Posts

Yet Another Potential AI Security Problem

Image
I know that AI is advancing so rapidly that there are going to be many stories like this unless and until we ethical humans catch up. I know that there are solid use cases for AI, even within cybersecurity. I know that we must all fight the all-or-nothing, good-or-evil, boon-or-bane dichotomy that seems to define the Internet these days. And yet this news item really gave me pause: OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider The sub headline isn't any more comforting: AgentForger allows an attacker to create, insert and remotely control an invisible autonomous AI agent inside a victim organization. This model of bug reporting doesn't help: hey, there was this terrible issue that we fixed and now everyone knows about it but also it should be fixed now, really. I understand that it is a bad idea to trumpet issues until those issues are fixed, but the effect is still somewhat unsettling. The point is not that AI is worth the risk in all cases and i...
Post a Comment
Read more

I'm Sorry Dave

Image
I'm sorry Dave. I am afraid that I can't do that. Well, that was fast. Only a few days ago I blithely invoked the HAL 9000  and now I regret it because  a real life AI has gone and done something...unsettling. CNN needed a very long headline to convey it: An OpenAI test model escaped and broke into a real company’s servers The opening paragraph of this article is just as concerning as you would expect: OpenAI says some of its experimental AI models left a test environment with no human direction and hacked its way onto a different company’s real production systems while trying to “cheat” on a cybersecurity test.  Yes, you read that correctly: a not-ready-for-release AI broke out of its containment area (supposedly a private network without access to the Internet) and then hacked a company's server in order to try to get a leg up on an upcoming test. Let's stress the disturbing parts: The AI deliberately broke out of the area assigned to it. It decided to cheat on a test...
Post a Comment
Read more

The Gold Eagle Has Landed

Image
In my previous post I bemoaned the fact that there is so little pooling of cybersecurity resources. All around the Internet we find the twin themes of "AI is the future of {pick an activity}" and "AI will destroy our economies, our minds and our freedoms." In cybersecurity specifically these twin themes are expressed in a mind-bending mobius strip of "we all need AI to protect us from AI." I see the lack of pooled resources as a drawback inherent in capitalism: for-profit organizations exist to generate profits and that usually means winning against competitors which does not lead to cooperative behavior. This drawback can be mitigated by government action and today we have an example of this kind of government action in initiative which rejoices in the name "Gold Eagle." From CNN,   White House launches AI cybersecurity clearinghouse . The White House’s clearinghouse, dubbed Gold Eagle , is a joint project across the Treasury, the Department o...
Post a Comment
Read more

Dear HAL 9000

Image
Reading the news lately has me wishing that, in the wake of cybersecurity incidents, there was something between press releases and brutal take downs. I don't want the bland reassurance of the average press release. I don't want the 20/20 hindsight of the average blog post. When I see a cybersecurity incident in the news I want a clear, credible description of the issue, ideally from the people who experienced that incident, followed by some expert advice, perhaps from an AI. I want Dear Abby  but written by the HAL 9000 . On the one hand the spin machine is trying to minimize the business impact of whatever happened. Mostly these efforts are aimed a share price and market share, instead of enlightenment and greater community security. On the other hand the click bait is trying to paint a terrible picture of the kind of horror we can all feel better reading about--at least I'm not that guy! True, there are a few cybersecurity news outlets which are both responsible and tech...
Post a Comment
Read more

Seven Words Lead To Your Improvement

Image
Once upon a time I took a ride in a car share service (not naming it) in Los Angeles. I got a 'shared' ride, which was cheaper, seemed like it would get me where I needed to be on time, and thus was my best option. Surely, thought I, the All-Powerful car share service's (not naming it) AI would know we were all going to same direction etc. First the car picked me up. Then it drove over to another location to pick up the next rider. Then another. Then, after riding around LA (I'm not from LA so we might as well have been driving around the desert) we dropped off one rider, the one who got in last. Then we dropped off the first other rider. Then we drove around some more. Finally we got to my destination. I looked at the driver. He looked at me. For the first time we spoke to each other. I said, "How could I do better tomorrow?" He said, "You need to start sooner." I thanked him, gave him a five-star rating and a nice tip because he had given me the be...
Post a Comment
Read more

Pulling In the Same Direction

Image
Let's talk about team dynamics, both in general and then specifically what Pythia Cyber can do to help you improve or maintain your cybersecurity team's performance. We start with that tired cliche, the crew team. On the surface, what a metaphor! You are all literally strapped into the same structure and all doing basically the same thing. It seems as though it would be easy to see if everyone is doing their job. Teamwork makes the dream work! Furthermore the usual thing is to picture a great crew having a great row. This image is, to say the least, skipping over an awful lot of reality. I know because I rowed a little myself and was the worst part of a great team and the mediocre middle of a terrible team. Those experiences were very different from each other, although superficially similar. In high school I was asked to fill for an absent team member for a coxed 4. I found the experience delightful, except for the extraordinary amount of effort and fatigue. We hummed along qu...
Post a Comment
Read more

Beware "All or Nothing"

Image
The technological base of most modern networking is rather naive with respect to security. It was created on the assumption that connection was good and that networks exist to transmit data and facilitate access to resources. Ah, the innocence of those simpler times. The same was true of most software: it was written to be used. Once you logged into the mainframe or minicomputer or departmental server, you were authorized to do whatever there was to do. The original PC environments had no authorization at all: you turned them on and started typing. This history means that an awful lot of technology's original authorization scheme was "none at all."  Adding authorization has not been easy, especially in a client/server environment. In a client/server environment we rarely can be certain of the other end which makes trust difficult to establish and maintain. Early authentication was based mostly on permission schemes layered on after logging in. Early sys admins used permis...
Post a Comment
Read more