Bolstering cyber resilience in an AI-powered world

Among all the frenzy surrounding advanced AI today, it’s easy to get lost in the hype.

 

With Anthropic claiming to have developed a platform so powerful it needs to be tightly controlled, and OpenAI revealing its most advanced model escaped an isolated testing environment before going on to discover and exploit additional vulnerabilities and break into the network on Hugging Face, the world has been flooded with headlines about AI and the risks, opportunities and capabilities it presents.

 

While exciting, and often entertaining, to many business leaders, the headlines and sensational claims are also causing one thing – concern.

 

Concern about what advanced AI means for their defences and whether they will still hold. Concern about the impact of AI on patch cycles and resources. Concern that AI-enabled attacks will be unstoppable. And concern over how malicious actors will use AI to launch attacks.

 

These concerns are valid.  

 

There is no denying the power of today’s most advanced AI platforms. The technology industry has changed in ways only previously experienced during the dawn of the World Wide Web.

 

However, this doesn’t have to mean our defences have diminished.  They need to be modernised to remain effective in today’s advanced AI-powered world.

 

Patch every day

One of the biggest concerns organisations are assessing today is the impact AI will have on patch cycles.

 

With models being capable of finding thousands of vulnerabilities at speed, there are growing concerns this means organisations will have to move into continuous firefighting mode.

 

These concerns are once again justified, but they also must be viewed in context.

 

We are already seeing an increase in vulnerability disclosures, with the June and July Microsoft Patch Tuesday updates both being record breaking, with last month’s addressing 622 CVEs.

 

However, despite advanced AI models being able to rapidly uncover CVEs, patching should continue to be risk-based.

 

It’s likely organisations will have to evolve from routine patching to continuous patching, where cycles are optimised to meet the speed at which AI finds flaws, but remediation should always be risk based.

 

Organisations must take time to understand CVEs and, more specifically, how they will impact their environment.

 

This does mean organisations must have up-to-date architecture inventories, and an up-to-date list of the applications and third parties they depend on, but it doesn’t mean patching everything immediately.  

 

Another key element of this is how certain vulnerabilities impact supply chain partners.

 

It is essential that organisations modernise their agreements with suppliers to ensure they are updating their security processes to keep pace with vulnerability disclosures.

 

This must move beyond point-in-time questionnaires to regular updates.

 

Organisations should also ensure timelines for addressing critical CVEs are built into SLAs to minimise the risks of supply chain incidents.

 

Preparing for the malicious use of AI

When it comes to the malicious use of AI by threat actors and nation states, this is something organisations must be prepared for.

 

However, it is also worth noting that AI tools are noisy and not necessarily stealthier than traditional attack techniques.

 

While they can scale the detection of vulnerabilities, the platforms often resort to less subtle techniques that most mature cyber security operations centres would detect.

 

Unlike a penetration tester or a malicious human actor, advanced AI platforms don’t tire.

 

Instead, they will try every scenario possible to reach an objective.

 

They are also getting better at chaining together attack paths, which was noted in the technical report developed by Hugging Face after the incident it faced with OpenAI.

 

This offers attackers significant opportunities, particularly with the initial stages of a compromise.

 

By finding vulnerabilities and working tirelessly to identify ways to exploit them, AI can significantly reduce the reconnaissance element of attacks, making them faster and easier to execute.

 

This reinforces the importance of organisations applying patches to the most critical vulnerabilities, therefore closing the window before agents can find and exploit them.

 

However, given that many organisations are currently lacking the resources to move to continuous patching, detection and response should also be deployed to add an additional layer of security.

 

Detection and response means that even if an organisation has not applied a patch to a CVE, or a zero-day exists in its architecture, there is an additional opportunity to identify malicious activity within the Security Operations Centre.

 

This means that even if an attacker gains network access by exploiting an unpatched vulnerability, security teams have an opportunity to detect and contain the incident before it turns into a full-scale compromise.

 

Building resilience in an AI-powered world

Advanced AI is here to stay, but this doesn’t mean our defences have dissolved.

 

Even in the face of highly capable models, the fundamentals still apply. There are some key steps organisations can take to ensure their defences and resilience remain intact.

 

Double down on cyber fundamentals

The rise of advanced AI does not replace the importance of good cyber hygiene.

 

Organisations should continue to prioritise vulnerability management, but be prepared to update their patch management cycles to meet the frequency of disclosures they are set to face. Furthermore, multi-factor authentication, penetration testing, red teaming, managed detection and response and staff training are all essential in further bolstering defences.   

 

Reduce technology debt

This is something organisations could previously get away with, but advanced AI platforms shine a spotlight on this overlooked infrastructure.

 

Legacy systems, unsupported software and unnecessary complexity are becoming increasingly difficult to justify. Organisations should continue to modernise and simplify their technology estates wherever possible.

 

Prepare for faster supply chain risk

Advanced AI has the potential to identify software vulnerabilities at unprecedented speed, increasing the likelihood that supply chain weaknesses will be discovered and exploited more quickly.

 

Organisations should strengthen third and fourth-party risk management, understand dependencies across their supply chain and ensure response plans are in place for large-scale software or supplier-related incidents.

 

Avoid creating a single point of failure

Organisations should avoid relying on only one advanced AI platform for their cyber security. With Mythos and Fable temporarily being suspended without warning as a result of a restriction from the US government, organisations should understand that a situation like this could occur again, so it’s better to diversify platforms rather than relying on one.

 

Building flexibility into AI strategies will help organisations maintain resilience if similar disruptions occur in the future.

 

Furthermore, organisations should also prepare for regulatory intervention regarding the use of AI. Governments worldwide are currently assessing advanced AI regulations, so it is vital organisations are prepared for this, as it could impact how they use, deploy and purchase AI.

 

Use AI as a catalyst for board engagement

The growing attention surrounding advanced AI presents an opportunity to strengthen conversations with boards about cyber resilience. Rather than focusing solely on emerging technology, organisations should use this moment to drive investment in governance, resilience planning, cyber security maturity and long-term risk reduction.

 

Changing the technology landscape

AI has changed the technology landscape in ways few organisations were prepared for.

 

Yet, even in the face of the highly advanced models we are seeing today, and will see tomorrow, to safeguard resilience, the fundamentals are more important than ever.

 

---

 

Gaven Smith is a former CTO of GCHQ and NED at Beyond Blue; David Ferbrache is a former head of cyberspace at the Ministry of Defence and managing director at Beyond Blue

 

Main image courtesy of iStockPhoto.com and amgun