Emperor's Tshiab AI Cov Khaub Ncaws Kev Ruaj Ntseg: Thaum Peb Saib ntawm Muse, Lub Tsev Haujlwm Crumbles
Cia peb hais ncaj qha: kev lag luam thev naus laus zis muaj qhov xav tau tshiab, thiab nws hu ua "AI kev ruaj ntseg." Peb txhua tus xav kom tsom mus rau kev txhaj tshuaj sai, ua qauv tshuaj lom, thiab tshem tawm cov ntaub ntawv los ntawm cov qauv lus loj. Lub caij no, qhov tseeb, lub cev, digital infrastructure tuav peb cov lag luam ua ke yog nquag ua rau hluav taws los ntawm qhov tsis muaj zog ntawm xoom-hnub. Ib qho xwm txheej tsis ntev los no uas cuam tshuam nrog lub platform AI loj, piv txwv ntawm cov kev sib tw dav dua hauv kev ruaj ntseg AI infrastructure, qhia txog qhov txaus ntshai dichotomy [1].
Meta, lub tuam txhab paub txog nws "txav nrawm thiab ua txhaum yam" ethos, tau ntsib kev tshuaj xyuas txog kev ruaj ntseg tsis zoo hauv nws lub platform AI. Piv txwv li, qhov kev pab cuam kab laum tau nthuav tawm qhov teeb meem tseem ceeb nthuav tawm cov neeg siv Virtual Machine. Qhov no tsis yog qhov hloov maj mam cov ntaub ntawv tawm los yog qhov ntse ntse bypass, tab sis qhov tseem ceeb, kev teeb tsa-qib yuam kev uas nthuav tawm * neeg siv VMs *. Qhov no tsis yog qee qhov esoteric AI tshwj xeeb qhov tsis zoo; qhov no yog qhov yooj yim VM cais tawm, ib qho teeb meem uas peb xav tias tamed ib xyoo caum dhau los. Nws sawv cev rau qhov kev ua txhaum cai tseem ceeb ntawm kev ceev ntiag tug thiab cov ntaub ntawv ncaj ncees, cuam tshuam ncaj qha rau cov neeg siv thiab cov neeg lag luam uas muaj peev xwm siv cov khoom siv AI li no.
Hom kev tsis haum no, thaum muaj kev cuam tshuam tiag tiag, xav tias tsawg dua li qhov tshiab "AI kev ruaj ntseg" kev sib tw thiab ntau dua li qhov tsis ua haujlwm classic tsis hnav lub kaus mom AI. Nws yog ib qho tseem ceeb kom nco ntsoov tias txawm tias AI platforms siab tshaj plaws tau tsim los ntawm cov txheej txheem ntawm kev suav, kev sib tham, thiab virtualization. Yog tias cov txheej txheej hauv qab no tau riddled nrog lub qhov, nws tsis muaj teeb meem li cas sophisticated koj tus qauv AI; tag nrho cov system tseem muaj kev cuam tshuam. Qhov "AI" nam ntawm zaj dab neeg no yuav luag muaj kev cuam tshuam, kev coj tsis ncaj uas ua rau peb saib deb ntawm cov ntoo rotting hauv qab polished floorboards.
CISA's KEV Barrage: A Critical Indicator
Thaum peb tab tom tsis khoom sib cav txog qhov cuam tshuam txog kev coj ncaj ncees ntawm kev xa xov chatbots thiab cov nuances ntawm AI kev nyab xeeb, CISA tab tom tso tus lej tsis tau pom dua los ntawm kev ua haujlwm tsis zoo rau hauv nws cov ntawv teev npe Paub Siv Tau Zoo (KEV). Qhov no tsis yog kev xyaum theoretical. Qhov no tsis yog "patch ib hnub" daim ntawv teev npe. Nov yog qhov xwm txheej ceev "koj lub tsev raug hluav taws * tam sim no*" daim ntawv teev npe.
Nyob rau lub asthiv tsis ntev los no, CISA tau ntxiv ntau qhov kev nkag, nqa tag nrho cov kev ua haujlwm tsis zoo rau cov lej tsis txaus ntseeg hauv lub sijhawm luv [2]. Qhov no tsis yog "kev ruaj ntseg tsis zoo"; qhov no yog ib qho systemic, escalating ntsoog cuam tshuam qhov tseem ceeb heev enterprise software uas khiav peb lub ntiaj teb no.
Xav txog qhov tsis ntev los no ntxiv rau KEV catalog:
- ** CVE-2023-46214:** Splunk Enterprise tej thaj chaw deb code execution vulnerability (CVSS 9.8) nrog rau CISA thaj hnub kawg, ua rau cov tshuab tsis muaj kev tiv thaiv zoo heev.
- ** CVE-2023-29357:** Microsoft SharePoint Server muaj cai nce ntxiv qhov tsis zoo, cuam tshuam rau cov pob txha ntawm suav tsis txheeb cov tuam txhab intranets.
- ** CVE-2023-42824:** Ib qho Apple iOS/iPadOS kernel qhov tsis zoo, twb tau siv rau hauv cov phiaj xwm tawm tsam, ua pov thawj tias txawm tias tswj hwm ecosystems tsis muaj kev cuam tshuam.
- ** CVE-2023-30799:** MikroTik RouterOS tej thaj chaw deb code execution flaw, cuam tshuam cov routers uas txuas txhua yam, feem ntau sab laug unpatched nyob rau hauv lub deepest ces kaum ntawm lub network.
Qhov sib ntxiv ntawm hluav taws kub ceev no ntawm kev siv zog xoom-hnub thoob plaws cov neeg muag khoom loj - Microsoft, Apple, Splunk, MikroTik, Linux, JFrog - xav tau tam sim ntawd, frantic mloog. Qhov no tsis yog lus ceeb toom dav dav; nws yog ib tug siren blaring ncaj qha ntawm txhua pab neeg IT thiab kev ruaj ntseg. CISA's KEV daim ntawv teev npe tsis yog ib qho kev tawm tswv yim rau tsoomfwv cov koom haum; nws yog qhov ceeb toom tseem ceeb rau *tag nrho * cov koom haum. Tsis quav ntsej nws ntawm koj qhov xwm txheej.
Qhov kev xav ntawm "AI Security" thiab tus nqi cuam tshuam
Ntawm no yog qhov tsis xis nyob qhov tseeb: lub hauv paus tsis zoo hauv AI platforms thiab CISA KEV barrage yog qhov sib cuam tshuam ntawm tib qhov teeb meem. Lawv ob leeg qw hais txog qhov kev puas tsuaj tseem ceeb hauv kev ruaj ntseg software, tab sis peb txoj kev lag luam kev sib koom ua ke yog qhov txaus ntshai tsis zoo. Peb txaus siab heev los ntawm cov lus cog tseg thiab kev phom sij ntawm "AI" uas peb tau tso lub hauv paus ntawm cov txheej txheem digital rot.
"AI kev ruaj ntseg" tau dhau los ua cov lus buzz, qhov chaw tshiab rau cov kws pab tswv yim thiab cov thawj coj khoom. Tab sis nws yog dab tsi, tiag tiag? Feem ntau, nws tsuas yog * kev ruaj ntseg * siv rau AI systems. Yog lawm, AI qhia txog cov kev tawm tsam tshiab thiab cov kev sib tw tshwj xeeb, tab sis ib feem tseem ceeb ntawm "AI kev ruaj ntseg" yog qhov yooj yim engineering, ruaj ntseg coding xyaum, thiab mob siab rau patching - tib yam khoom uas peb tau ua tsis tiav nyob rau ntau xyoo lawm. Qhov teeb meem kev rho tawm VM tau hais ua ntej yog qhov piv txwv zoo tshaj: qhov tsis muaj peev xwm classic tau nthuav dav los ntawm qhov nyuaj ntawm AI platform.
Peb tab tom tsim cov txheej txheem AI tsis txaus ntseeg nyob rau sab saum toj ntawm kev ua kom tsis yooj yim thiab nquag siv lub hauv paus. Nws zoo ib yam li kev tsim lub tsheb tsav tus kheej nrog AI navigation siab heev, thaum lub log poob thiab lub cav yog sputtering. Kev tsom mus rau "AI kev ruaj ntseg" feem ntau xav tias muaj kev cuam tshuam, cuam tshuam cov peev txheej thiab kev saib xyuas los ntawm lub ntiaj teb, tsis zoo, tab sis tseem ceeb heev ua haujlwm ntawm kev ruaj ntseg uas twb muaj lawm.
Puas yog peb tibneeg hu tauj coob coob ntxiv uas peb tso cov khoom loj tam sim no hlawv? Qhov loj me me thiab qhov dav ntawm KEV hem thawj qhia tau hais tias muaj kev sib tw tseem ceeb thiab nrawm rau lub hauv paus ntawm cov txheej txheem digital, txawv ntawm kev sib tham yav dhau los AI-centric xoom-hnub. Qhov no tsis yog hais txog yav tom ntej ntawm AI; nws yog hais txog lub xeev tam sim no ntawm peb lub neej digital.
Tam sim no, CTOs yog dab tsi?
Rau engineering coj thiab CTOs, cov lus yog stark thiab tam sim ntawd:
- Ua ntej daim ntawv teev npe KEV: Tso txhua yam. Patch cov vulnerabilities. Mandate nws. yuam nws. Qhov no tsis yog xaiv tau.
- ** Tsis txhob thab hauv "AI kev ruaj ntseg" hype ntawm tus nqi ntawm cov hauv paus ntsiab lus:** Yog lawm, nkag siab txog cov kev pheej hmoo tshwj xeeb ntawm AI, tab sis nco ntsoov tias kev ua haujlwm ruaj khov, kev nyab xeeb kev loj hlob lifecycles, thiab mob siab rau patching tseem yog koj qhov kev tiv thaiv zoo tshaj plaws. Tus qauv AI zoo nkauj yuav tsis cawm koj yog tias tus neeg tawm tsam muaj koj tus VM hauv qab lossis koj tus neeg rau zaub mov SharePoint.
- Kev nqis peev hauv kev ruaj ntseg hauv paus: Qhov no txhais tau tias ntau dua li kev yuav lwm yam kev ruaj ntseg. Nws txhais tau tias kev nqis peev rau tib neeg, txheej txheem, thiab kab lis kev cai uas muaj txiaj ntsig zoo rau kev nyab xeeb raws li kev qhuab qhia tseem ceeb hauv engineering, tsis yog kev xav tom qab. Kab laum cov kev pab cuam zoo heev, tab sis lawv yuav tsum yog qhov kev nyab xeeb, tsis yog koj lub tswv yim kev ruaj ntseg.
Qhov xwm txheej cuam tshuam nrog AI platform infrastructure yog kev hu xov tooj, tab sis CISA KEV daim ntawv teev npe yog lub tswb ceev. Peb yuav tsum tsum tsis txhob qhuas qhov tseeb AI kev ruaj ntseg pib thiab pib patching lub qhov nyob rau hauv peb cov kev tiv thaiv tiag tiag. Lub neej yav tom ntej ntawm AI yog qhov zoo siab, tab sis lub xeev tam sim no ntawm peb kev ruaj ntseg yog txaus ntshai.
Qhov chaw
[1] AI kev ruaj ntseg yog qhov tsis txaus ntseeg, thiab nws tab tom yuav hnyav dua - https://techcrunch.com/2023/10/11/ai-security-is-a-mess-and-its-about-to-get-worse/ [2] Paub Kev Ua Phem Txhaum Cai Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog