Speed Data: AWS, Gen AI, and SecDataOps With Jonathan Rau

Welcome to Speed Data: Quick Conversations With Cybersecurity Leaders. Like speed dating, our goal is to capture the hearts of CISOs with intriguing, unique insight in a rapid format for security professionals pressed for time.

Jonathan Rau, VP and Distinguished Engineer at Query, has made a name for himself online by sharing thought-provoking posts and never being predictable. In this episode of Speed Data, the AWS Community Builder shares his advice for navigating data in the cloud versus on-prem and explains what most organizations get wrong about cloud security.

The path to security PM

Former board advisor, CISO, and four-year Army veteran Jonathan Rau could have gone the way of Jesse James.

“I could probably be a good bank robber,” the Query VP and Distinguished Engineer quipped. His time spent working in radio telecommunications and the bomb squad for the U.S. Army honed leadership skills that — fortunately — Jonathan used for benevolent purposes. “I did a little bit of intel work, and when I got out, I was like, ‘What do I do now?’”

After leaving the military, Jonathan began working as a security project manager for Nationwide. His inquisitive nature more than made up for his inexperience as a PM.

Jonathan quickly worked his way up through the ranks. “I just picked it up as I went, and then eventually ended up at AWS,” he said.

A new way of identifying misconfigurations

Jonathan’s time at Amazon Web Services helped him author Electric Eye, a multi-cloud, multi-SaaS Python CLI tool that continuously monitors AWS services for misconfigurations that may be degrading the CIA triad. 

“Not only does it support AWS, but it also now has Oracle Cloud and Google Cloud,” Jonathan said.

“It also supports ServiceNow and Salesforce, with a couple of different integrated reporting tools, such as an integration into the Amazon Data Lake. I'm working on a PR for Azure, which is slowly draining the life out of me,” he laughed.

The creation of SecDataOps

Jonathan is known as a jokester to his 8,000-plus social media followers. It’s no surprise, then, that the LinkedIn “Top Cybersecurity Voice” coined a well-known term by “trash-talking online,” he said.

“‘SecDataOps’ I meant as a joke, poking fun at ‘DevSecOps,’” Jonathan said. “I think DevSecOps was a great aspiration to try to reach, to bring developers closer to the fold of security. But while there are success stories, there are a lot more failures.”

Jonathan said, “‘Why mess with the developers when we could make security people into data people?’ And that’s how it turned out.”

“And at a high level, it's about security teams using data to achieve security outcomes and taking ownership of the data,” he said.

Gen AI pros and cons

And speaking of data ownership, Jonathan explained why orgs must also own the accuracy of their data, particularly content produced by generative AI.

“Large language models, if we're looking at it from a natural language processing perspective, are really good at taking big data analytics out of the hands of the end analyst, and it's good to help people author threat models at some perspective,” he said. “But the risk is there for businesses.”

“Google's using Reddit as their training data and so now if you're looking up a medical question, it might tell you to go smoke seven cigarettes and do a backflip off a bridge instead of talk to your doctor, right?,” he said, referencing Reddit’s instigative reputation.

However, Jonathan said there are many pros gen AI offers as well.

Multiply that by tens of thousands, and finding context in the results becomes impossible.

“Most of the mainstream gen AI models — GPT-4 and GPT-4o, the new Mistral ones, the Anthropics like the Cloud 3 Sonnet and Haiku — those are great at gaining context and digging through that stuff.”

Ultimately, Jonathan said, it’s still too early in the technology's development to label it as “good” or “bad.”

“There's a lot that we still don't know about AI, and there's a lot more that we're going to continue to learn,” Jonathan said.

Harnessing gen AI for good

Generative AI has changed the game in many ways for productivity and creativity, but also for risk. With gen AI, attackers are faster, stealthier, and can more easily find what they want — your sensitive data.

Varonis’ Athena AI spans the entire Data Security Platform and redefines how security teams protect data — from visibility to action.

Curious to learn how Athena can transform users of all skill levels into formidable defenders? Check out our free Data Risk Assessment to learn exactly where you have security gaps and data exposures, or reach out to request a demo.