ʻO nā lole palekana AI hou o ka Emperor: ʻOiai mākou e nānā iā Muse, ua hāʻule ka Foundation.
E alakaʻi pololei kākou: ʻo ka ʻoihana ʻenehana kahi nānā hou, a ua kapa ʻia ʻo "AI security." Manaʻo ʻia mākou a pau e kālele i ka hoʻokē ʻana koke, ka make ʻana o nā kumu hoʻohālike, a me ka lawe ʻana i ka ʻikepili mai nā ʻōlelo hoʻohālike nui. Eia nō naʻe, ʻo ka ʻōnaehana maoli, kino, ʻenehana e paʻa ana i kā mākou ʻoihana e hoʻopau ʻia i ke ahi e ka pahu hoʻomaha mau ʻole o nā lā ʻole. ʻO kahi hanana hou e pili ana i kahi kahua AI koʻikoʻi, e hōʻike ana i nā pilikia ākea i ka hoʻopaʻa ʻana i ka ʻōnaehana AI, e hōʻike ana i kēia dichotomy weliweli [1].
ʻO Meta, kahi hui i ʻike ʻia no kāna "neʻe wikiwiki a wāwahi i nā mea" ethos, ua alo i ka nānā ʻana i nā hemahema palekana i kāna mau kahua AI. No ka laʻana, ua wehe kahi papahana bug bounty i kahi hemahema nui e hōʻike ana i ka mea hoʻohana Virtual Machines. ʻAʻole kēia he leakage ʻikepili maʻalahi a i ʻole ka hoʻokae wikiwiki ʻana, akā he hewa kumu, ʻoihana-level i hōʻike ʻia * mea hoʻohana VMs *. ʻAʻole kēia he mea nāwaliwali esoteric AI-specific; ʻO kēia ka hoʻokaʻawale VM maʻamau, kahi pilikia a mākou i manaʻo nui ai i hoʻopili ʻia i nā makahiki he ʻumi aku nei. Hōʻike ia i kahi hōʻino koʻikoʻi o ka pilikino a me ka pono o ka ʻikepili, e hoʻopilikia pololei i nā mea hoʻohana a me nā mea kūʻai aku ʻoihana e hoʻohana ana i kēlā ʻano hana AI.
ʻO kēia ʻano kīnā, ʻoiai ka hopena maoli, ʻoi aku ka liʻiliʻi e like me kahi moʻolelo "AI Security" paʻakikī a ʻoi aku ka like me ka hāʻule ʻole o ka ʻōnaehana maʻamau e kau ana i kahi pāpale AI. He mea hoʻomanaʻo e kūkulu ʻia nā paena AI kiʻekiʻe loa ma nā papa o ka compute maʻamau, networking, a me virtualization. Inā piha kēlā mau papa kumu i nā lua, ʻaʻole ia he mea nui ke ʻano o kāu kumu hoʻohālike AI; noho pilikia ka ʻōnaehana holoʻokoʻa. ʻO ka hiʻohiʻona "AI" o kēia moʻolelo he mea hoʻohilahila, kahi kuhi hewa e hoʻokaʻawale i ko mākou maka mai nā lāʻau popopo ma lalo o nā papa papahele i poni ʻia.
CISA's KEV Barrage: He hōʻailona koʻikoʻi
ʻOiai mākou e paʻa nei i ka hoʻopaʻapaʻa ʻana i nā hopena kūpono o nā chatbots sentient a me nā nuances o ka palekana AI, ke hoʻolei nei ʻo CISA i kahi helu ʻike ʻole o nā nāwaliwali i hoʻohana ʻia i loko o kāna Catalog Known Exploited Vulnerabilities (KEV). ʻAʻole kēia he hoʻomaʻamaʻa theoretical. ʻAʻole kēia he papa inoa "patch i kekahi lā". ʻO kēia kahi papa inoa "ua ahi kou hale i kēia manawa."
I nā pule i hala iho nei, ua hoʻohui ʻo CISA i nā helu he nui, e lawe mai ana i ka huina o nā nāwaliwali i hoʻohana ʻia i kahi helu staggering i kahi manawa pōkole [2]. ʻAʻole kēia he "ʻino ka palekana"; ʻo kēia ka pilikia e pili ana i ka polokalamu ʻoihana koʻikoʻi e holo nei i ko mākou honua.
E noʻonoʻo i nā hoʻohui hou i ka papa helu KEV:
- CVE-2023-46214: ʻO kahi Splunk Enterprise mamao hoʻokō code vulnerability (CVSS 9.8) me kahi CISA patch palena manawa, e hoʻonawaliwali loa i nā ʻōnaehana unpatched.
- CVE-2023-29357: ʻO Microsoft SharePoint Server ka hoʻonui ʻia ʻana o ka pono, e pili ana i ka iwi kuamoʻo o nā intranet hui lehulehu.
- CVE-2023-42824: ʻO Apple iOS/iPadOS kernel vulnerability, i hoʻohana mua ʻia i nā hoʻouka ʻana i manaʻo ʻia, e hōʻike ana ʻaʻole hiki ke komo i nā kaiaola i hoʻomalu ʻia.
- CVE-2023-30799: He hemahema hoʻokō code mamao MikroTik RouterOS, e hoʻopilikia ana i nā mea ala e hoʻopili ai i nā mea āpau, waiho pinepine ʻole ʻia ma nā kihi hohonu loa o ka pūnaewele.
ʻO kēia hoʻohui ahi wikiwiki o ka hoʻohana ikaika ʻana i nā lā ʻole ma waena o nā mea kūʻai nui - Microsoft, Apple, Splunk, MikroTik, Linux, JFrog - koi koke i ka nānā ʻana. ʻAʻole kēia he ʻōlelo aʻo nui; he kani kani pololei ia i kēlā me kēia IT a me ka hui palekana. ʻO ka papa inoa KEV o CISA ʻaʻole ia he manaʻo no nā keʻena federal; he ʻōlelo aʻo koʻikoʻi no nā hui *a pau. E haʻalele i kou pilikia.
ʻO ka Illusion o "AI Security" a me ke kumukūʻai o ka hoʻopiʻi
Eia ka ʻoiaʻiʻo ʻoluʻolu ʻole: ʻo nā hemahema kumu i nā kahua AI a me ka pā CISA KEV he mau mea pili i ka pilikia like. Uā lāua ʻelua e pili ana i ka haki ʻana o ka palekana lako polokalamu, akā kuhi hewa ʻole ka nānā ʻana o kā mākou ʻoihana. Pīhoihoi mākou i ka ʻōlelo hoʻohiki a me ka pōʻino o "AI" e ʻae nei mākou i ka pohō ʻana i ka ʻōnaehana kamepiula kumu.
Ua lilo ʻo "AI Security" i buzzword, kahi palena hou no nā mea kūkākūkā a me nā luna huahana. Akā, he aha ia? ʻO ka manawa pinepine, hoʻohana wale ʻia ka * palekana * i nā ʻōnaehana AI. ʻAe, hoʻolauna ʻo AI i nā mea hoʻouka kaua hou a me nā luʻi kūʻokoʻa, akā ʻo kahi hapa nui o ka "AI Security" ʻo ia ka ʻenehana paʻa, nā hana hoʻopaʻa paʻa paʻa, a me ka hoʻopaʻa ʻana - nā mea like a mākou i hāʻule ai i nā makahiki he mau makahiki. ʻO ka pilikia hoʻokaʻawale VM i ʻōlelo ʻia ma mua he hiʻohiʻona maikaʻi loa: kahi palupalu maʻamau i hoʻonui ʻia e ka paʻakikī o kahi kahua AI.
Ke kūkulu nei mākou i nā ʻōnaehana AI paʻakikī loa ma luna o nā kumu maʻalahi a hoʻohana ikaika ʻia. Ua like ia me ka hoʻolālā ʻana i kahi kaʻa hoʻokele ponoʻī me ka hoʻokele AI kiʻekiʻe, ʻoiai e hāʻule ana nā huila a hū ka ʻenekini. ʻO ka manaʻo nui i ka "AI Security" e like me ka mea e hoʻohuli ai, e hoʻohuli i nā kumuwaiwai a me ka nānā ʻana mai ka hana maʻamau, ʻaʻole ʻoluʻolu, akā koʻikoʻi loa no ka hoʻopaʻa ʻana i nā ʻoihana i loaʻa.
Paʻa loa mākou i ka ʻimi ʻana i ka mea nui aʻe a ke hoʻokuʻu nei mākou i nā mea nui o kēia manawa e ʻā? ʻO ka nui a me ka laulā o nā mea hoʻoweliweli KEV e hōʻike ana i kahi hoʻokūkū ʻōnaehana a wikiwiki hoʻi i ka ʻōnaehana kikohoʻe kumu, ʻokoʻa mai nā kūkākūkā ʻana o AI-centric zero-day mua. ʻAʻole kēia e pili ana i ka wā e hiki mai ana o AI; e pili ana i ke ʻano o ko mākou ola kikohoʻe.
He aha kēia, nā CTO?
No nā alakaʻi ʻenekinia a me nā CTO, paʻa a wikiwiki ka ʻōlelo:
- E hoʻokahua i ka papa inoa KEV: E hoʻokuʻu i nā mea a pau. Hoʻopili i kēia mau nāwaliwali. Kauoha ia. E hoʻokō. ʻAʻole kēia he koho.
- **Mai komo i loko o ka "AI Security" hype me ka lilo o nā kumu waiwai: ** ʻAe, e hoʻomaopopo i nā pilikia kūʻokoʻa o AI, akā e hoʻomanaʻo ʻo ka ʻenekinia paʻa, nā ola hoʻomohala palekana, a me ka hoʻopaʻa paʻa ʻana ʻo ia kāu pale maikaʻi loa. ʻAʻole e hoʻopakele ke kumu hoʻohālike AI maikaʻi iā ʻoe inā nona kāu VM i lalo a i ʻole kāu kikowaena SharePoint.
- Ke kūʻai aku i ka palekana kumu: ʻO ke ʻano kēia ma mua o ke kūʻai wale ʻana i kahi mea hana palekana. ʻO ia hoʻi ka hoʻokomo kālā ʻana i nā kānaka, nā kaʻina hana, a me kahi moʻomeheu e manaʻo nui ana i ka palekana ma ke ʻano he kumu ʻenekinia kumu, ʻaʻole he manaʻo hope. He mea maikaʻi loa nā polokalamu bug bounty, akā pono lākou he ʻupena palekana, ʻaʻole kāu hoʻolālā palekana mua.
ʻO ka hanana e pili ana i ka ʻōnaehana platform AI he ala ala, akā ʻo ka papa inoa CISA KEV ka mea hoʻāla wikiwiki. Pono mākou e ho'ōki i ka mahalo i nā hana palekana AI hou loa a hoʻomaka i ka paʻi ʻana i nā lua i kā mākou pale maoli. He mea hauʻoli ka wā e hiki mai ana o AI, akā weliweli ke kūlana o ko mākou palekana i kēia manawa.
Nā kumu
[1] He pilikia ka palekana AI, a ua kokoke e ʻoi aku ka hewa - https://techcrunch.com/2023/10/11/ai-security-is-a-mess-and-its-about-to-get-worse/ [2] ʻIke ʻia i ʻike ʻia i nā mea ʻino — https://www.cisa.gov/known-exploited-vulnerabilities-catalog