Iminsi-Zeru na Zeru Igenzura: Umugani Wibintu Byukuri Byukuri
Tekereza itsinda ryawe rya SOC, rifite amaso yuzuye amaraso, witegereje urumuri rutukura. Ni saa tatu za mugitondo mu Kwakira 2023, kandi amakuru ntabwo ari meza: iminsi ibiri ikomeye ya zeru muri Citrix NetScaler ADC na Gateway, ikoreshwa cyane, ituma Kora Remote Code (RCE), hamwe na malware yihariye igaragara mwishyamba. Urutonde rwa CISA ruzwiho gukoreshwa (KEV) urutonde rwongeyeho [1, 2, 3, 4]. Ntabwo ari iterabwoba; ni ibintu bikomeye, mpuzamahanga bigira ingaruka ku bikorwa remezo bikomeye by’inganda muri guverinoma, imari, uburezi, n’amategeko muri Amerika ya Ruguru n’Uburayi. Mu gihe amakipe yawe arimo kwihatira gukumira amaraso, guterwa umujinya mwinshi, no gutangiza iperereza ry’ubucamanza ku bishobora kuba ari ukurenga ibiza, undi mutwe ugabanuka: Perezida Trump yabonye "amasezerano ku bushake" n’amasosiyete akomeye y’ikoranabuhanga agamije iterambere rya AI, asezeranya inganda zo kwikorera abapolisi [5].
Ivangitirane ntirisanzwe. Ku ruhande rumwe, duhanganye nukuri kwubugome, budashobora guhakana ibidukikije bigezweho muri iki gihe: urugamba ruhoraho, rukomeye rwo kurwanya abanzi bakomeye bakoresha intege nke zifatizo mubikorwa remezo bishimangira isi yacu ya none. Ku rundi ruhande, indorerezi ya politiki yerekana ko ejo hazaza h’impinduka, ariko zidashidikanywaho cyane, ikoranabuhanga rishobora gucungwa neza n’inganda zimwe zihora ziharanira umutekano w’ibanze no kwiyobora.
Catrix ya Citrix: Ikimenyetso cyo Kubora cyane
Reka tubyumve neza: Citrix zeru-iminsi, nka CVE-2023-4966 (izwi nka Citrix Bleed) na CVE-2023-3519, ntabwo "ari izindi ntege nke." Zerekana ikibazo cyihutirwa mu kigo cyamakuru, ubukangurambaga butaziguye, bukomeje busaba igisubizo cyihuse, amaboko yose ku kibanza [1, 2, 3, 4]. Kurangiza Kode ya kure kuri ADC cyangwa Irembo ni digitale ihwanye ningingo ikomeye yo kugera ibumoso. Ibi ntabwo ari ugupakira gusa; bijyanye na sisitemu yoroheje yuburyo bwububiko bwacu.
Tumaze imyaka, twubatse sisitemu igoye, ihujwe, akenshi twishingikiriza kubacuruzi bake bakomeye kubucuruzi bwibikorwa remezo. Citrix, kimwe nabandi benshi, itanga serivisi zingenzi, ariko hamwe nuburinganire buzana ibyago byinshi. Iyo ikintu cyibanze nka NetScaler kibangamiwe kurwego rwa zeru-umunsi, ingaruka zangiza. Irerekana inenge yihariye yo kwishingikiriza ku ngingo imwe yo gutsindwa, niyo yaba * igomba kuba ikomeye. Amabwiriza "patch ako kanya", mugihe bibaye ngombwa, yumva ari umuti utagaragara kubibazo bya sisitemu. Ntabwo ikemura ibibazo byihishe inyuma: ingorane zibyara intege nke, umuvuduko muke wo kuvugurura umutekano utangwa nabacuruzi bamwe na bamwe, hamwe ningamba zidahagije zo kwirwanaho-byimbitse byananirana mugihe perimeteri yarenze aho igeze.
Ntabwo arikibazo cya tekiniki gusa; ni ubucuruzi bukomeza inzozi. Kutubahiriza amakuru, guhagarika ibikorwa, ihazabu yubuyobozi, kwangirika kwicyubahiro - ibiciro ni astronomie. Kandi kubera iki? Gukoresha umuyoboro neza? Turimo kwishyura igiciro cyoroshye kugirango byoroherezwe kandi bigaragara neza, igiciro gipimwa nijoro ridasinziriye kuri CTOs hamwe nitsinda ryumutekano, kandi birashoboka, mugusenya ikizere rusange. Kuba ibyo * bikoreshwa cyane * zeru-minsi, ukoresheje * porogaramu mbi ya malware *, itubwira ko atari inyandiko zanditse. Aba bafite imbaraga, bakomeje gutera ubwoba bagamije umutungo ufite agaciro kanini [3]. Niba tudashobora kurinda ibice fatizo byisi yacu isanzwe, ni ibihe byiringiro dufite ejo hazaza hakeye?
AI yo mu burengerazuba bwa AI: Kwizera inyungu-bwite zo gutegeka umutekano
Kandi tuvuze iby'ejo hazaza, reka twibande ku bwumvikane bwa AI "self-policing". Amatangazo ya Perezida Trump, nubwo afite akamaro muri politiki, ni urugero rw'igitabo cyo kureka kubazwa [5]. "Ubushake" na "self-policing" ni amagambo agomba gutera ubwoba umuntu wese warebye inganda zikoranabuhanga zikora mumyaka 20 ishize. Twabonye iyi ngero mbere, si byo? Imbuga nkoranyambaga "kubushake" abapolisi bavuga urwango, moteri zishakisha "kwiyobora" ubuzima bwite bwamakuru, hamwe nububiko bwa porogaramu "bwigenga" butanga amarushanwa akwiye. Ibyakurikiranwe ni, kubishyira mu bwitonzi, mubi.
Igitekerezo cy'uko amasosiyete ubwayo yiruka mu guteza imbere no gukoresha sisitemu zikomeye za AI - sisitemu ifite ubushobozi bwo kuvugurura ubukungu, guhindura amatora, ndetse no gushyiraho uburyo bushya bw’ibyago by’abaturage - irashobora kwizerwa gushiraho no gushyira mu bikorwa umurongo ngenderwaho w’imyitwarire n’umutekano ntabwo ari byiza na gato, kandi ni bibi ku nshingano mbi. Izi nisosiyete itwarwa ninyungu no kuganza isoko. Inshingano yabo yibanze yo kwizerwa ni abanyamigabane, ntabwo ari igitekerezo kidafatika cyibyiza rusange cyangwa imyitwarire myiza ya AI.
Iyi "masezerano" ni intsinzi ya politiki ku buyobozi, ibemerera gusaba ibirego kuri AI nta bucuruzi bubi bw’amategeko cyangwa kugenzura amabwiriza. Nintsinzi nini kuri Big Tech, kubagurira umwanya nubwisanzure bwamabwiriza aremereye ashobora gutinda guhanga udushya cyangwa guhindura umurongo wabo wo hasi. Ariko kuri twe twese - kubanyamwuga buhanga bubaka sisitemu, kubucuruzi buzashingira kuri bo, ndetse no muri societe muri rusange - ni urugero rubi. Irerekana uburyo bwatoranijwe ku miyoborere ya AI ishyira imbere ubwigenge bwibigo kuruta umutekano rusange no kubazwa ibyo.
Guhagarika: Kubaka kumfatiro zidahinduka
Dore ukuri kutoroheye: turimo icyarimwe tunanirwa kurinda umutekano wubu kandi dukoresha nabi ejo hazaza. Turimo kubaka sisitemu ya AI igezweho cyane ku rufatiro rwo guhungabana kwa digitale, aho ibikorwa remezo bikomeye bikunze guhungabana nabanzi bakomeye. Bamwe mu bayobozi b’inganda badashobora kubuza ibicuruzwa byabo kuba ibitero by’ibitero ku isi ubu basabwe "kwikorera abapolisi" ingaruka z’imyitwarire n’umutekano by’ubwenge rusange.
Ibi ntabwo ari uguhagarika gusa; ni icyuho cyimbitse. Nka CTOs nubuhanga buyobora, twafashwe hagati. Dufite inshingano zo gukemura ibibazo byihuse, bibaho nka Citrix zero-iminsi, mugihe icyarimwe tubwirwa kwitegura ejo hazaza hayobowe na AI aho amategeko ashyirwaho mugihe tugenda, ahanini nabakinnyi ubwabo.
Amasezerano ya AI kubushake ntabwo ari igisubizo; ni amayeri yo gutinda. Irasubika kubazwa, ikemeza ko mugihe byanze bikunze kurenga ku mahame mbwirizamuco, kubogama, cyangwa no kunanirwa gukabije kwa AI bibaye, abaturage bazasigara bibaza impamvu hatabayeho kugenzura gukomeye, kwigenga kuva mu ntangiriro. Kandi iyo ibyo kunanirwa bibaye, ntabwo bizaba ari theoretical. Bazaba nkukuri kandi bangiza nka RCE kuri NetScaler yawe, gusa nibishobora kuba byinshi mubaturage.
Tugomba gusaba byinshi. Dukeneye umutekano ukomeye, wibikorwa byabacuruzi bacu, ntabwo dukeneye gusa ibintu bifatika nyuma yukuri. Dukeneye amabwiriza nyayo, yigenga kuri AI, ntabwo amasezerano yo guhana amaboko hagati yabanyapolitike n’amasosiyete. Kuberako niba tudashobora no gushakira umutekano ibikorwa remezo byingenzi, nigute dushobora kwizera abubatsi kubaka igisekuru kizaza cyimico neza? Igisubizo, kuri ubu, ntidushobora.
Inkomoko
] https://www.cisa.gov/amakuru-yamakuru/ibimenyesha/2023/10/24/cisa-yongeyeho [2] Itangazo ryumutekano wa Citrix kuri CVE-2023-4966 na CVE-2023-4967 - https://support.citrix.com/article/CTX579459/citrix-netscaler-adc-kandi [3] Mandiant: UNC4841 Yifashishije Citrix NetScaler ADC na Gateway Zero-Umunsi (CVE-2023-4966) - https://www.mandiant.com/amakuru ] https://www.cisa.gov/amakuru-yamakuru/ibimenyesha/2023/07/21/cisa-yongeyeho [5] Amakuru agezweho: Trump yashyize umukono kubushake kubayobozi ba AI kubijyanye n'ikoranabuhanga ... -