Alessio Jacona*
In cybersecurity, the advent of generative artificial intelligence has unleashed "a new arms race" of which we are only seeing the first steps, but whose impact will bring a real paradigm shift in the management and very way of understanding security digital. Word of Nadir Izrael, CTO and co-founder of the Californian multinational specialized in cybersecurity Armis, according to whom companies and institutions must quickly understand that AI is needed to defend themselves from AI, otherwise there is no story.
«Generative AI lends itself to both attack and defense - explains Izrael - It is an extremely powerful tool of which we only saw a glimpse when, at the beginning, it was used to carry out spear phishing and scamming on a large scale, that is, much more sophisticated attacks based on social engineering whose target is the human being as the weak link in the system. However, much more can be done, and recently we have started to see the first versions of malware capable of evolving on their own."
Thanks to AI, it becomes much easier to exploit the "surface" exposed to risk in organizations, made much larger today by digitalisation. The problem is that «human attackers need time to identify the best point of attack, while a generative AI can potentially greatly accelerate this process, launching attacks that a human team alone can hardly manage and repel. We have not yet seen AI operating at this extreme level - clarifies Nadir Izrael - but it is only a matter of time".
What countermeasures can be adopted? Are there specific weaknesses that need to be eliminated?
To be honest, everything is a weakness: the moment you go from facing a team of human attackers to something like an AI, everything changes. The limited adoption of automation in defense systems makes organizations vulnerable, as many response actions still require selective manual interventions. It is necessary to radically review the defense strategy, focusing on understanding and protecting the attack surface, and here too AI and automation will become crucial defensive tools. Fortunately, defensive AI has some notable advantages, such as having deeper knowledge of the infrastructure it is tasked with defending. However, the security industry is lagging behind in implementing AI compared to attackers. It is urgent that companies and governments evaluate the risks posed by AI-based attack platforms and choose accordingly."
And what about those of you who deal with cybersecurity? Do you feel like the industry is managing the AI revolution?
“I fear that many of those in cybersecurity are not moving fast enough to fully adopt AI, or at least not as quickly as attackers. We at Armis put AI at the center of our activities already a year ago, when we realized that not doing so would mean risking becoming irrelevant within two or three years. And then there's another problem."
Which?
«The fact that we now expect significant attacks from the same international cybercrime actors, i.e. structured groups with great skills and resources, while instead AI could soon lower the threshold of access to cybercrime. All it takes is for someone to create an AI-based platform equipped with the necessary tools, and we will immediately see new players emerging on the global scene."
So is there a risk that someone is developing AI-based cybercrime platforms available to anyone who wants to use them?
«If I worked in that sector, I would. It is possible and you can earn a lot. The necessary technology is already available and we are starting to see the first signs of self-evolving malware and platforms that exploit global data. Our recent acquisition of a threat intelligence company demonstrates the importance of developing defensive tools based on this technology."
Is this phenomenon occurring on a global scale?
«We are seeing signs of evolution and this year could bring significant developments. Geopolitical events and the many elections taking place around the world could push threat actors to intensify their efforts. It is essential to accelerate the development of AI-based defensive platforms to anticipate AI attacks."
In your opinion, in the future will machines, alone, fight on both sides to protect systems and attack them?
«Yes, without a doubt. I think this is the future of this industry. What happened with factories will happen a bit: the increase in automation has partly reduced the number of workers, but above all has required them to have very different skills than before to manage the new systems, making it increasingly difficult to find staff qualified. Likewise, I believe that in the coming years the cybersecurity sector will give space to new figures related to AI programming, which we must train starting today. Then there is also another question: if I try to imagine a world in which artificial intelligence is at the center of every business process within an organization, this inevitably means that many of the systems around which we have built today organizations will no longer be relevant."
Which systems are you referring to?
«I think for example of the databases with which we store data: we built them for us, to store information in a way that humans can consume. But in a world where an AI can simply pull sets of data from different places, connect them together, provide insights, provide context, there's really no reason to store all the data in this way, which just to this will begin to be increasingly fragmented. A new structure that will require a completely new infrastructure and about which we still know nothing from an IT point of view. In short, there are many challenges around the corner."
Is the diffusion of this technology proceeding too quickly?
“The speed at which AI is deployed is inevitable, and in the case of cybersecurity, we are in the equivalent of an arms race. It is essential to leverage AI to defend ourselves,
including the ability to detect artificially generated content. The challenge will be to stay current to protect both organizations and individuals."
What is your advice for companies and ordinary citizens who want to protect themselves from new possible threats?
«Companies must realize that things are changing, and that when it comes to cybersecurity they rely too much on detection and response strategies and systems, which provide a reaction following an attack. It's a cybersecurity idea that I fear is about to explode in our faces, because it's a losing strategy that should be replaced with vulnerability management, attack surface management and a heavy dose of automation. We need to overcome the fear of automation. Things need to be automated."
And the people?
«For them the rules of common sense still apply, that is, careful management of their privacy, their data and passwords to reduce the personal attack surface, and here the good news is that most of us are not targeted as an individual. In the future, however, perhaps we will have a defensive artificial intelligence dedicated to protecting the digital identities of individuals, why not?
In short, it will be like having an intelligent antivirus guarding our lives...
"Exactly".
Are you worried or excited about the future?
"Both things. We are faced with intriguing challenges, but what is also worrying is the fact that we do not realize our fragility. The need to rapidly adapt our skills and defenses is now more critical than ever."
*Journalist, innovation expert and curator of the ANSA.it Artificial Intelligence Observatory
Reproduction reserved © Copyright ANSA