Izingubo Zokuvikeleka Ezintsha Ze-Emperor's AI: Ngenkathi Sibuka I-Muse, Isisekelo Siyabhidlika
Masiqonde: imboni yezobuchwepheshe ine-obsession entsha, futhi ibizwa ngokuthi "ukuphepha kwe-AI." Sonke kulindeleke ukuthi sigxile ekujovweni osheshayo, ubuthi bemodeli, kanye nokukhishwa kwedatha kumamodeli amakhulu olimi. Ngaleso sikhathi, ingqalasizinda yangempela, ebonakalayo, yedijithali ebambe amabhizinisi ethu ndawonye ithungelwa ngomlilo uhide lwezinsuku eziyiziro. Isigameko sakamuva esibandakanya inkundla ye-AI enkulu, ebonisa izinselelo ezibanzi ekuvikeleni ingqalasizinda ye-AI, sigqamisa le dichotomy eyingozi [1].
I-Meta, inkampani eyaziwa nge-ethos yayo "yokuhamba ngokushesha futhi yephule izinto", ibhekane nokucutshungulwa kwamaphutha ezokuphepha kumapulatifomu ayo e-AI. Isibonelo, uhlelo lwe-bug bounty lwembule iphutha elibalulekile elidalula umsebenzisi Imishini Ebonakalayo. Lokhu bekungekona ukuvuza kwedatha okucashile noma ukudlula ukwaziswa okuhlakaniphile, kodwa iphutha eliyisisekelo, lezinga lengqalasizinda elidalule ama-VMs womsebenzisi. Lokhu akubona ukuba sengozini okuthile kwe-AI-esoteric; lokhu ukuhlukaniswa kwe-VM okuyisisekelo, inkinga ebesicabanga ukuthi iyilungisile eminyakeni eyishumi edlule. Imele ukwephulwa okubalulekile kobumfihlo nobuqotho bedatha, okuthinta ngokuqondile abasebenzisi kanye namakhasimende okungenzeka amabhizinisi asebenzisa ingqalasizinda ye-AI enjalo.
Lolu hlobo lwamaphutha, nakuba lunomthelela wangempela, luzizwa lufana nenselelo yenoveli "yokuphepha kwe-AI" futhi lufana nokwehluleka kwakudala kwengqalasizinda ukugqoka isigqoko se-AI. Kuyisikhumbuzo sokuthi namapulatifomu e-AI athuthuke kakhulu akhelwe phezu kwezingqimba zekhompuyutha ezivamile, inethiwekhi, kanye ne-virtualization. Uma lezo zendlalelo eziyisisekelo zigcwele izimbobo, akunandaba ukuthi imodeli yakho ye-AI iyinkimbinkimbi kangakanani; lonke uhlelo luhlala lusengozini. Ingxenye ye-"AI" yale ndaba icishe ibe isiphazamiso, ukuduka okusondeza kude nezingodo ezibolayo ngaphansi kwamapulangwe aphansi aphucuziwe.
I-KEV Barrage ye-CISA: Inkomba Ebalulekile
Ngenkathi simatasa sidingida imithelela yesimilo yama-chatbots azwelayo kanye namanuances okuphepha kwe-AI, i-CISA iphonsa inani elingakaze libonwe lobungozi obuxhashazwe ngokuqhubekayo kukhathalogi yayo eyaziwa ngokuthi I-Know Exploited Vulnerabilities (KEV). Lokhu akuwona umsebenzi wasetiyetha. Lolu akulona uhlu "lolunye usuku". Lolu uhlu oluphuthumayo oluthi "indlu yakho iyasha okwamanje".
Emasontweni asanda kwedlula, i-CISA yengeze okufakiwe okuningi, okuletha ingqikithi yobuthakathaka obuxhashazwe ngenani elimangalisayo ngesikhathi esifushane [2]. Lokhu akukhona nje ukuthi "ukuphepha kubi"; lokhu kuyinkinga ehlelekile, ekhulayo ethinta isofthiwe yebhizinisi ebaluleke kakhulu ephethe umhlaba wethu.
Cabangela izengezo zakamuva kukhathalogi ye-KEV:
- CVE-2023-46214: Ukuba sengozini yokusebenzisa ikhodi yerimothi ye-Splunk Enterprise (CVSS 9.8) ngomnqamulajuqu wepeshi ye-CISA, okwenza amasistimu anganyathelisiwe abe sengozini kakhulu.
- CVE-2023-29357: Ilungelo le-Microsoft SharePoint Server ekhuphukayo ekubeni sengozini, okuthinta umgogodla wama-intranethi ezinkampani amaningi.
- CVE-2023-42824: Ukuba sengozini kwe-Apple iOS/iPadOS kernel, osekuvele kusetshenziswe ekuhlaselweni okuqondiwe, okubonisa ukuthi ngisho nezinhlelo zemvelo ezilawulwayo azingeneki.
- CVE-2023-30799: Iphutha ekusebenziseni ikhodi yerimothi ye-MikroTik RouterOS, enomthelela kumarutha axhuma yonke into, ngokuvamile ashiywe enganamathiselwe emakhoneni ajulile enethiwekhi.
Lokhu kwengezwa okusheshayo kokusetshenziswa kwezinsuku eziyiziro kubathengisi abakhulu - iMicrosoft, Apple, Splunk, MikroTik, Linux, JFrog - kudinga ukunakwa ngokushesha. Lesi akusona isixwayiso esijwayelekile; kuyinhlabamkhosi ekhala ngokuqondile kuwo wonke amathimba e-IT nezokuphepha. Uhlu lwe-KEV lwe-CISA alusona nje isiphakamiso sezinhlaka zikahulumeni; yisexwayiso esibucayi kuzo zonke izinhlangano. Kuzibe ngengozi yakho.
Inkohliso "Yokuphepha kwe-AI" kanye Nezindleko Zokuphazamiseka
Nali iqiniso elingakhululekile: amaphutha ayisisekelo kumapulatifomu e-AI kanye ne-CISA KEV barrage yizici ezixhumene zenkinga efanayo. Bobabili bayamemeza mayelana nokuwohloka okuyisisekelo kokuphepha kwesofthiwe, kodwa ukubuka ndawonye komkhakha wethu akuqondile ngendlela eyingozi. Sikhangwe isithembiso nobungozi be-"AI" kangangokuthi sivumela ingqalasizinda yedijithali ibole.
"Ukuphepha kwe-AI" sekuphenduke i-buzzword, umngcele omusha wabaxhumanisi nabaphathi bemikhiqizo. Kodwa kuyini ngempela? Ngokuvamile, kumane kusetshenziswe ukuphepha kumasistimu e-AI. Yebo, i-AI yethula ama-vector amasha okuhlasela nezinselele eziyingqayizivele, kodwa ingxenye enkulu "yokuphepha kwe-AI" imane iwubunjiniyela obuqinile, izinqubo zokufaka amakhodi ezivikelekile, kanye nokupeshwa okukhuthele - izinto ezifanayo ebesihluleka kuzo amashumi eminyaka. Udaba lokuhlukaniswa kwe-VM okukhulunywe ngalo ekuqaleni luyisibonelo esihle kakhulu: ukuba sengozini kwakudala okukhuliswe ubunkimbinkimbi benkundla ye-AI.
Sakha amasistimu e-AI ayinkimbinkimbi ngendlela emangalisayo phezu kwezisekelo ezintekenteke nezisetshenziswa ngokuqhubekayo. Kufana nokuklama ngokucophelela imoto ezishayelayo ene-Advanced AI navigation, kuyilapho amasondo ewa futhi injini ishosholoza. Ukugxila "kokuvikeleka kwe-AI" kuvame ukuzwakala njengokuphazamiseka, izinsiza eziphambukisayo nokunaka okuvela kokujwayelekile, okungathandeki, kodwa umsebenzi obaluleke kakhulu wokuvikela ingqalasizinda ekhona.
Ngabe simatasatasa sijaha into enkulu elandelayo size siyeke izinto ezinkulu zamanje zishise? Umthamo kanye nobubanzi bezinsongo ze-KEV kukhombisa inselelo ehlelekile nephuthumayo kwingqalasizinda yedijithali eyisisekelo, ehlukile ezingxoxweni zangaphambilini ze-AI-centric zero-day. Lokhu akuphathelene nekusasa le-AI; imayelana nesimo samanje sokuba khona kwethu kwedijithali.
Yini Manje, CTOs?
Kubaholi bobunjiniyela nama-CTO, umlayezo ucacile futhi uyashesha:
- Beka kuqala uhlu lwe-KEV: Beka yonke into. Pheca lobu bungozi. Igunyaze. Kugcizelele. Lokhu akuyona inketho.
- Ungangenelwa ekukhulumeni "kwezokuphepha kwe-AI" ngaphandle kokuchitha izinto ezibalulekile: Yebo, qonda ubungozi obuyingqayizivele be-AI, kodwa khumbula ukuthi ubunjiniyela obuqinile, umjikelezo wokuphila wokuthuthukiswa okuvikelekile, kanye nokuchibiyela ngenkuthalo kusewukuzivikela kwakho okungcono kakhulu. Imodeli ye-AI ephambili ngeke ikusindise uma umhlaseli engumnikazi we-VM yakho eyisisekelo noma iseva yakho ye-SharePoint.
- Tshala imali ekuvikelekeni okuyisisekelo: Lokhu kusho okungaphezu nje kokuthenga elinye ithuluzi lokuvikela. Kusho ukutshala imali kubantu, izinqubo, nesiko elazisa ukuvikeleka njengomkhakha wobunjiniyela owumongo, hhayi umcabango wakamuva. Izinhlelo ze-bug bounty zinhle kakhulu, kodwa kufanele zibe inethiwekhi yokuphepha, hhayi isu lakho eliyinhloko lokuvikela.
Isigameko esibandakanya ingqalasizinda yesikhulumi se-AI siwucingo lokuvuka, kodwa uhlu lwe-CISA KEV luyi-alamu ephuthumayo. Kudingeka siyeke ukuncoma imizamo yakamuva yezokuphepha ye-AI futhi siqale ukuchibiyela izimbobo ekuzivikeleni kwethu kwangempela. Ikusasa le-AI liyajabulisa, kodwa isimo samanje sokuvikeleka kwethu siyethusa.
Imithombo
[1] Ukuvikeleka kwe-AI kuyisiyaluyalu, futhi sekuzoba kubi kakhulu — https://techcrunch.com/2023/10/11/ai-security-is-a-mess-and-its-about-to-get-worse/ [2] Ikhathalogi Eyaziwayo Yokuxhashazwa Kwezingozi — https://www.cisa.gov/known-exploited-vulnerabilities-catalog