SAN FRANCISCO – If you're the CEO of RSA Security, and your company is staging what’s billed as the world's largest security conference, then you might be expected to offer a few words of insight to all those gathered from far and wide. And so that man, Rohit Ghai, this week at the Moscone Center, offered his perspective on the broad sector of digital security – and the more specific topic of identity management – Monday at the conference.

His message pointed out what he sees as "The Looming Identity Crisis." "If identity is the defender’s shield, then it’s also the attacker’s target. In fact, identity is the most attacked part of the attack surface," Ghai said.

[ Follow SDXCentral’s complete RSA Conference 2023 coverage ]

Ghai, who took over as CEO in September 2020, told a packed room of about 2,000 at his opening keynote that "AI will cause us humans to be totally confused about our role in this world. We face a looming identity crisis. I think the humans in the identity control center will not be spared, either."

This crisis, in Ghai's eyes, has to do with technology, for sure, but it also has everything to do with truth. This is going to become harder to identify as time rolls on, because AI and other unregulated publicly available IT is enabling far too much untruth.

“AI will challenge self-perception," Ghai said. With avatars, AI-built deepfakes, false identities, misleading and made-up information being delivered by chatbots flooding the networks with bad and/or useless data, how in the world do we even know who we ourselves are? Who can you trust? Who should you trust? Will the online world become a zero-trust universe for everything we do in the future?

RSA Chief of Products Jim Taylor talked about this topic in a conversation with SDXCentral when he said "the overall preponderance of data – personal, business and machine-made – is leading to a 'good AI vs. bad AI' world" of the future. With this context, Ghai talked about the history of IT leading up to this moment.

"Every new technology wave is bigger, broader, faster and more disruptive than the previous one. This time is no different," Ghai said. Identity tech has lived through three disruptive technology waves, he said.

• The first: the internet wave. "The hallmark of that time was connectivity. Everything was getting connected, and our sector secured those connections," Ghai said.
• Second: the mobile cloud wave. "It was characterized by a shift away from a developer-centric mindset to consumer-centric. Everything was about making things easier. We catered to users’ love of convenience and enabled single-sign on, biometric authentication and access management," he said.
• The third wave is the AI/data wave we're now experiencing.

"We all sense that it is cresting. We can hear the roar of the ocean," Ghai said. "Readily available generative AI, large language models with 175 billion – that’s billion with a 'B' – parameters, AI that can ace AP biology, enormous investments by the big tech companies and a vibrant startup ecosystem are helping AI grow from an application-level technology into a platform capability."

AI also will cause humans to be totally confused about our role in this world, he said.

"Let’s reflect on the core purpose of the identity tech platform. Why does it exist? In the world of identity, we have always had to juggle three objectives – compliance, convenience and security. This is quite a task," Ghai said. We will need plenty of help – including from AI – to do this effectively, he said.

As we have navigated the three waves of technology, our expectations around the core purpose of an identity platform have shifted, Ghai said. "In the internet era, it was compliance-first (followed by security and convenience); in the mobile/cloud era, it was convenience-first (followed by security and compliance).

In the AI era it is security-first (followed by convenience and compliance)," Ghai said.

"Think of smartphones: their name belies what we actually use them for," Ghai said. "Today, the core purpose of this device isn’t to make phone calls. It is still a feature but not the core purpose. Instead, its core purpose is to access services over the internet.

"Similarly, the term 'identity and access management platform' is outdated. Access management and identity management are table stakes features, just like making a phone call. Today the core purpose of an identity platform is security. In the AI era, we need an identity security platform," Ghai said.

AI can watch and learn actual access and over time build fine-grained access models that humans could not process, he said. Similarly, AI can manage millions of entitlement relationships vs. thousands, he said.

"It is no longer sufficient to integrate the UI and bring all alerts into a common console. Instead, we need to integrate AI at the data layer," Ghai said. "Building our platforms from data will provide us with the superhuman insights, expert- and decision support that cybersecurity will need to protect a growing attack surface."

In the AI/data wave, "we need to think of identity tech as a sequence of decisions – who should have access, why, when and to what? We need insight to inform those decisions. Insight and meaning that is derived by reasoning over data," Ghai said.

Without "good AI" in our identity tools, zero trust has zero chance of success, Ghai said. "Bad AI will take us for a ride, and identity is a sitting duck," he said.

Cyber threat actors have always used automation to launch attacks, Ghai said. "Now they are leveraging AI to launch very sophisticated social engineering campaigns. They are phishing us with emotionally manipulative, compelling and seductive language. Without grammatical errors, I might add," he said.

"They are executing prompt bombing attacks to defeat MFA when we are most distracted and vulnerable. 

We need Good AI on our side to sniff out these sophisticated and relentless campaigns launched by Bad AI."