Sabuwar Tufafin Tsaro na AI na Sarkin sarakuna: Yayin da muke kallon Muse, Gidauniyar ta rushe
Bari mu kasance kai tsaye: masana'antar fasaha tana da sabon ra'ayi, kuma ana kiranta " Tsaron AI." Ana sa ran dukkanmu za mu mai da hankali kan allura cikin gaggawa, da guba samfurin, da kuma fitar da bayanai daga manyan nau'ikan harshe. A halin yanzu, ainihin, na zahiri, kayan aikin dijital da ke riƙe da kasuwancinmu tare ana cinnawa wuta ta hanyar wuce gona da iri na kwanaki. Wani abin da ya faru kwanan nan wanda ya shafi babban dandamali na AI, wanda ke kwatanta ƙalubalen ƙalubalen tabbatar da abubuwan more rayuwa na AI, yana ba da ƙarin haske game da wannan dichotomy mai haɗari [1].
Meta, wani kamfani da aka sani da "tafiya da sauri da karya abubuwa" dabi'un, ya fuskanci bincike kan kurakuran tsaro a cikin dandamali na AI. Misali, shirin kyauta na kwaro ya bankado wani babban aibi da ke fallasa injinan Virtual Machines. Wannan ba leken asirin bayanai bane ko wayo mai saurin wucewa ba, amma babban kuskuren matakin kayan more rayuwa wanda ya fallasa * VMs mai amfani*. Wannan ba wasu lahani na musamman na AI ba ne; wannan shine ainihin keɓewar VM, matsalar da muka fi tunanin ta shawo kanta shekaru goma da suka gabata. Yana wakiltar mummunar keta sirri da amincin bayanai, yana tasiri kai tsaye ga masu amfani da yuwuwar abokan cinikin kasuwancin da ke ba da damar irin waɗannan ababen more rayuwa na AI.
Wannan nau'in aibi, yayin da yake da tasiri sosai, yana jin ƙarancin ƙalubalen "tsaro na AI" kuma ya fi kama da gazawar abubuwan more rayuwa sanye da hular AI. Yana da tunatarwa cewa hatta manyan dandamali na AI an gina su akan yadudduka na ƙididdigewa na al'ada, hanyar sadarwa, da haɓakawa. Idan waɗannan ginshiƙan tushe suna cike da ramuka, ba kome ba yadda ƙirar AI ɗinku ta ƙware; duk tsarin ya kasance mai rauni. Bangaren "AI" na wannan labarin kusan shine karkatacce, karkatacciyar hanya ce da ke janye kallonmu daga ruɓaɓɓen katako a ƙarƙashin allunan da aka goge.
CISA's KEV Barrage: Mahimman Nuni
Yayin da muke shagaltuwa da yin muhawara game da tasirin da'a na saƙon chatbots da kuma abubuwan da ke tattare da amincin AI, CISA tana faɗuwa da adadin da ba a taɓa ganin irinsa ba na raunin da ake amfani da shi a cikin kasidar ta sanannen Exploited Vulnerabilities (KEV). Wannan ba aikin motsa jiki bane. Wannan ba jerin "faci wata rana" bane. Wannan jerin gaggawa ne "gidan ku yana cin wuta yanzu".
A cikin 'yan makonnin nan, CISA ta ƙara shigarwar da yawa, tana kawo jimillar raunin da aka yi amfani da su a hankali zuwa adadi mai ban mamaki a cikin ɗan gajeren lokaci [2]. Wannan ba kawai "tsaro yana da kyau" ba; wannan tsari ne, da ke daɗa tabarbarewar rikice-rikicen da ke yin tasiri ga babbar manhajar kasuwanci da ke tafiyar da duniyarmu.
Yi la'akari da ƙarin kwanan nan zuwa kundin KEV:
- CVE-2023-46214: Rashin lahanin aiwatarwa na Kamfanin Splunk Enterprise (CVSS 9.8) tare da ƙarshen facin CISA, yana mai da tsarin da ba a buɗe ba yana da rauni sosai. CVE-2023-29357: Microsoft SharePoint Server gata haɓaka rauni, yana shafar ƙashin bayan manyan intranet na kamfanoni. CVE-2023-42824: Rashin lahani na kwaya ta Apple iOS/iPadOS, wanda aka riga aka yi amfani da shi a cikin hare-haren da aka yi niyya, yana nuna cewa hatta tsarin muhallin da aka sarrafa ba zai iya yiwuwa ba. CVE-2023-30799: MikroTik RouterOS Laifin aiwatar da lambar nesa, yana tasiri masu amfani da hanyoyin sadarwa waɗanda ke haɗa komai, galibi ana barin su a cikin kusurwoyi mafi zurfi na hanyar sadarwa.
Wannan ƙarin saurin-wuta na kwanaki sifili da aka yi amfani da shi a cikin manyan dillalai - Microsoft, Apple, Splunk, MikroTik, Linux, JFrog - yana buƙatar kulawa nan da nan. Wannan ba faɗakarwa ba ce; siren ne da ke fitowa kai tsaye a kowane IT da ƙungiyar tsaro. Jerin KEV na CISA ba shawara ce kawai ga hukumomin tarayya ba; gargadi ne mai mahimmanci ga duk kungiyoyi. Yi watsi da shi a cikin haɗarin ku.
Haƙiƙa na "Tsaron AI" da kuma tsadar ɓarna
Anan ga gaskiyar mara dadi: ginshiƙi na asali a cikin dandamali na AI da barrage na CISA KEV abubuwan haɗin haɗin gwiwa ne na matsala iri ɗaya. Dukansu biyun suna kururuwa game da rugujewar asali a cikin tsaro na software, amma kallon gama-garin masana'antar mu yana da haɗari da haɗari. Alƙawari da haɗarin "AI" sun burge mu sosai har muna barin tushen abubuwan more rayuwa na dijital su ruɓe.
"Tsaron AI" ya zama babban magana, sabon kan iyaka ga masu ba da shawara da manajan samfur. Amma menene, gaske? Sau da yawa, kawai * tsaro* ana amfani da tsarin AI. Ee, AI yana gabatar da sabbin hanyoyin kai hari da ƙalubale na musamman, amma babban ɓangaren "Tsaron AI" shine kawai injinin ƙarfi mai ƙarfi, amintattun ayyukan ƙididdigewa, da faci mai ƙwazo - abubuwa iri ɗaya da muka gaza shekaru da yawa. Batun keɓewar VM da aka ambata a baya misali ne cikakke: ƙaƙƙarfan raunin da aka haɓaka ta hanyar rikitaccen dandamali na AI.
Muna gina tsarin AI mai sarƙaƙƙiya mai ban sha'awa a kan tushe masu rauni da kuma fa'ida sosai. Yana kama da ƙirƙira mota mai tuƙi da kai tare da ci-gaba na kewayawa na AI, yayin da ƙafafun ke faɗuwa kuma injin ɗin yana toshewa. Mayar da hankali kan "Tsaron AI" sau da yawa yana jin kamar karkatar da hankali, karkatar da albarkatu da hankali daga al'amuran yau da kullun, marasa kyan gani, amma cikakkiyar mahimmin aiki na tabbatar da ababen more rayuwa.
Shin muna shagaltuwa da bin babban abu na gaba har muna barin manyan abubuwan na yanzu sun ƙone? Girman girma da faɗin barazanar KEV suna nuna ƙalubalen tsari da gaggawa ga tushen abubuwan more rayuwa na dijital, wanda ya bambanta da tattaunawar rana ta sifili na AI na baya. Wannan ba game da makomar AI ba; game da halin yanzu na kasancewar mu na dijital.
Menene Yanzu, CTOs?
Don jagorar injiniya da CTOs, saƙon yana nan da nan:
- Ba da fifikon lissafin KEV: Ajiye komai. Faci waɗannan raunin. Wajabta shi. tilasta shi. Wannan ba na zaɓi ba ne.
- **Kada a yi amfani da shi a cikin "tsaro na AI" a cikin kuɗin kuɗi na asali: *** Ee, ku fahimci kasada na musamman na AI, amma ku tuna cewa injiniya mai ƙarfi, amintaccen ci gaba na rayuwa, da faci mai ƙwazo har yanzu shine mafi kyawun tsaro. Kyakkyawan samfurin AI ba zai cece ku ba idan maharin ya mallaki VM ɗin ku ko uwar garken SharePoint ɗin ku.
- ** Zuba jari a cikin tushen tsaro:** Wannan yana nufin fiye da siyan wani kayan aikin tsaro kawai. Yana nufin saka hannun jari a cikin mutane, matakai, da al'adun da ke darajar tsaro a matsayin babban horo na injiniya, ba tunani na baya ba. Shirye-shiryen kyauta na bug suna da kyau, amma yakamata su zama hanyar tsaro, ba dabarun tsaro na farko ba.
Lamarin da ya shafi kayan aikin dandamali na AI kira ne na farkawa, amma jerin CISA KEV shine ƙararrawa na gaggawa. Muna buƙatar dakatar da sha'awar sabbin tsare-tsaren tsaro na AI kuma mu fara faci ramukan da ke cikin ainihin tsaronmu. Makomar AI tana da ban sha'awa, amma halin yanzu na tsaron mu yana da ban tsoro.
Sources
[1] Tsaron AI ya zama rikici, kuma yana gab da yin muni - https://techcrunch.com/2023/10/11/ai-security-is-a-mess-and-its-about-to-to-mummunan/ [2] Sanann Katalogi na Rarrabuwa - https://www.cisa.gov/known-exploited-vulnerabilities-catalog