A Cybersecurity Offensive? Beware of Collateral Damage | Antivirus Software

For almost all organizations - public and private, traditional and defensive cybersecurity has been and always will be the only approach. Offensive cybersecurity is a proactive approach that involves launching a cyber-attack against adversaries to disrupt or cripple their operations and deter future attacks. This approach is sometimes called "hacking back" (hacking back) and relies on the accurate determination of the person conducting the attacks against the company. Typically, the targets of cyber offensives are threat actors who have been identified as launching cyber-attacks against the organization.

 

As any security professional should know, hacking is not a trivial exercise and the approach can be riddled with flaws. Currently, the practice of hacking remains illegal because it would violate various national and international laws, although, in some countries such as the United States, bills have recently been introduced to allow organizations to take offensive measures against their intruders. on their computer network.

 

Devastation Comparable to Conventional War

The biggest problem with offensive cybersecurity strategies is the risk, or perceived risk, of an attack launched in error. A full-fledged cyber offensive could inflict havoc on a scale comparable to that of conventional warfare or a nuclear bomb. It is not far-fetched. If an attack were to occur within critical infrastructure or extremely sensitive services, we could see poisons in our water supply, massive loss of electricity, and even the handling of civilian aircraft. These are the risks of any large-scale offensive attack.

 

Next, consider the growing use of Artificial Intelligence (AI), especially with regard to the automation and orchestration of IT security. AI is based on machine learning algorithms - programs that learn from examples and formulate results derived from statistics or other models. While AI lacks a concept of good or bad, it could be programmed with parameters to differentiate between “good” and “bad” behaviors or desired outcomes. The problem is, AI can learn bad behavior, like a young child, and could trigger a very unwanted response, much like a tantrum. If the AI ​​is allowed to attack automatically,

 

Automated Responses to Verify

As a concrete example, consider streaming video. The desired result is clear: multicast packets to all targets subscribed to the stream. If an online network device corrupts these packets due to a hardware/software failure or another attack, the received packets could be malformed. The AI ​​could interpret these malformed packets as an attack or the potential exploitation of a vulnerability. Today, web content filtering solutions can easily make this mistake even when something as simple as the source of the video stream is not recognized. Do you think that sounds crazy? In fact, this is what signature-based intrusion detection system (IDS) solutions do today.

 

The triggered automated responses scenario as described above explains why even conventional warfare is locked down. Automated responses to threats, especially for offensive behavior, should always be verified and should never be trusted as-is.

 

A Risk of Uncontrollable Reaction

While automation in many forms helps IT and IT security solve scalability and efficiency issues, caution should always be exercised when it comes to technologies that offer full automation, especially of an offensive nature. This level of caution should be even higher for automation technologies and AI-driven platforms, where the logic for initiating a response may not even be explained logically. And, better to leave some very sensitive areas of decision-making to humans - imperfect as we are.

 

In reality, the Internet is fragile. Actions and reactions can quickly get out of hand there, and AI with automation could make it dramatically worse. Better to adhere to the best defensive IT security technologies and avoid the hype, legal issues, and potential harm of adopting an offensive cybersecurity posture. install antivirus software for cybersecurity.