The Japan Times - 'Tech debt coming due': AI-found flaw signals chaos ahead

The vulnerability to potential hackers was found by using a powerful model from OpenAI in one of the most high-profile demonstration of AI's cyber capabilities.

AFP spoke with Michael Daniel, president of the Cyber Threat Alliance and a former White House cybersecurity coordinator under former US president Barack Obama, about what the episode means as AI tools find software flaws faster than ever.

The interview has been edited for length and clarity.

Q: What does the PHP episode tell us?

A: This is the beginning of a pretty chaotic period, given the abilities of the advanced models. I've been saying for years that the logical conclusion of these AI models being able to find vulnerabilities at speed and at scale is that there's going to be a flood of these vulnerabilities.

Rob Joyce [former cybersecurity director at the US National Security Agency] has referred to it as the great cleansing forest fire of old software. I've talked about our tech debt coming due.

The incentives have been for people to keep software as long as possible, and we don't really factor these risks into the cost of having the software. You're not incurring a direct cost on your books for this old software, but in reality you are, only it's an implicit cost until something like this happens.

Q: What should organizations be doing?

A: Preparing to get your software updated, be prepared to keep it updated, and be prepared to implement patches when they come out.

There's going to be a flood of vulnerabilities, a flood of patches and a flood of mitigations, and not all of them will be created equal.

For a lot of smaller organizations that don't have a lot of internal capacity, what you've got to do is shift your organization to be able to accept the vendor updates as fast as you can.

Q: Is every flaw dangerous?

A: Historically, the exploitation rate for vulnerabilities has been five or six percent, and there's no indication that number is going up. But now when bad guys exploit a vulnerability, they're able to do so much more quickly.

It used to take a month or two for a proof of concept to come out, and then another month or two for it to show up in exploit kits (used by bad actors). That's now measured in hours or days.

Q: What does that mean for large companies?

A: Most businesses essentially ran a zero-risk tolerance for breaking things, so they would test the hell out of a patch before they put it into production. Now they don't have that time.

If the risk of breaking something by putting this patch into place is one percent, but the risk of being attacked could cost me 50 million dollars...now I've got an interesting trade-off.

Q: Are advanced AI tools reliable at finding real flaws?

A: There's a lot of noise. The PHP one is a prime example of a real one, but there's an awful lot out there that are either not real or are on software that's never exposed to the internet. We've got to improve our triage system.

Q: Where does this lead us in two or three years?

A: We're going to turn these AI tools on software that hasn't been deployed yet, so one would hope we start to deploy software that has fewer vulnerabilities to begin with. You burn out all the old stuff, and it makes way for new growth that's more secure from the beginning.

It's not like this solves our cybersecurity problem, but it does change the nature of it going forward.

S.Fujimoto--JT