Maria Sumnicht was a young software engineer at NASA Ames Research Center in 1988, when the Morris Worm — considered one of the first cyberattacks in the nation — infected about 10% of the internet, creating a massive denial of service disruption. Nothing like it had ever happened, and she recalled running through the agency, unplugging computer after computer to limit the damage to NASA’s network.

“That day, cybersecurity was born, and I was on the very first incident response team,” she told the crowd at the Cybersecurity Conference Nov. 6 on the University of Nevada, Reno campus.

Sumnicht, now the national cybersecurity director for Critical Infrastructure with the Task Force on Homeland Security, discussed the widespread use of artificial intelligence in our modern cybersecurity systems, and the benefits and risks involved.

“Artificial intelligence is really moving at light speed,” she said, “[and is] being placed in our critical infrastructure, such as our power grid, our water treatment facilities, food production, transportation and automotive, health, telecom and military (systems), providing both unprecedented security and magnified risk.” 

Nearly 400 people gathered for the annual event, designed to bring together academia, industry and government to share information and the latest technology around cybersecurity. The free conference, organized by the University’s Cybersecurity Center and supported by industry and government sponsors, focused on the role of AI in cybersecurity systems.

“We are moving toward a future where AI and cybersecurity are the two cornerstones of our lives,” Shamik Sengupta, Cybersecurity Center executive director, said. “One will shape the future and how we live in it; the other will provide us resilience. This year’s Cybersecurity Conference will bring the best minds from across campus and the nation to discuss these dual concepts.”

Engineering Dean Tom Weller, in his opening remarks, announced that cybersecurity company Viakoo has donated $10,000 to establish a Cyber Defense Leadership scholarship at the University of Nevada, Reno, as well as new partnerships between the Cybersecurity Center and IBM and CarbonHelix. 

Regional and national cybersecurity leaders presented at the event, including Guy Shanny from IBM, Aaron Rose of Check Point Software Technologies and Ameya Kawimandan of Palo Alto Networks. Mark Precious and David DeLozier of CarbonHelix Security Operations also spoke, along with Josh Richman of the Electronic Frontier Foundation. Scott Stachan from the Nevada System of Higher Education led a panel discuss on research data security with Toolika Ghose from the University of Nevada, Las Vegas; Edward Mitchell from the Desert Research Institute and Joel Zysman from the University of Nevada, Reno.

Double-edged sword

In her morning keynote address, Sumnicht discussed how artificial intelligence could augment cybersecurity efforts — or overcome them, causing a “black sky event,” or large-scale disruption to critical systems that threatens our safety and security.

“I always like starting with the positive,” Sumnicht said, explaining how AI enhances cybersecurity through automated responses, proactive threat detection and predictive analysis. She added that there are many good zero-trust models — cybersecurity frameworks that require verification before access is granted — but strongly advised securing and testing any zero-trust model before rolling it out on your network.

On the negative side, Sumnicht noted that AI can be used to launch cyberattacks with greater speed than humans and “on the fly, (AI) can keep rewriting its code,” with devastating results. Because our critical infrastructures are interconnected and interdependent, Sumnicht said, “it’s really easy, if you take down one system, for the rest of the connected systems to be affected.”

As an example, she mentioned electrical grids. If a cybersecurity attack takes down an electrical grid, water treatment plants — which require electricity — won’t be able to process water. Meaning no drinking water, sanitation or reclaimed water. 

Sumnicht described AI as a double-edged sword and dedicated her presentation to the young students in the audience.

“I really want to get the next generation of cyber-defenders thinking about the things that should be top of mind,” she said. “As we move forward in the implementation of AI, we really need to be thinking leaps ahead of where we are now.”