The guiding objective for addressing cyber risk | The TechTank Podcast

TechTank, a biweekly podcast from the Center for Technology Innovation at Brookings, explores today’s most consequential technology issues.

TechTank 是布鲁金斯学会技术创新中心的双周播客，探讨当今最重要的技术问题。

Moderators Nicol Turner Lee and Darrell West speak with experts and policymakers to share data, ideas, and policy solutions that address the challenges of our digital world.

主持人 Nicol Turner Lee 和 Darrell West 与专家和政策制定者交谈，分享应对数字世界挑战的数据、想法和政策解决方案。

Cyber risk in an interconnected environment is increasingly complex for organizations to assess and address.

对于组织而言，互联环境中的网络风险评估和解决变得越来越复杂。

Strategic choices can shape both cybersecurity risk and resilience.

战略选择可以塑造网络安全风险和弹性。

The question of vendor concentration—an organization’s reliance on a single supplier or platform—is part of the risk calculus.

供应商集中度问题（组织对单一供应商或平台的依赖）是风险计算的一部分。

While vendor concentration can present certain risks, it can also deliver strength through unified controls and coordinated defense.

虽然供应商集中可能会带来一定的风险，但也可以通过统一控制和协调防御来发挥力量。

A recent paper , informed by discussions with senior leaders immersed in cybersecurity risk management with both public and private sector experience, argues that resilience, which “treats concentration and diversity as strategic levers, backed by redundancy, contingency, and fast recovery,” should be an organization’s guiding objective.

最近的一篇论文通过与具有公共和私营部门经验的网络安全风险管理高级领导人的讨论得出结论，认为韧性“将集中度和多样性视为战略杠杆，并以冗余、应急和快速恢复为后盾”，应该成为组织的指导目标。

In this episode of the TechTank, guest host and Brookings fellow Stephanie Pell is joined by the paper’s coauthors, Diana Burley, senior vice president of research at Brookings, and Rhea Siers, a cyber risk adviser and former senior intelligence official, to discuss their findings along with the implications of their research in an artificial intelligence (AI)-enabled risk environment.

在 TechTank 的这一集中，特邀主持人、布鲁金斯学会研究员 Stephanie Pell 与该论文的合著者、布鲁金斯学会研究高级副总裁戴安娜·伯利 (Diana Burley) 和网络风险顾问兼前高级情报官员雷亚·西尔斯 (Rhea Siers) 一起讨论了他们的发现以及他们的研究在人工智能 (AI) 支持的风险环境中的影响。

Listen to the episode and subscribe to the TechTank Podcast on Apple , Spotify , or Acast .

收听该剧集并订阅 Apple、Spotify 或 Acast 上的 TechTank 播客。

[00:00:00] CO-HOST NICOL TURNER LEE: You’re listening to TechTank, a biweekly podcast from the Brookings Institution exploring the most consequential technology issues of our time.

[00:00:00] 联合主持人 NICOL TURNER LEE：您正在收听 TechTank，这是布鲁金斯学会的双周播客，探讨我们这个时代最重要的技术问题。

From racial bias in algorithms to the future of work, TechTank takes big ideas and makes them accessible.

从算法中的种族偏见到未来的工作，TechTank 吸收了伟大的想法并让它们变得容易理解。

[00:00:25] GUEST HOST STEPHANIE PELL: Welcome to the Tech Tank Podcast.

[00:00:25] 嘉宾主持人斯蒂芬妮·佩尔：欢迎来到科技坦克播客。

I’m guest host Stephanie Pell, a fellow in Governance Studies at The Brookings Institution.

我是客座主持人斯蒂芬妮·佩尔，布鲁金斯学会治理研究研究员。

Assessing and addressing cyber risk in an interconnected environment is increasingly complex for organizations big and small.

对于大大小小的组织来说，评估和解决互联环境中的网络风险变得越来越复杂。

As digital ecosystems and supply chains expand, strategic choices can shape both cybersecurity risk and resilience across an enterprise.

随着数字生态系统和供应链的扩展，战略选择可以影响整个企业的网络安全风险和弹性。

The question of vendor concentration, that is, how reliance on a single supplier or platform might shape risk and resilience, is often raised, especially because organizations often lack visibility into how cyber threats or failures might propagate.

供应商集中度的问题，即对单一供应商或平台的依赖如何影响风险和弹性，经常被提出，特别是因为组织通常缺乏对网络威胁或故障如何传播的可见性。

Today, I’m joined by Diana Burley, senior vice president of research here at Brookings.

今天，布鲁金斯学会研究高级副总裁戴安娜·伯利 (Diana Burley) 也加入了我的行列。

Prior to coming to Brookings, Diana was vice provost for research and innovation at American University, where she also led the Khan Cyber and Economic Security Institute and served as a member of the faculty.

在加入布鲁金斯学会之前，戴安娜曾担任美利坚大学负责研究和创新的副教务长，她还领导可汗网络和经济安全研究所并担任教员。

I am also joined by Diana’s co-author, Rhea Siers, who has 30 years of operational, legal, and policy experience in the U.S. intelligence community, is an advisor on cyber risks and threats, and is a member of the adjunct faculties at George Washington University and Johns Hopkins University.

戴安娜的合著者雷亚·西尔斯 (Rhea Siers) 也加入了我的行列，她在美国情报界拥有 30 年的运营、法律和政策经验，是网络风险和威胁方面的顾问，也是乔治华盛顿大学和约翰霍普金斯大学的兼职教授。

They’re here to discuss a paper they published at the end of last year titled “Resilience Rules: Securing the Enterprise in Concentrated Systems.” Welcome, Diana and Rhea, and thank you for joining me.

他们来这里是为了讨论去年年底发表的一篇论文，题为“弹性规则：保护集中系统中的企业”。欢迎戴安娜和瑞亚，感谢你们加入我的行列。

[00:02:16] GUEST HOST STEPHANIE PELL: To start off, can you talk about some of the real-world scenarios that organizations face and how such scenarios and the attendant cyber risks lead us into a discussion of vendor concentration and resilience?

[00:02:16] 嘉宾主持人斯蒂芬妮·佩尔：首先，您能否谈谈组织面临的一些现实场景，以及这些场景和随之而来的网络风险如何引导我们讨论供应商集中度和弹性？

[00:02:34] GUEST DIANA BURLEY: I’ll start off, and then I will turn it over to Rhea.

[00:02:34] 嘉宾戴安娜·伯利：我先开始，然后把它交给雷亚。

When we first think about real-world scenarios, we’re thinking about how organizations are functioning in these highly dense and opaque supply chain environments where security risk is heavily interconnected.

当我们首先考虑现实世界的场景时，我们会考虑组织如何在这些安全风险高度关联的高度密集且不透明的供应链环境中运作。

You can’t really think about an organization in isolation because all of the connections between the organizations matter for how they are able to secure the products and services that they are providing.

您不能真正孤立地考虑一个组织，因为组织之间的所有连接都关系到它们如何确保其提供的产品和服务的安全。

And so when we think about c- vendor concentration, we think about the fact that up and down the supply chain, the different companies are all using the same software applications, corporate applications, cloud providers, service providers, and so therefore they become vulnerable to an attack on, that particular vendor.

因此，当我们考虑第三方供应商集中度时，我们会考虑这样一个事实：在供应链上下游，不同的公司都使用相同的软件应用程序、企业应用程序、云提供商、服务提供商，因此它们很容易受到特定供应商的攻击。

It impacts all of the different in, organizations throughout the supply chain, and that’s what makes, the risk amplified when we talk about concentrated environments.

它影响整个供应链中的所有不同组织，这就是当我们谈论集中环境时风险被放大的原因。

[00:03:44] GUEST RHEA SIERS: And I really wanna emphasize this because I think we almost see this as a critical law of cyber physics.

[00:03:44] 嘉宾 RHEA SIERS：我真的想强调这一点，因为我认为我们几乎将其视为网络物理的关键定律。

Reducing the risk for one party usually relocates it rather than removes it.

降低某一方的风险通常会重新定位而不是消除它。

And it often gets pushed downstream to smaller suppliers who simply can’t handle the load.

而且它经常被推向下游，交给根本无法处理负载的较小供应商。

But in terms of what we saw of examples raised by our subjects, we saw a continuing drumbeat of pressure to meet financial constraints, operational pressures, and oversight and governance concerns.

但就我们所看到的主题提出的例子而言，我们看到了满足财务限制、运营压力以及监督和治理问题的持续压力。

when something does go wrong, when there is a serious incident, there is sometimes a problem organizationally when there is no technically some backup when you are dependent on a specific operating system or a specific piece of software, and this really, aggravates the situation as well.

当出现问题时，当发生严重事件时，当您依赖于特定操作系统或特定软件时，如果没有技术上的备份，有时会出现组织问题，这确实也会加剧情况。

[00:04:42] GUEST HOST STEPHANIE PELL: So you referenced your subjects or participants.

[00:04:42] 嘉宾主持人斯蒂芬妮·佩尔：所以你提到了你的主题或参与者。

I wanna turn specifically to your research paper and, have you talk about the particular research questions you were grappling with, how your research proceeded, and who your study participants were.

我想具体谈谈您的研究论文，请您谈谈您正在努力解决的特定研究问题，您的研究是如何进行的，以及您的研究参与者是谁。

What kinds of organizations or companies did they represent?

他们代表什么类型的组织或公司？

[00:05:08] GUEST RHEA SIERS: So I’ll discuss the research question a bit and the methodology and the participants.

[00:05:08] 嘉宾 RHEA SIERS：所以我将稍微讨论一下研究问题、方法论和参与者。

The purpose was not the standard kind of dry theoretical trade-offs between concentration and diversification.

目的不是集中化和多元化之间标准的枯燥理论权衡。

The focus of the research question and the interviews we did was really how senior enterprise leaders actually manage and engage risk on the ground when it comes to concentration.

我们所做的研究问题和访谈的重点实际上是企业高层领导者在集中度方面如何实际管理和参与风险。

So in terms of the methodology, we used a two-part integrative approach, which involved a structured literature review, and then was followed by targeted focus groups and interviews.

所以在方法论上，我们采用了两部分综合的方法，首先是结构化的文献综述，然后是有针对性的焦点小组和访谈。

we kept the framework for those interviews around six core operational dimensions, and these really are the dimensions and issues that organizations and leaders weigh when they think about concentration and diversity.

我们将这些访谈的框架围绕六个核心运营维度进行，这些确实是组织和领导者在考虑集中度和多样性时权衡的维度和问题。

And they include operational overhead, business continuity, economic and societal factors, user experience, workforce readiness, and global strategic risk.

它们包括运营费用、业务连续性、经济和社会因素、用户体验、劳动力准备情况和全球战略风险。

In terms of the demographics of the group we engaged, we focused on 15 elite senior professionals.

就我们参与的群体的人口统计而言，我们重点关注了 15 名精英高级专业人士。

It’d be chief information security officers, chief technology officers, managing directors, program leaders.

其中包括首席信息安全官、首席技术官、董事总经理、项目负责人。

And all of them spanned cross-sector environments, which would include government, finance, technology, cloud services, education, and law.

所有这些都跨越跨部门环境，包括政府、金融、技术、云服务、教育和法律。

[00:06:44] GUEST DIANA BURLEY: I would just add in terms of the professionals that we engaged in this study, they were also, multinational.

[00:06:44] 嘉宾戴安娜·伯利：我想补充一下我们参与这项研究的专业人士，他们也是跨国公司。

We had most of our participants had experience working, within the, the United States and abroad, either because they worked at companies based in, in, outside of the United States or because they worked with na- multinational companies that, had experience across borders.

我们的大多数参与者都有在美国境内和国外工作的经验，要么是因为他们在美国境内、境外的公司工作，要么是因为他们与有跨境经验的跨国公司合作。

And because they were senior professionals, they also all had experience in multiple sectors, even within the United States.

由于他们都是高级专业人士，因此他们也都拥有多个领域的经验，甚至在美国也是如此。

They had worked in policy, in, within government, and within the private sector.

他们曾在政府内部和私营部门从事政策工作。

So they really brought a, a very large range of experiences, to bring to bear to the study.

因此，他们确实带来了非常广泛的经验，并将其运用到研究中。

[00:07:35] GUEST HOST STEPHANIE PELL: And what were some of the key themes and challenges that you heard from your study participants?

[00:07:35] 嘉宾主持人斯蒂芬妮·佩尔：您从研究参与者那里听到的一些关键主题和挑战是什么？

[00:07:42] GUEST DIANA BURLEY: I’ll start with some of the key themes and, challenges.

[00:07:42] 嘉宾戴安娜·伯利：我将从一些关键主题和挑战开始。

One was a visibility gap.

其中之一是能见度差距。

the participants talked about the fact that there are blind spots in their ability to look down the supply chain and understand the amount of exposure the systems really have to vulnerabilities and to, to cyber attacks.

参与者谈到了这样一个事实：他们在审视供应链和了解系统真正面临的漏洞和网络攻击的风险程度方面存在盲点。

As one of our study participants put it, “I have no way of knowing my impact radius.” They really, especially as they get to the third and fourth order, parts of the supply chain, they could not see, where their vulnerabilities lie.

正如我们的一位研究参与者所说，“我无法知道我的影响半径。”他们确实看不到自己的弱点在哪里，特别是当他们进入供应链的第三和第四阶部分时。

They also talked about the illusion of simplification, and this is while even when you’re thinking about flattening the vendor stack and recognizing that when you flatten that vendor stack in terms of concentration, it does bring you some short-term relief.

他们还谈到了简化的错觉，即使您正在考虑扁平化供应商堆栈，并认识到当您在集中度方面扁平化供应商堆栈时，它确实会给您带来一些短期的缓解。

That simplification often abstracts away and obscures critical underlying system complexities.

这种简化通常会抽象并掩盖关键的底层系统复杂性。

And so this really goes to the notion that Rhea talked about just a few moments ago, where you’re pushing risk downstream, you’re not necessarily getting rid of it.

因此，这确实符合雷亚刚才谈到的观点，即你将风险推向下游，但不一定能摆脱它。

And I’ll say a third, a third challenge that our participants really focused on was that there’s an incomplete metric.

我要说的是，我们的参与者真正关注的第三个挑战是，存在一个不完整的指标。

Concentration is an important and a critical facet of risk, but it is an incomplete proxy for it.

集中度是风险的一个重要且关键的方面，但它并不能完全代表风险。

And so understanding that measuring vendor counts alone does not show you the true nature of your operational exposure, certainly doesn’t give you a sense of the exposure that goes beyond your, beyond your borders and down your supply chain.

因此，仅了解衡量供应商数量并不能向您展示运营风险的真实性质，当然也不能让您感受到超出您、超出您的边界和供应链的风险。

And so they really talked about the fact that it is very difficult to understand just how much vulnerability actually exists in your tech stack

因此，他们确实谈到了这样一个事实：很难了解技术堆栈中实际存在多少漏洞

[00:09:38] GUEST RHEA SIERS: And I’ll dig a little deeper on all those points Diana made.

[00:09:38] 嘉宾 RHEA SIERS：我会更深入地探讨戴安娜提出的所有这些观点。

I’ll start with the simplification and consolidation advantages.

我将从简化和整合的优势开始。

the simplification drives concentration, so obviously allows for unified control, centralized dashboard, automated threat intel sharing, and streamlined patch management and oversight.

简化可以提高集中度，因此显然可以实现统一控制、集中仪表板、自动威胁情报共享以及简化的补丁管理和监督。

Diana also alluded to the supply chain danger, so we’re not just talking first tier here.

戴安娜还提到了供应链的危险，所以我们在这里谈论的不仅仅是第一层。

The- there are significant vulnerabilities on the fourth- and fifth-party relationships which are, which the people we interviewed recognized, very clearly.

我们采访的人非常清楚地认识到，第四方和第五方关系存在重大漏洞。

There’s also something called the Frankenstein effect, which is over-diversification, it essentially backfires.

还有一种叫做弗兰肯斯坦效应，即过度多元化，本质上会适得其反。

If there’s an uncoordinated multi-vendor patch, it creates an operational mess with inconsistent security protocols and massive configuration gaps, and this is often seen when there is a serious incident of some sort.

如果存在不协调的多供应商补丁，则会造成操作混乱，安全协议不一致和巨大的配置差距，这种情况在发生某种严重事件时经常出现。

It does not have to be a concentration risk type of incident.

它不一定是集中风险类型的事件。

It can be any type of cyber incident and I do think that our subjects really believe that resilience is the key principle here, and we can talk more about that later.

它可以是任何类型的网络事件，我确实认为我们的受试者确实相信弹性是这里的关键原则，我们稍后可以更多地讨论这一点。

And the other area that I think both Diana and I have seen a lot of is the impact on the workforce.

我认为戴安娜和我都经常看到的另一个领域是对劳动力的影响。

Now, a lot of people discuss the impact on the workforce these days concerning AI, but let’s talk about it in terms of concentration.

现在，很多人都在讨论人工智能对劳动力的影响，但让我们从集中度的角度来谈谈。

The pro, the positive of it, is that concentrating the tech stack narrows the scope of tech training that’s required.

优点是，集中技术堆栈可以缩小所需技术培训的范围。

It allows your staff to build deeper expertise in a single ecosystem.

它允许您的员工在单一生态系统中建立更深入的专业知识。

That can be very effective and important.

这可能非常有效且重要。

The other side of that, of course, the con, is that organizations become entirely dependent on occasion on outsourced vendor knowledge, and you can see how that could lead to problems down the road.

当然，缺点是组织有时会完全依赖外包供应商的知识，您可以看到这将如何导致未来的问题。

So that would be the deeper dive in some of the things that we heard from those that we interviewed.

因此，这将是我们从受访者那里听到的一些事情的更深入的探讨。

[00:11:49] GUEST HOST STEPHANIE PELL: So I wanna dig a little bit deeper then on this idea of resilience as a principle that seemed to emerge as one of the core findings of the paper.

[00:11:49] 嘉宾主持人斯蒂芬妮·佩尔（STEPHANIE PELL）：所以我想更深入地探讨弹性这一原则，它似乎是本文的核心发现之一。

Can you talk a little bit more about that?

您能多谈谈吗？

[00:12:04] GUEST RHEA SIERS: I think that there is somewhat of a knee-jerk reaction, not just in terms of concentration, but in all response to incidents where, there’s a view that you have to, immediately solve the problem and, kinda move on.

[00:12:04] 嘉宾 RHEA SIERS：我认为存在某种下意识的反应，不仅在注意力方面，而且在对事件的所有反应中，有一种观点认为你必须立即解决问题，然后继续前进。

There’s never this precursor, or there often is not a precursor of looking where the potential risk is, addressing that risk ahead of time, and matching the technical, the cyber risk, both to compliance issues and of course to business issues, continuity of business.

从来没有这种先兆，或者通常没有先兆来寻找潜在风险所在，提前解决该风险，并将技术、网络风险与合规问题以及业务问题、业务连续性相匹配。

That’s the piece of resilience that we hear most often from cyber professionals that is the most important for them, and frankly, the most complex to dig into and to, to be able to even, include in your governance and your procedures.

这是我们最常从网络专业人士那里听到的弹性，这对他们来说是最重要的，坦率地说，也是最复杂的挖掘和挖掘，甚至能够包含在你的治理和程序中。

[00:12:58] GUEST DIANA BURLEY: Yeah, if I can follow on that, because I, think it’s really important to emphasize that when we’re talking about cyber risk, we are talking about a single facet of business risk.

[00:12:58] 嘉宾戴安娜·伯利：是的，如果我能继续下去的话，因为我认为强调这一点非常重要：当我们谈论网络风险时，我们谈论的是业务风险的一个方面。

And so when you talk about concentration, and you think about it only from a cyber risk perspective, it doesn’t allow you to really think through what will make your company or your enterprise resilient across all of the different facets of risk that you face.

因此，当您谈论集中度时，如果您仅从网络风险的角度来考虑它，那么您就无法真正思考如何使您的公司或企业在面临的所有不同风险方面具有弹性。

And so as we began to, unbundle this very complex, tapestry of challenges, of risk, what our participants just talked about over and over again were the trade-offs that are made when you make different decisions.

因此，当我们开始分解这个非常复杂的、充满挑战和风险的挂毯时，我们的参与者刚刚一遍又一遍地谈论的是当你做出不同的决定时所做出的权衡。

And that’s how we ended up getting to this idea of risk of, resilience as a, as the core principle.

这就是我们最终得出风险、弹性作为核心原则的想法。

Because as you continue to move down the discussion of the various types of risks and the various types of trade-offs that need to be made, you realize that there is no silver bullet.

因为当你继续深入讨论各种类型的风险和需要进行的各种类型的权衡时，你会意识到没有灵丹妙药。

There is no one way that is the best way.

没有一种方法是最好的方法。

It really becomes a question of balancing and ensuring that depending on the specific details of your situation, and the environment, and the supply chain, and the products, and the training, and all of these different factors, putting them together in a way that allows your enterprise to recover from challenges and to continue moving forward is really the name of the game.

这实际上成为一个平衡和确保根据您的具体情况、环境、供应链、产品、培训以及所有这些不同因素的具体细节，以一种允许您的企业从挑战中恢复并继续前进的方式将它们组合在一起的问题，这才是真正的游戏名称。

[00:14:41] GUEST HOST STEPHANIE PELL: To that point, this notion of simplification and consolidation advantages, how s- how did you find that organizations were seeking simplification and consolidation, but addressing the risks inherent in, moving in those sorts of directions?

[00:14:41] 嘉宾主持人斯蒂芬妮·佩尔：就这一点而言，简化和整合的概念具有优势，您是如何发现组织正在寻求简化和整合，同时解决朝这些方向发展所固有的风险的？

[00:15:09] GUEST RHEA SIERS: I somewhat relate to this as kind of organizations or a- or even federal agencies choosing vendor consolidation as a practical prerequisite, not just for simplification, but for compliance.

[00:15:09] 嘉宾 RHEA SIERS：我在某种程度上认为这是一些组织或机构甚至联邦机构选择供应商整合作为实际先决条件，不仅是为了简化，而且是为了合规性。

And so if you think about things like identity and access management, there are multiple syst- systems, there are, federal network directives on zero trust and, similar conditional access.

因此，如果您考虑身份和访问管理等问题，就会发现有多个系统，有关于零信任和类似条件访问的联邦网络指令。

When you would try to achieve that across, legacy vendors, across, really across the, the globe, it’s operationally impossible.

当你试图跨传统供应商、跨全球、真正跨全球实现这一目标时，这在操作上是不可能的。

So that’s where simplification, as an example, I would say, comes in, and was one of the things that was shared with U.S. pretty, pretty often, actually.

举个例子，我想说，这就是简化的用武之地，实际上，这也是美国经常分享的事情之一。

[00:16:00] GUEST DIANA BURLEY: I would say one thing too that we haven’t talked about yet, but that certainly came up in the study and, in, in the months since, and that is the notion of digital sovereignty, and recognizing that simplification is not just about the system per se or the technical infrastructure of the system.

[00:16:00] 嘉宾戴安娜·伯利：我还要说一件事，我们还没有讨论过，但这确实在研究中以及此后的几个月里出现了，那就是数字主权的概念，并认识到简化不仅仅是关于系统本身或系统的技术基础设施。

It’s also about understanding how the use of the technology relates to the political environment, the global political environment, and, the, the laws and regulations that sit within individual countries.

它还涉及了解技术的使用与政治环境、全球政治环境以及各个国家/地区的法律和法规之间的关系。

And so that is a component of simplification as well that has to be considered when you’re thinking through the questions of resilience.

因此，这也是简化的一个组成部分，当您思考弹性问题时必须考虑这一点。

[00:16:45] GUEST RHEA SIERS: And there’s a great example of this going on right now, that we discussed and d- as we did our after discussions on the study with the round table and others, we talked about France, and specifically its perception that it is, that it has concentration risk due to the fact that I think U.S. big tech controls about 65% of Europe’s, cloud market, for example.

[00:16:45] 嘉宾 RHEA SIERS：现在有一个很好的例子，我们在与圆桌会议和其他人讨论该研究后进行了讨论和讨论，我们谈到了法国，特别是它的看法，即它存在集中风险，因为我认为美国大型科技公司控制着欧洲约 65% 的云市场。

And so France has increasingly mandated these local alternatives, replacing all kinds of tools like Teams and Zoom.

因此，法国越来越多地强制使用这些本地替代方案，取代 Teams 和 Zoom 等各种工具。

And the question is, what is the impact of that going to be on, on concentration risk?

问题是，这会对集中风险产生什么影响？

And it’s, of course, impossible to know that at the moment, but I think there are a couple things we need to study and watch.

当然，目前还不可能知道这一点，但我认为有一些事情我们需要研究和观察。

There are a couple things they’re doing, like they’re migrating, this massive health data hub, from Microsoft to, I think it’s Iliad.

他们正在做一些事情，比如他们正在将这个庞大的健康数据中心从微软迁移到，我认为是伊利亚特。

I think it’s called Scaleway.

我认为它叫做 Scaleway。

and there are severe internal concentration risks when you have this kind of internal by French mandate.

当法国有这种内部授权时，就会存在严重的内部集中风险。

There’s a domestic monopoly trap, highly consolidated, so a single physical attack, fire, cyberattack, operational outage could paralyze in public services.

国内存在高度整合的垄断陷阱，因此一次物理攻击、火灾、网络攻击、运营中断都可能导致公共服务瘫痪。

And then there’s the issue that we continue to worry about across the cyber’s, arena, and that’s the innovation and capacity gap.

然后是我们在网络领域继续担心的问题，那就是创新和能力差距。

And so that’s another thing we need, to consider when we start looking at the digital sovereignty issue as well

因此，这是我们在开始考虑数字主权问题时需要考虑的另一件事

[00:18:33] GUEST DIANA BURLEY: And just one more aspect of that, and that is the global supply chain.

[00:18:33] 嘉宾戴安娜·伯利：还有一方面，那就是全球供应链。

Because while we have talked about the supply chain and the fact that even when we’re not thinking about the global supply chain specifically, we’re saying our participants were saying they already had no idea what their impact radius was.

因为虽然我们已经讨论了供应链，但即使我们没有具体考虑全球供应链，我们的参与者也表示他们已经不知道自己的影响半径是多少。

It’s not clear that they can get visibility into the, the third, fourth, or fifth level down.

目前尚不清楚他们能否看到第三层、第四层或第五层。

So you can imagine that in a situation like in France, I can imagine that even as they, mandate that they have to use technologies and, products that are made in France, that is at the top level.

所以你可以想象，在法国这样的情况下，我可以想象，即使他们强制要求他们必须使用法国制造的技术和产品，那也是顶级的。

What happens when you start moving down the supply chain and deal with the questions around interoperability?

当您开始沿着供应链向下移动并处理有关互操作性的问题时会发生什么？

And so that’s also another, another opportunity for this Frankenstein effect to occur, unwittingly.

因此，这也是弗兰肯斯坦效应在不知不觉中发生的另一个机会。

And when you think that you are reducing risk in one area, you end up really, creating additional risk and, hurting your enterprise

当您认为自己正在降低某个领域的风险时，您最终实际上会创造额外的风险并损害您的企业

[00:19:48] GUEST HOST STEPHANIE PELL: So not to add yet another facet to this risk discussion, but as you reflect on your discussions with participants about the risks and benefits of vendor concentration, how do you think AI impacts risk calculations for organizations?

[00:19:48] 嘉宾主持人斯蒂芬妮·佩尔（STEPHANIE PELL）：因此，并不是要为这个风险讨论添加另一个方面，而是当您反思与参与者关于供应商集中的风险和收益的讨论时，您认为人工智能如何影响组织的风险计算？

[00:20:08] GUEST RHEA SIERS: Oh, I’ll start on that.

[00:20:08] 嘉宾 RHEA SIERS：哦，我就从这个开始吧。

so it, it shifts the core, obviously.

所以它显然改变了核心。

AI removes traditional layered tech stacks, so there’s an immense concentration dependency on just a few shared foundational architectures and core hosting platforms.

人工智能消除了传统的分层技术堆栈，因此对少数共享基础架构和核心托管平台有极大的集中依赖。

what we heard from leaders we spoke to was that they were very concerned about AI products escaping chain of custody scrutiny.

我们从与我们交谈的领导人那里听到的是，他们非常担心人工智能产品逃避监管链审查。

That’s not what Claude was per se, but I’m gonna use it as an example in just a second.

这并不是克劳德本身，但我很快就会用它作为例子。

so the underlying foundational model for AI might be vetted.

因此人工智能的底层基础模型可能会受到审查。

the commercial products that are built on top of them com- really completely lack visibility and data governance.

建立在它们之上的商业产品确实完全缺乏可见性和数据治理。

So a single flaw in a frontier model, the cutting-edge model, could cause immediate cascading failures globally.

因此，前沿模型（尖端模型）中的一个缺陷可能会立即导致全球范围内的连锁故障。

So I just wanna differentiate because, there’s been a lot of talk the last few weeks about the Claude containment incidents.

所以我只是想区分一下，因为过去几周有很多关于克劳德收容事件的讨论。

they were operational and what are called harness failures.

它们是可操作的，也就是所谓的线束故障。

So there was a breakdown in the surrounding software infrastructure to restrict it, including boundaries, and thus it escaped.

所以周围的软件基础设施出现故障来限制它，包括边界，因此它逃脱了。

This is an inherent governance issue as well as an operational issue, and it is related to concentration risk as well.

这是一个固有的治理问题，也是一个运营问题，也与集中度风险有关。

[00:21:39] GUEST DIANA BURLEY: And I want to…

[00:21:39] 嘉宾戴安娜·伯利：我想……

I wanna take us back maybe 10 years because whenever a new technology, emerging tech comes out, we, address the challenges as if they’re brand-new challenges.

我想把我们带回大约 10 年前，因为每当一项新技术、新兴技术出现时，我们都会像对待全新的挑战一样应对挑战。

And in fact, you think about the internet, and you think about the, the, Apple platform and the Android platform and the Google s- platform and the stores and whether, the apps that were available within the stores had been properly vetted and, whether they were introducing vulnerabilities onto the platforms, and that’s really what we’re dealing with again, in this AI space.

事实上，你想到互联网，想到苹果平台、安卓平台、谷歌 s 平台和商店，商店中提供的应用程序是否经过了适当的审查，以及它们是否在平台上引入了漏洞，而这正是我们在人工智能领域再次面临的问题。

And so as Rhea said, even if the foundational model has been vetted, that doesn’t mean that the commercial products that you’re using have been.

正如 Rhea 所说，即使基础模型已经过审查，但这并不意味着您正在使用的商业产品已经过审查。

And so it just adds another layer of complexity, that we need to really think through as we begin to use these tools even more, on the data, the proprietary data often that we have within our pr- enterprises.

因此，它只是增加了另一层复杂性，当我们开始更多地使用这些工具时，我们需要真正考虑到数据，即我们公关企业中通常拥有的专有数据。

[00:22:41] GUEST RHEA SIERS: And, what’s the pragmatic fix?

[00:22:41] 嘉宾 RHEA SIERS：那么，务实的解决办法是什么？

Of course, that’s the most difficult question, and we talked about this with, those we interviewed and with folks who’ve reviewed the study.

当然，这是最困难的问题，我们与受访者和审查过该研究的人讨论了这个问题。

and I’m an attorney, so I will say that one of the things has to be building explicit contractual terms that cover, regular model audits and data portability, but we just haven’t really settled, not just in AI but across the cyber arena, on what that constitutes.

我是一名律师，所以我想说，其中一件事必须是建立明确的合同条款，其中包括定期模型审计和数据可移植性，但我们还没有真正确定其构成，不仅在人工智能领域，而且在整个网络领域。

And for example, if we want strict end-to-end chain of custody tracking for all AI-enabled vendor products, how are we gonna do that?

例如，如果我们希望对所有支持人工智能的供应商产品进行严格的端到端监管链跟踪，我们该如何做到这一点？

And, I think, actually Diana can, talk a little bit about what we already have in term of frameworks, but this is the ongoing question of industry standards over mandates.

而且，我认为，实际上戴安娜可以谈谈我们在框架方面已经拥有的东西，但这是行业标准高于授权的持续问题。

[00:23:39] GUEST DIANA BURLEY: Yeah, and I, think it too, it also reflects the question that many of our participants, laid out, which, what are the metrics?

[00:23:39] 嘉宾戴安娜·伯利：是的，我也这么认为，它也反映了我们许多参与者提出的问题，指标是什么？

How are we really looking at this?

我们到底如何看待这个问题？

How are we measuring risk?

我们如何衡量风险？

And, if we focus on this question around industry standards, we can begin to think through some of the best practice frameworks, like NIST, like ISO.

而且，如果我们围绕行业标准关注这个问题，我们就可以开始思考一些最佳实践框架，例如 NIST、ISO。

But the, real issue is, who is putting those standards forward?

但真正的问题是，谁提出这些标准？

Are these industry-led standards?

这些是行业主导的标准吗？

Are these government mandates?

这些是政府的命令吗？

If they’re government mandates, are they by country or is this some type of international body?

如果它们是政府的指令，是按国家/地区还是某种类型的国际机构？

And, I can tell you that the individuals, who participated in our round table, who were very much like the participants, in terms of background, those that we interviewed in our study, certainly preferred the idea of industry-led standards.

而且，我可以告诉你，参加我们圆桌会议的个人，就背景而言，与我们在研究中采访的参与者非常相似，当然更喜欢行业主导标准的想法。

That, the individuals who really understand the technology and understand what it will take to, to reign in, the kind of behavior that, that we need to think critically about are the ones who come together and put these standards in place.

也就是说，那些真正了解技术并了解需要采取什么措施来控制这种行为的人，我们需要批判性地思考，他们是聚集在一起并制定这些标准的人。

[00:24:55] GUEST RHEA SIERS: And let me, I, I think I mentioned it at the top of this that, there were a couple of recent events that are examples of this, and the suspension of DOD’s, CMMC requirements, the, cybersecurity maturity model certification.

[00:24:55] 嘉宾 RHEA SIERS：让我，我，我想我在本文开头提到过，最近发生的几起事件就是这方面的例子，以及国防部、CMMC 要求、网络安全成熟度模型认证的暂停。

And so this is supposed to apply to all mandatory third-party audits.

因此，这应该适用于所有强制性第三方审核。

Yes, it’s amazing I remembered what that acronym stand- stood for.

是的，令人惊奇的是我还记得那个缩写词的含义。

this is about compliance though and, not standards.

但这是关于合规性，而不是标准。

And, reducing risk, as I said before, sometimes relocates it instead of removed it.

而且，正如我之前所说，降低风险有时会重新定位而不是消除它。

And if we wanna do this effectively, we have to do both together.

如果我们想有效地做到这一点，我们就必须同时做到这两点。

And we have to decide when we’re gonna do it, and we don’t have the luxury of time.

我们必须决定何时去做，但我们没有足够的时间。

we don’t have it at all, especially when we’re talking about some of the AI effects.

我们根本没有，特别是当我们谈论一些人工智能效果时。

[00:25:51] GUEST HOST STEPHANIE PELL: So understanding that we don’t have the luxury of time, what is your actionable advice for organizations today?

[00:25:51] 嘉宾主持人斯蒂芬妮·佩尔：了解到我们没有足够的时间，您对今天的组织有什么可行的建议？

[00:26:02] GUEST DIANA BURLEY: The first thing that, that I think came through both the roundtable and the study was that organizations should not fight concentration.

[00:26:02] 嘉宾戴安娜·伯利：我认为通过圆桌会议和研究得出的第一件事是组织不应该反对集中化。

It’s not a question of concentration being good or bad, it’s really about resilience.

这不是专注力好坏的问题，而是韧性的问题。

And so you don’t want to avoid vendor concentration for the sake of avoidance, but you want to make sure that you are engineering adaptive defenses around it so that you are thinking critically about all of the facets of enterprise risk, not just those that happen to, to come along with a particular type of, vendor.

因此，您不想为了避免而避免供应商集中，但您希望确保围绕它设计适应性防御，以便批判性地思考企业风险的所有方面，而不仅仅是那些碰巧与特定类型的供应商一起出现的风险。

[00:26:44] GUEST RHEA SIERS: And I would say that one of the fundamental takeaways from the study that bears on this that people should keep in mind is it’s kind of a paradox.

[00:26:44] 嘉宾 RHEA SIERS：我想说的是，人们应该牢记这项研究的基本要点之一是这是一种悖论。

concentration obviously can amplify catastrophic systemic risk, but it’s the only way to build real defensive strength.

集中显然会放大灾难性的系统性风险，但这是建立真正防御实力的唯一途径。

And so you have to balance those two.

所以你必须平衡这两者。

And you…

而你……

Diana and I have done a lot of work, I would say, on a multidisciplinary level, and I find myself going back to that, even about concentration risk.

我想说，戴安娜和我在多学科层面上做了很多工作，我发现自己又回到了这一点，甚至在集中风险方面也是如此。

As I, I think I said before, it’s not just about governance, it’s not just about operations, it’s about, business operation, business preparedness, and the ability to exist in, in, in this arena.

正如我之前所说，这不仅仅是治理，不仅仅是运营，而是业务运营、业务准备以及在这个领域存在的能力。

And we don’t, always do it that way, and that’s understandable, because sometimes we’re dealing just with incidents.

我们并不总是这样做，这是可以理解的，因为有时我们只是在处理事件。

But it’s not a holistic approach, and the holistic approach doesn’t just ap- apply to cyber concentration risk, obviously.

但这不是一种整体方法，而且显然，整体方法不仅仅适用于网络集中风险。

It applies across all cybersecurity.

它适用于所有网络安全。

And this is just another example and another wake-up call to why we need this kind of approach.

这只是另一个例子，也是我们为什么需要这种方法的另一个警钟。

[00:27:56] GUEST HOST STEPHANIE PELL: So Diana and Rhea, as, as we finish up for today, do you have any closing thoughts or ideas that you’d like to share?

[00:27:56] 嘉宾主持人斯蒂芬妮·佩尔：戴安娜和雷亚，在我们今天结束时，你们有什么想要分享的结束语或想法吗？

[00:28:05] GUEST DIANA BURLEY: First, thank you for giving us this platform.

[00:28:05] 嘉宾戴安娜·伯利：首先，感谢您给我们这个平台。

We are very excited to be able to share this work.

我们非常高兴能够分享这项工作。

It was, a, a long time coming and putting this study together.

花了很长时间才完成这项研究。

And I will say that, outside of what we have talked about in terms of managing, risk and thinking about resilience, I also wanna add in that as we think about supply chains and we think about the breadth of organizations that are in these supply chains and we look at very large organizations to very small ones, that is something that we have to keep in mind as we begin to look at questions around, resiliency and questions around concentration.

我要说的是，除了我们在管理、风险和对弹性的思考方面讨论的内容之外，我还想补充一点，当我们考虑供应链时，我们会考虑这些供应链中组织的广度，我们会考虑非常大的组织和非常小的组织，这是我们在开始考虑有关弹性和集中度的问题时必须牢记的事情。

Because as we add more regulation, as we add more requirements for, these organizations, it, just becomes, a challenge to ensure that at each level of institution, at each level of the supply chain, that we’re effectively able to navigate, to navigate all of those questions.

因为当我们增加更多的监管，当我们对这些组织增加更多的要求时，确保在机构的每个级别、供应链的每个级别，我们能够有效地解决所有这些问题，就成为一个挑战。

And so re- remember that resilience is not just about a single entity, but it’s really about an entire market, even beyond, a, an individual supply chain.

因此请记住，弹性不仅仅涉及单个实体，而且实际上涉及整个市场，甚至超越单个供应链。

[00:29:26] GUEST RHEA SIERS: And I would add that I think one of the things that was very apparent to me during the interviews was the thoughtfulness of these leaders in cyber about this issue.

[00:29:26] 嘉宾 RHEA SIERS：我想补充一点，我认为在采访中对我来说非常明显的一件事是这些网络领域的领导者对这个问题的深思熟虑。

They’ve lived it, they’ve done it, but they’re also trying to think their way through it.

他们已经经历过，他们已经做到了，但他们也在努力思考如何解决它。

And, I’ve been in both the public and private sector environments, and I understand that some of the issues that have been raised here, have got to be addressed from all angles.

而且，我曾在公共和私营部门环境中工作过，我知道这里提出的一些问题必须从各个角度得到解决。

[00:29:58] And when we talk to the experts about it, they have some great views.

[00:29:58] 当我们与专家讨论这个问题时，他们有一些很好的观点。

For example, the issue of, regulations ver- versus standards, that we need to take the time to further listen to and perhaps to assist in the formulation of those thoughts.

例如，法规与标准的问题，我们需要花时间进一步倾听，或许还可以帮助形成这些想法。

[00:30:15] GUEST HOST STEPHANIE PELL: Diana and Rhea, thank you for joining me today.

[00:30:15] 嘉宾主持人斯蒂芬妮·佩尔：戴安娜和雷亚，谢谢你们今天加入我的行列。

It was really interesting to hear about your research that involved actual discussions with, Rhea, as you said it, people who are living these issues and having to make decisions on a daily basis.

听到你的研究真的很有趣，其中涉及与雷亚的实际讨论，正如你所说，那些生活在这些问题中并必须每天做出决定的人。

You can learn more about this topic by reading Diana and Rhea’s paper, “Resilience Rules: Securing the Enterprise in Concentrated Ecosystems”, which is available at TechTank on the Brookings site, accessible at brookings.edu.

您可以通过阅读 Diana 和 Rhea 的论文“弹性规则：保护集中生态系统中的企业”来了解有关此主题的更多信息，该论文可在布鲁金斯学会网站的 TechTank 上找到，也可通过 brookings.edu 访问。

Please explore more in-depth content on tech policy issues at TechTank, also accessible at brookings.edu.

请在 TechTank 上探索有关技术政策问题的更深入的内容，也可以通过 brookings.edu 访问。

This concludes another episode of the TechTank podcast.

TechTank 播客的另一集到此结束。

Thank you for listening.

感谢您的聆听。

[00:31:08] CO-HOST NICOL TURNER LEE: Thank you for listening to TechTank, a series of roundtable discussions and interviews with technology experts and policymakers.

[00:31:08] 联合主持人 NICOL TURNER LEE：感谢您收听 TechTank，这是一系列圆桌讨论以及对技术专家和政策制定者的采访。

For more conversations like this, subscribe to the podcast and sign up to receive the TechTank newsletter for more research and analysis from the Center for Technology Innovation at Brookings.

欲了解更多此类对话，请订阅播客并注册接收 TechTank 时事通讯，以获取布鲁金斯学会技术创新中心的更多研究和分析。