Race Against the Machine - Will AI Help Or Harm Security? M London October 16th, 2018 David Fuhr

Page created by Lloyd Burns

Society

English

Like
Share
Embed
Fullscreen
Slides
Download HTML
Download PDF
Abuse

←

→

Page content transcription

If your browser does not render page correctly, please read the page content below

Race Against the Machine - Will AI Help Or Harm Security? M London October 16th, 2018 David Fuhr

Race Against the Machine
Will AI Help Or Harm Security?

M³ London October 16th, 2018

                                 David Fuhr
1

David Fuhr
    Head of Research, HiSolutions AG
    • Maths
    • Crypto(graphy)
    • InfoSec
    • Gestalt/Coaching

2                                      © HiSolutions 2018

3   © HiSolutions 2018

4   © HiSolutions 2018

5   © HiSolutions 2018

6   © HiSolutions 2018

DATA SCIENTIST / AI RESEARCHER

7                                    © HiSolutions 2018

8   © HiSolutions 2018

9   blogs.balbix.com
       © HiSolutions 2018

10   blogs.balbix.com
        © HiSolutions 2018

www.datasciencecentral.com

11                 © HiSolutions 2018

Man vs. Machine

              …threatens   Human             Machine

                            Civil/Military   InfoSec ……
              Human           Security         Cyberwar

              Machine         Safety         War of Machines

                                                               [Liggesmeyer 2015]

12                                                                    © HiSolutions 2018

InfoSec in a Nutshell                         Confi-
                                              dentia
                                               -lity
                                               Info
                                               Sec
 Goal (Why): Protect CIA triad
                                      Inte-             Avai-
 How?                                grity            lability

      (Risk) Management System
        (PDCA Cycle, saturation curve, dynamics)
      Looong list of controls (preventive, detective, corrective)
      Lots of folklore,
      drinking,
      bragging, and
      crystal balling

13                                                                   © HiSolutions 2018

AI Security?

 AI for Security
 Security of/for AI
 Security from/against AI
 Security because of / thanks to AI
 AI against Security / Security in spite of AI
 …?

14                                                © HiSolutions 2018

Man vs. AI vs. Machine

 …threatens       Human                      AI                 Machine

 Human             Civil/Military Security          AI-Sec           InfoSec

 AI                      AI Safety                Adversarial        Sec AI

 Machine           Safety (e.g. Safety AI)         (AI-Sec)      War of Machines

15                                                                         © HiSolutions 2018

Adversarial: AI vs. AI

 Sparring: GANs (Generative Adversarial Networks, 2014)
 Fight: CGC (DARPA Cyber Grand Challenge 2016)

16                                                         © HiSolutions 2018

AI-Sec: Humans vs. AI

 Humans (or nature) trying to harm a piece of software
      (on purpose or bad luck (e.g., fat finger))
This we know!
See InfoSec

17                                                        © HiSolutions 2018

AI-Sec: Humans vs. AI

 Availability: Depending on (Cloud) resources, model parameters, data
 Confidentiality: Trade secrets in models
 Integrity:
      Manipulation of evaluation
      Manipulation of models
      Manipulation of data
      Manipulation of AI stacks (source code, binaries)
      Manipulation of supply chain

Let “us” tell you: It’s all going to happen.

18                                                                       © HiSolutions 2018

Sec-AI: AI vs. Machines

 Offensive AI
 Defensive AI

                          https://xkcd.com/
19                                            © HiSolutions 2018

Incorrect View of InfoSec (Dullien 2017)

     Thomas Dullien 2017, https://doc.dustri.org/keynotes/Machine%20Learning,%20Offense,%20and%20the%20future%20of%20Automation%20-%20Halvar%20Flake%20-%20ZeroNights%202017.pdf

20                                                                                                                                                              © HiSolutions 2018

More Realistic View of InfoSec (Dullien 2017)

     Thomas Dullien 2017, https://doc.dustri.org/keynotes/Machine%20Learning,%20Offense,%20and%20the%20future%20of%20Automation%20-%20Halvar%20Flake%20-%20ZeroNights%202017.pdf

21                                                                                                                                                              © HiSolutions 2018

The Good, the Bad & the Ugly

 Task              Today               Future                             Action

 SPAM detection    Near perfect        SPAM evasion might win              Learn about useful/fruitful content

 Virus detection   Mostly non-AI       Not to change that fast (what is   Wrong idea anyways ;-)
                                       „evil“ behavior?)                   Whitelisting, hardening,
                                                                            true software engineering
 „Anomaly          AI marketing hype   Will work in simple/strict          Ditto
 detection“                            environments
 Vuln scanning     Some AI hype        Mostly useless (hacking is          Can work on a macro level
                                       about exploiting minor glitches)
 Attribution       „It was the         Please don‘t.                       Forget about it!
                   Russinese!“
 Config            Non-AI              Promising („most servers that       Start doing Config management
 Management                            were not hacked did X“)             Use AI to make it cooler
 Other             What is AI?         Lots of hidden wins                 Start researching

22                                                                                                           © HiSolutions 2018

AI Safety: AI vs. Humans

-    Opacity (vs. Transparency)
-    Bias
-    Singularity

23                                © HiSolutions 2018

AI Safety: AI vs. Humans

-        Opacity (vs. Transparency)
     -     Transparency as crucial for democracy: Trust, Accountability
     -      Also a chance?
-        Bias
     -     Cannot be avoided (part of culture), but:
     -     We need to stay fluid vs. power
     -     Stakeholder problem (bias in professional field)
     -      Always ask and invite those discriminated against
-        Singularity
     -     Actually a scale
     -     Start researching and mitigating early(!!!)
24                                                                        © HiSolutions 2018

Who Will Win?

 Attacker or Defender?
 In (pre AI) InfoSec:
 It depends.
 Used to say: attacker
 New insight:
      locally: attacker
      globally: defender
      but: cyberwar
                            https://xkcd.com/

25                              © HiSolutions 2018

Who Will Win with AI / Post-AI?

 Defenders need to keep wining (statistically, without black swans)
 New type of defenders and defenses needed
 More research necessary

                                            https://xkcd.com/
26                                                                     © HiSolutions 2018

Man vs. AI vs. Machine

 …threatens       Human                      AI                     Machine

                                                   AI-Sec
 Human             Civil/Military Security                               InfoSec
                                             - New Attack Vectors

                           AI Safety
                                                  Adversarial:            Sec AI
                          - Opacity
 AI                                                 - GANs            - Offensive AI
                            - Bias
                                                     - CGC            - Defensive AI
                         - Singularity
                           Safety
 Machine                                           (AI-Sec)           War of Machines
                      (e.g. Safety AI)

27                                                                              © HiSolutions 2018

Lessons To Be (Deeply) Learned

 We (AI & InfoSec communities) need to talk.
 Now.
 Learn about
      Threat Modeling
      Attacks/Attack vectors
      Risk Analysis and Risk Management
      Security by Design, Security by Default
      Accountability
      Transparency
 And have fun doing it!

28                                               © HiSolutions 2018

Thanks! Questions?

David Fuhr
fuhr@hisolutions.com

Bouchéstraße 12 | 12435 Berlin

info@hisolutions.com | +49 30 533 289 0

www.hisolutions.com

29                                        © HiSolutions 2018

You can also read