Iimpahla zoKhuseleko ze-AI zika-Emperor: Ngelixa sijonge eMuse, iSiseko siyawohloka.
Masibe ngqo: imboni ye-tech ine-obsession entsha, kwaye ibizwa ngokuba "yi-AI yokhuseleko." Sonke silindeleke ukuba sigxile kwisitofu esikhawulezileyo, ukutyhefa imodeli, kunye nokukhutshelwa kwedatha kwiimodeli ezinkulu zolwimi. Ngeli xesha, esona siseko sikhoyo, somzimba, sedijithali esibambe amashishini ethu kunye sitshiswa ngenkuthalo engapheliyo yeentsuku zero. Isiganeko sakutsha nje esibandakanya iqonga elikhulu le-AI, elibonisa imingeni ebanzi ekukhuseleni iziseko zophuhliso ze-AI, igxininisa le dichotomy eyingozi [1].
I-Meta, inkampani eyaziwa ngokuba "hamba ngokukhawuleza kwaye yaphule izinto" i-ethos, iye yajongana nokuphononongwa malunga neziphene zokhuseleko kumaqonga ayo e-AI. Umzekelo, inkqubo ye-bug bounty yatyhila isiphene esibonakalayo somsebenzisi oomatshini ababonakalayo. Le ibingeyiyo idatha evuzayo echuliweyo okanye ukukhawuleza ukugqitha ngokukhawuleza, kodwa ibiyimpazamo yomgangatho weziseko ezingundoqo eveze i-VMs yabasebenzisi. Oku asingomngcipheko othile we-AI-specific; oku kukwahlulwa kwe-VM okusisiseko, yingxaki ebesicinga ukuba yalungiswa kwiminyaka elishumi eyadlulayo. Imele ukophulwa okubalulekileyo kobumfihlo kunye nemfezeko yedatha, enefuthe ngqo kubasebenzisi kunye nabathengi abanokubakho bamashishini abasebenzisa iziseko ze-AI.
Olu hlobo lwesiphene, ngelixa lunempembelelo yokwenyani, luziva lungaphantsi njengenoveli "yokhuseleko lwe-AI" umngeni kwaye ngakumbi njengokusilela kweziseko zophuhliso ezinxibe umnqwazi we-AI. Sisikhumbuzo sokuba nawona maqonga e-AI aphambili akhiwe kumaleko ekhompuyutha eqhelekileyo, uthungelwano, kunye nokubonwayo. Ukuba loo maleko asisiseko azele yimingxunya, akunamsebenzi ukuba imodeli yakho ye-AI iphucuke kangakanani; yonke inkqubo ihleli isesichengeni. Umba we "AI" weli bali uphantse ube sisiphazamiso, indlela egwenxa ethi itsalele amehlo ethu kude namaplanga abolileyo angaphantsi kweebhodi ezigudisiweyo.
CISA's KEV Barrage: Isalathisi esibalulekileyo
Ngelixa sixakeke sixoxa ngeziphumo ezisesikweni zeengxoxo zencoko kunye nezinto ezibaluleke kakhulu zokhuseleko lwe-AI, i-CISA iphosa inani elingazange libonwe lobuthathaka obuxhatshaziweyo kwikhathalogu yayo eyaziwa ngokuba yi-Town Exploited Vulnerabilities (KEV). Lo ayingomsebenzi wethiyori. Olu ayiloluhlu "lolunye usuku". Olu luluhlu olungxamisekileyo "indlu yakho iyatsha okwangoku" uluhlu.
Kwiiveki zamva nje, i-CISA yongeze amangenelo amaninzi, izise itotali yobuthathaka obuxhatshaziweyo kwinani elimangalisayo ngexesha elifutshane [2]. Oku akuphelelanga nje "ukhuseleko lubi"; Le yinkqubo ecwangcisiweyo, intlekele ekhulayo echaphazela isoftware yeshishini elibaluleke kakhulu eliqhuba ilizwe lethu.
Qwalasela ezongezo zakutsha nje kwikhathalogu ye-KEV:
- CVE-2023-46214: A Splunk Enterprise remote code execution vulnerability (CVSS 9.8) kunye nomhla wokugqibela we-CISA patch, okwenza iinkqubo ezingabhalwanga zibe sengozini kakhulu.
- CVE-2023-29357: Ilungelo elilodwa le-Microsoft SharePoint Server linyusa ukuba sesichengeni, lichaphazela umqolo we-intranets zeshishini ezingenakubalwa.
- CVE-2023-42824: Ubuthathaka be-Apple iOS/iPadOS, esele ixhatshazwe kuhlaselo olujoliswe kuyo, ebonisa ukuba neendawo eziphila kuzo ezilawulwayo azingeneki.
- CVE-2023-30799: I-MikroTik RouterOS i-remote code execution flaw, echaphazela ii-routers ezidibanisa yonke into, zihlala zishiywe zingabhalwanga kwiikona ezinzulu zenethiwekhi.
Oku kongezwa komlilo okukhawulezayo kokuxhaphazwa ngokusebenzayo kweentsuku zero kubathengisi abakhulu - iMicrosoft, iApple, iSplunk, iMikroTik, iLinux, iJFrog - ifuna ingqwalasela ekhawulezileyo. Esi ayisosilumkiso ngokubanzi; siren ikhala ngokuthe ngqo kuyo yonke i-IT kunye neqela lokhuseleko. Uluhlu lwe-KEV lwe-CISA alukho nje ingcebiso yee-arhente zobumbano; sisilumkiso esibalulekileyo kuyo yonke imibutho. Ungayihoyi ngengozi yakho.
Inkohliso "ye-AI yoKhuseleko" kunye neXabiso lokuphazamiseka
Nantsi inyani engathandekiyo: iziphene ezisisiseko kumaqonga e-AI kunye ne-CISA KEV barrage yimiba edibeneyo yengxaki efanayo. Bobabini bayakhala malunga nokuwohloka okusisiseko kukhuseleko lwesoftware, kodwa ukujonga okudityanisiweyo koshishino lwethu kujongwa kakubi. Sichukunyiswe kakhulu sisithembiso kunye nobungozi be "AI" kangangokuba sivumela isiseko sesiseko sedijithali kubola.
"Ukhuseleko lwe-AI" luye lwaba yi-buzzword, umda omtsha wabacebisi kunye nabaphathi beemveliso. Kodwa yintoni, ngokwenene? Rhoqo, ilukhuseleko* nje olusetyenziswa kwiinkqubo ze-AI. Ewe, i-AI yazisa uhlaselo olutsha kunye nemiceli mngeni ekhethekileyo, kodwa inxalenye ebalulekileyo "yokhuseleko lwe-AI" bubunjineli obuqinileyo, iindlela ezikhuselekileyo zokukhowuda, kunye nokuchwetheza ngenkuthalo - izinto ezifanayo besisilela kuzo amashumi eminyaka. Umba wokwahlula we-VM okhankanywe ngaphambili ngumzekelo ogqibeleleyo: ukuba semngciphekweni kwakudala okwandiswe bubunzima beqonga le-AI.
Sakha iisistim ze-AI ezintsonkothileyo ngaphezulu kweziseko ezithe kratya kunye nezixhaphakileyo. Kufana nokuyila ngobuchule inqwelo-mafutha eziqhubayo ene-AI navigation ephucukileyo, ngelixa amavili ewa kunye ne-injini itshiza. Ugxininiso "kukhuseleko lwe-AI" luhlala luziva ngathi sisiphazamiso, ukuphambukisa izixhobo kunye nengqalelo kwizinto eziqhelekileyo, ezingenabugocigoci, kodwa zibaluleke kakhulu umsebenzi wokukhusela iziseko ezingundoqo ezikhoyo.
Ngaba sixakeke sileqa into enkulu elandelayo ukuba siyeke izinto ezinkulu zangoku zitshise? Umthamo omkhulu kunye nobubanzi bezoyikiso ze-KEV zibonakalisa umngeni wenkqubo nongxamisekileyo kwiziseko ezingundoqo zedijithali, owahlukileyo kwiingxoxo zangaphambili ze-AI-centric zero-day. Oku akubhekiseli kwikamva le-AI; imalunga nemeko yangoku yobukho bethu bedijithali.
Yintoni Ngoku, CTO?
Kwiinkokeli zobunjineli kunye neeCTOs, umyalezo ucacile kwaye ungoko:
- Beka kuqala uluhlu lwe-KEV: Shiya yonke into. Cima obu buthathaka. Yigunyazise. Nyanzelise. Oku akukhethi.
- Musa ukukhukuliseka kwi-hype ye-"AI yokhuseleko" ngeendleko zezinto ezisisiseko: Ewe, qonda iingozi ezikhethekileyo ze-AI, kodwa khumbula ukuba ubunjineli obuqinileyo, uphuhliso olukhuselekileyo lwemijikelezo yokuphila, kunye nokuchwetheza ngenkuthalo kuselona khuselo lwakho. Imodeli ye-AI enqabileyo ayiyi kukugcina ukuba umhlaseli ungumnikazi we-VM ephantsi okanye iseva yakho ye-SharePoint.
- Tyala kukhuseleko olusisiseko: Oku kuthetha okungakumbi kunokuthenga nje esinye isixhobo sokhuseleko. Kuthetha ukutyala imali ebantwini, kwiinkqubo, nakwinkcubeko exabisa ukhuseleko njengoqeqesho lobunjineli olungundoqo, hayi ingcamango yamva. Iinkqubo ze-bug bounty zigqwesile, kodwa kufuneka zibe ngumnatha wokhuseleko, hayi isicwangciso sakho sokuqala sokhuseleko.
Isiganeko esibandakanya isiseko seqonga se-AI singumnxeba wokuvuka, kodwa uluhlu lwe-CISA KEV luyi-alamu ephuthumayo. Kufuneka siyeke ukuncoma amanyathelo okhuseleko e-AI yamva nje kwaye siqale ukupeya imingxunya kukhuseleko lwethu lokwenyani. Ikamva le-AI liyonwabile, kodwa imeko yangoku yokhuseleko lwethu iyoyikisa.
Imithombo
[1] Ukhuseleko lwe-AI bubugxwayiba, kwaye sele luza kuba lubi ngakumbi — https://techcrunch.com/2023/10/11/ai-security-is-a-mess-and-its-about-to-get-worse/ [2] Ikhathalogu eyaziwa ngokuba yi-Exploited Vulnerabilities- https://www.cisa.gov/known-exploited-vulnerabilities-catalog