uh, I, I've done some pen testing and infrastructure work in my past, but I've been employed in tech for about 18 years almost, so it's, uh, it's been fantastic. 

Evan: Was there a moment in your career where you said, okay, like, you know, cybersecurity, information security, this is, this is what I want to do. 

Stephen: Yeah, I had met some pen testers at the Veris group a long time ago, and I've been doing like infrastructure work, which is admirable work. I mean, uh, the network infrastructure engineering is it's, uh, it's become this complex thing from SD-WAN and like, uh, if you think cloud based routing and, and just at a place like MGM resorts, you think about one of our properties, there might be thousands of switches in one property and, and just to orchestrate network objects and manage that at scale, that is a, a Herculean effort. 

But I'd always been, I don't know, maybe mischievous in my youth, and so when I learned about pen testing and things like this, it really stood out to me as like an opportunity to, to chase that sort of mischievous nature early on in my career. And then, as one does, you find out it's very easy to point out problems, it's a lot harder to solve them. 

And so, I still admire red teamers. I mean, reverse engineering malware, like, finding creative ways to, to point out flaws and attack vectors that threat actors will use, but on, on the blue team and program management side, it is so much more challenging, and I love the challenge.

Evan: You talked about, um, MGM's mission to entertain the human race, right? And you also mentioned, you know, one of the important roles to kind of reduce friction in that process. Sometimes reducing friction comes at the cost of, you know, security. 

I remember one of the, you know, anecdotes you shared with me in the past, um, and forgive me if I'm misremembering here, but you said, hey, on one hand, we're trying to make sure that anytime someone steps in MGM resorts, they have easy, instant access to wifi. At the same time, we also host conventions for like the hackers, right? And so there's some kind of tension there. 

Like, do you mind sharing just like some of the unique challenges that MGM has that maybe some of the outsiders may not fully appreciate.

Stephen: Yeah. If you think about this, Black Hat, DEF CON, B Sides, these all are wonderful programs that spawned out of Las Vegas. Which is, I guess, what's appealing about Las Vegas, as a professional here. And DEF CON has obviously grown and Black Hat has grown to international offerings, and B Sides has become this community framework across the country, right? I think actually across the globe at this point. 

These conventions all coming to Vegas bring interesting challenges and, uh, And it's not solved just by one, one resort or company, but mainly the community. And so a lot of, uh, my counterparts, Homeland Security, FBI, everyone will sort of come together during this fun week to, to ensure that everyone who's coming in, I don't, I don't actually think people are coming in with a lot of like malintent in their, their day to day, but there's, it is fun to, to go and, and get with your friends and, and. I think to back like when the TV killer came out and, this is an old IR device, infrared device, that was, uh, an innovation a long time ago and it would spam the universal remote code to turn off televisions. 

Could you imagine this, uh, sort of havoc it would wreak? Reap across like sports books or restaurants with digital menus or things like this, just as an example of like the mischief, uh, nature that, that comes here are trying to sabotage elevators or, I mean, Defcon is really the originating conference here, and there's so much passion for technology that comes to town and it does bring challenges that, that really we're focused on, like I said, protecting that experience that includes protecting hackers from themselves. 

So, so if you think about, uh, these groups of professionals coming in, Testing, learning about new things, we have to have fantastic logical separation of those event spaces and those networks so that it doesn't interact or impede core function for the services we provide. And, and really that's, I mean, zero trust is sort of a, a big deal. Another one of these buzzwords like enabled by AI, but it's really that sort of strategy of segmenting out your network with a zero trust hierarchy. So, so we're empowering that experience.

And I mean, last year the sphere was like offering a bounty for like whoever could hack it or, or something like this. And if you haven't seen the sphere in Las Vegas, this gigantic digital display, powered by like millions of dollars of Nvidia technology, . And it is a site.

Evan: LEDs. Yeah, it's crazy. 

Stephen: It's a site to see but, as a digital target, these things stand out. The digital signs across properties, and if you're looking for some sort of, um, social media clout or farming as a, as a hacker, a red teamer, they almost become like too tempting to ignore. So, so those are some of the challenges we face.

If you think about the digital experience in your day to day life, checking into your hotel, your digital key app, your, the ATMs, loyalty experiences, these are across most of the hospitality space in Vegas. And that footprint is, is also again, this time of year, a very fun, tantalizing target. And so, it's sort of a love hate relationship with it.

The team absolutely loves coming out and working on this. We have a lot of collaboration. We, we stand up a lot of services to support it. It's a fun time to network and, and learn and innovate and hit your head against the wall and some capture the flag event. But then it's also an interesting time at work where people are standing up new typosquat domains. They're trying to do social engineering attacks. I mean, Vegas is very famous for its physical security and they are fantastic at what they do across Vegas on the physical security side. So it's an interesting dynamic experience every year.

And it's not just Blackhat or Defcon or things like this. We had the Super Bowl here in February, across multiple companies, across multiple properties. We have F1, Formula One race, which was an international, um, I would say success, but I, I mean, it was a Just, just a challenging, interesting event. And, and you think about everything that goes into that from the retail, to commerce, um, business to business sales, room bookings, coordination for, we stood up our own grandstands at Bellagio. If you haven't looked at this, it was a daunting experience. You're standing up infrastructure that's going to live there and be used five days, and this has to facilitate food and beverage, point of sale, retail experiences, wifi and cellular repeaters, and things like this, this infrastructure is taken for granted and to be able to stand it up and secure it in that for such a short period of time is just a challenge I love to come and contribute to every day.

Mike: We've seen, you know, broad adoption of SaaS across most organizations. You see AI and just so much rapid technology advancement. And honestly, I've always felt like, security is always chasing the business on, on protecting things that they're throwing out there faster than, than we can keep up. 

How do you see the threat landscape changing with the technology, that we have today and, and some of the new things like SaaS and AI and CloudNative? 

Stephen: SaaS, the way I would explain it to my mother, think about cable TV and dish satellite or things like this, and, the way it evolved into everyone running their own streaming system. A SaaS is just essentially every company saying we're going to own and operate, and facilitate our own technology stacks, and you'll subscribe to them as a license. And this has created a distributed space.

Traditionally, if you go back, like 2010, we're very centralized across the board in InfoSec programs. And now we're operating in a distributed space. So that means your strategy, your, um, governance, compliance, your identity has to be managed in a distributed model, and so that comes with a lot of challenges at scale, compatibility, and those are all interesting things to solve for. It's good and bad, I guess, in that because you're, if you go all in on a SaaS partner, and in one space or one domain, and then you, you go all in on another, they don't always work together in the best ways.

So there can be competition and overlap. And when you're trying to get them to integrate. It can create challenges, especially if they have competing offers in different spaces and you're, you're picking one offering from each, but not the overlapping offering. I mean, that's just part of the corporate nature of it though.

They have to be incentivized, but that's really the, the better solutions out there are the ones that don't have that ego in their product development, that they'll open up their APIs, they'll integrate agnostically across technology. And I think that's starting there at, at SaaS and cloud. 

Cloud is basically the same thing. It's just, instead of a SaaS software, we're talking about platforms and infrastructure that we don't own anymore. And if you have a multi cloud provider configuration, then you're facing the same compatibility. 

And I think people overlook comparing the two. Build versus buy strategy a lot. Technologists can really just love to build stuff, right? And I'll see companies out there. In my career, when I did consulting or engineering development work or whatever, who really struggled with build versus buy because, as nerds, some of our favorite moments are when we build something ourselves, but it's not necessarily like sustainable, secure, supportable. And so I'm sure you've been in some place where someone built some core infrastructure piece, and that person left and no one knows what to do with that technology anymore. So, the challenges are the same, I think, across those domains, but it's, it's more distributed technology at scale.

If you're lucky enough or fortunate enough to be in a business where you can centralize, that's probably a nice place to be for like sleeping at night. But a lot of your retail, B2B entertainment, the retail hospitalities, the ISAC we're a member of, and all of our peers face similar challenges. Anything that's B2C, right, business to consumer, customers, it has to be scale. And so, yeah, those challenges, I think are primarily around supportability, scalability cost is a huge issue, but that's why you evaluate build versus buy.

Evan: It's hard when like, you know, we're at a rate, we're at a period of time where there's never been faster accReleration of technology. And like, whatever you thought was, you know, cutting edge AI last week. Well, just, you know, check Twitter this week. You're probably wrong, right? It's a new thing.

Stephen: I mean, every innovation that comes out is also empowering threat actors, right? It's not like we're just using it. And in some cases they innovate way faster and I'll, I'll backtrack a little bit. 

At MGM resorts, obviously we're leveraging AI and strategically investing in that space. I think when you envision the customer experience, the guest experience, there's places to digitally enhance that with AI. And that creates interesting challenges on protecting AI from injection model poisoning, feedback, sabotage. There's so many areas. And then you got your whole security and dev sec ops stack to worry about on top of that. You've just complicated it. But On the threat actor side, it's doing so much more.

I was talking with, you guys know Deepen Desai, uh, he's a, he's a great guy. He was talking about like GPT, um, for threat actors. And I was like, well, it's going to be more than that. And we pushed it a little bit farther in the conversation talking about, you know, you have ransomware as a service right now. And I would expect by next year, sometime to see ransomware as a service, uh, evolve and become more of like AI is a service for threat actors. They're going to subscribe with cryptocurrency, and it's going to be not just the send a phishing email, which AI is doing right now, for threat actors, but it's going to be help me discover domains and vulnerabilities and issues with this company. And, and then, uh, why don't you pull the exploit packages for me? And then why don't you stand up a C2 instance for me as well while you're at it, and then, uh, and then let's just go to town. 

You think about ScriptKitties, and we say it in a defamatory fashion when we describe ScriptKitties, someone who doesn't necessarily understand technology all that well, but there's easy opportunities and Google and YouTube, and they can figure out how to do something very simple to cause damage or, or disruption. And the, the risk of what used to be a dismissal script kitty, with what I expect to happen with AI, is going to exacerbate the situation. It's, it's not how much do I need to know anymore.

And, and think about this for a second too. I don't know if you guys look at like these, um, security function AI tools out there for development. AI works on like a bell curve, right? So it takes sampling of the curve and it's taking like this middle section and it's saying like, this is the most code here. But the problem is like, that's all garbage code for the most part, and then it's like all the best functions and clean code and comments are like far down on the right side of that bell curve.

If you look at packages and development that threat actors build, this stuff is clean and concise. The silver bullet AI proxy service out there that they're using for like sneaker bots and for loyalty takeover. This thing will cycle through proxy services automatically. It's like a subscription model. They have community sharing for configs for targeting retail companies out there. These things are so much more sophisticated in DevOps in some places, from like, if I go to like GitHub and I'm looking at like a major companies community repos and the way they're building code. 

So when I think about a GPT as a service for threat actors, or AI as a service, they're going to benefit from higher fidelity functions and codes and, and attacks because it's very concise work. So I, I expect that to be very disruptive. 

Evan: So Stephen, I think like there's a lot of confusion about kind of what are the real worries and kind of the non real worries. Right. And we've all read articles about, you know, someone they put in like the vulnerability or the vulnerability fix patch notes into GPT, whatever. And it spits out like what the exploit was. And, you know, people were talking about, Oh, there's going to be large language models spitting out zero day stuff. Help us tease out like what's kind of fact versus fiction. Like, what are some of the real threats you see today that you worry about? And what are things that are coming around the corner a year out down the road that you think maybe people are underestimating right now? 

Stephen: Right now you're seeing Social engineering and SMS phishing, email phishing, vishing, uh, voice calls. All of these areas are the real time or near, near present day threats where AI is excelling when you can see, like we could, we could take this sample conversation we're having right now. And then, if I know your phone number, Evan, I can spoof your phone number. I can call Mike. Maybe when I know he's busy. I can leave a voicemail with your voice and say, I'm too busy. Don't call me back. Just do these things. And like, if you can do these things for me, as my friend or whatever, I'll catch up with you later. That is a real world threat, I think, but I don't know that there's a stack, or a solution, or a screwdriver to throw at this problem, it's very much a human problem.

I think there's a lot of pressure on the FCC to get better at preventing phone spoofing. How many texts do you get a week right now, from like some offer Amazon delivery, whatever, like, Oh, here's a new job offer, work from home, whatever garbage it is out there. There has to be some, some stronger regulation and oversight, I think, for telcos. So 

Evan: It's crazy. I got three of these today. 

Stephen: Yeah. This is, it's not something security professionals can solve, is my point there. 

Evan: Yeah. There's not good integration points, right? Like you can't like, even if three of us got together, I said, we'll spend, you know, a billion dollars to go build a solution there. There's no API to monitor, you know, iPhone voicemail and stuff like that. So it's a really hard problem to solve. 

Stephen: Yeah, yeah, and they think about like half of emails are like garbage right now and like it from the Verizon breach report that came out and like, it's probably very similar. I think I read it was like over 40 percent for for phone calls or like spam in the US, and probably internationally right now.

So you're, you think about that. It's, it's just noise and there's no way to handle that right now, which is sort of discouraging, but, uh, it'd be interesting to see if your telco services can start bringing in like anti spoofing technology and, and building that out at the DID pool level, and the way they route calls and things like this, but I mean, we're not getting there anytime soon but these threats are here right now. 

Phishing, the social engineering side, I focus here because as a pen tester, you're like, what's the most successful route. A lot of it's social engineering. The human element is always going to be a struggle, and for some of these, there's no way to remove it out of the attack path. But for phishing, I think there's definitely solutions. 

Text, I think it's noisy but, unless you're going to control every phone and inspect every text that your company has, I don't know how you're going to handle that. But these are the areas that AI as, on the threat actor side is, is probably ahead of us in this cat and mouse game. 

Evan: So I think the example you gave, right. Um, Doesn't seem far fetched, right? You, you take the recording from this, right? You send the, you spoof a voicemail. Like, that's not like, that's not science fiction, right? That's something that you can do today. 

Where are we in like two years from now, right? When you have ChatGPT 7 and like, generated video models don't take five minutes to create, they take five milliseconds and you can now have interactive zoom calls with perfect deep fakes. How do we defend that future? 

Stephen: It's going to be insane. If you think about what's going on right now, or then the problems with AI right now. They're still prone to hallucinations in their AI models, and what you see NVIDIA and OpenAI and Microsoft's investing in is the reasoning models, right? And so if you're unfamiliar with AI bot infrastructure right now, you sort of have this orchestration bot that then goes, talks to all of these specific language learning model bots or functions, and each of them have a specialized area. And so they know which ones are experts in what space based on what you've built out and the data that you put behind them. But reasoning is, is where some of these things struggle.

Evan: These things, these problems will go away, right? Maybe whether it's one year or 10 years, at some point that goes away. And so where does that leave us from like a security perspective? 

Stephen: I think it's good as long as you're investing in those tools as well. Like if you're running an enterprise security and you're like sort of putting up this, Gridiron fence saying, no, our company is not going to use AI at a professional knowledge worker level. I think you're probably doing a disservice, right? That's like insisting you're going to, like, as typewriters are coming out that you're just going to keep using cursive and you're like iron ink or whatever. It's inefficient to think that way. 

And so as long as you can create sort of rules of the road or guidelines for your organization or team, and you consider privacy and the risks associated that, and you have, they're going to do it anyways, I guess is my first point. Because the whole term shadow IT exists for a reason or shadow tech. Uh, it's, it's because technology or security has created a barrier where the business sees value and the business is going to go around you. 

And I mean, You can argue that, well, you don't have a good enough relationship or whatever with your department, or you can be this department of no, but you're sort of stifling innovation, and development, and growth, and new ideas, if you go that route. 

Instead, find a way that it can work in your environment. Find a way that you, you can create safe engagements to use these tools and then see which ones are going to work for your use cases. And then these are going to drive new ideas and, and new innovations and new ways of thinking for your teams. 

Evan: So the last part of the episode, we like to do kind of what we call like a lightning round. So looking for like the one tweet responses, which I know will be impossible because these questions are pretty deep, but Mike, you want to kick it off? 

Mike: Sure. So, you know, you have somebody that you know that's stepping into their first CISO job. What's the one piece of advice that you would give them around something that you've either overestimated or underestimated about being a CISO? 

Stephen: Start a bug bounty program. 

Evan: What is the best way for a CISO to stay up to date on new security challenges, especially like in an age where AI is changing every week?

Stephen: Subscribe to news feeds and listen to these podcasts on your commute or when you're working out.

Mike: So on a more personal side, what's a book or maybe even a podcast or audio book that you've, you've taken advantage of that's had a big impact on you and why? 

Stephen: Dare to Lead. It is a fantastic book, and it's about getting over your own, uh, getting out of your own way and, uh, focusing on what you're, what you're there to do. 

Evan: What do you think will be true about AI's future impact on cybersecurity that most people don't believe or most people will consider science fiction?

Stephen: It's going to exacerbate the threat actors and empower them first before we're able to catch up in some spaces. 

Mike: Last question. What advice would you like to share to inspire the next generation of security leaders? 

Stephen: Try to be normal. Check your ego at the door. Don't, uh, don't focus too much on your own clout and, and, and life will be easier.

Evan: Stephen, thanks so much for joining our podcast today. As always, it's been super fun to talk with you. Looking forward to, uh, getting together again soon. 

Stephen: Thanks for having me. It's been great.

Mike: That was Stephen Harrison, Chief Information Security Officer at MGM Resorts International. I'm Mike Britton, the CISO of Abnormal Security. 

‍Evan: And I’m Evan Reiser, the CEO and founder of Abnormal Security.

 Mike: Please be sure to subscribe so you never miss an episode. You can find more great lessons from technology leaders and other enterprise software experts at enterprisesoftware.blog. 

‍Evan: This show is produced by Josh Meer. See you next time.