The Dark Side of AI: Hacking with AI and Exploiting AI Security Flaws

[Music]

David Bomble: Hello everyone, it's David Bomble coming to you from Cisco Live with a very special guest. Welcome!

Guest: Thank you so much for having me here.

David: Great to have you. You’re very well known in the industry, I believe 7 books at the last count, right?

Guest: Yes sir, I use them to raise my monitors so they're perfect for that.

David: I don't believe that for a moment. You’ve written books on various topics. Perhaps you can give us an overview of some of your favorite and most popular books.

Guest: Sure. I’ve been connected with Cisco for 25 years, contributing to many books before that. My books cover a wide spectrum from certification guides to those used in universities and ones focusing on emerging technologies like AI impacting everything from cybersecurity to networking and programming.

David: Some of your known works include books on CCNA, CyberOps for Cisco, and CCIE Security, right?

Guest: Yes, recently, I've also published books on AI cybersecurity. One book with a colleague from Oxford University focuses on high-level AI security, and another dives deeper into securing AI implementations and using AI for security.

David: So let’s dive into hot topics. Are you seeing a rise in AI used in attacks beyond just deep fakes and social engineering? What's happening in the real world?

Guest: Absolutely. Beyond traditional attacks, newer threats involve advanced techniques like differentiation, where AI abstracts tasks for attackers, making it easier to create novel exploits, vulnerabilities, and phishing techniques without needing a deep technical background.

David: Is AI being used for offensive hacking?

Guest: Yes, for instance, attackers use libraries like LLM, LangChain, and others to automate reconnaissance, creating targeted attacks even while they sleep. It's a huge shift from manually hacking to leveraging AI for automating complex tasks.

David: So essentially, attackers are using AI for nefarious purposes. How are they doing that?

Guest: Think about it: attackers can use AI to scan and exploit code in repositories like GitHub automatically. They can also perform extensive open-source intelligence gathering by vectorizing data from social media, certificates, etc., and using it for highly targeted attacks.

David: And these attacks are getting more sophisticated, right?

Guest: It’s escalating and will continue to escalate. We must reinvent incident response to tackle these newer dimensions. Remediating AI attacks, understanding model manipulation, and ensuring accurate forensics in AI systems are crucial.

David: What about securing AI itself?

Guest: Securing AI is equally crucial. It's a dual challenge: using AI for security while also securing AI systems. Each AI model you use can introduce new vulnerabilities, thus comprehensive security frameworks are essential.

David: But with all these challenges, is there hope?

Guest: Absolutely. Lots of industry organizations are developing guidelines for today's and future technologies. Collaborations across the industry are providing the much-needed guidance to secure AI systems.

David: What are the actual opportunities in AI cybersecurity for individuals?

Guest: The scope is broad. It’s not just about securing models but understanding vector databases, dimensionality, AI vulnerabilities, and supply chain security. With new roles and continuous learning, one can effectively contribute to AI cybersecurity.

David: Any advice for those starting in this field?

Guest: Begin with the fundamentals like networking and programming. Certifications like CCNA and ethical hacking courses can provide a good foundation. Stay updated with new AI technologies, understand underlying systems, and how AI can be manipulated for both defensive and offensive purposes.

David: Are there current programs or courses focused specifically on AI cybersecurity?

Guest: They’re emerging. Cisco announced an AI certification for security. Upcoming training and certifications will integrate AI topics, ensuring individuals are well-equipped to handle the evolving security landscape.

David: Omar, I could talk to you for hours. Thank you so much for your insights.

Guest: My pleasure, thank you for having me.

[Music]

Keywords

AI attacks
Differentiation techniques
Model manipulation
Incident response
AI security frameworks
Vector databases
Supply chain security
Cybersecurity certification
Ethical hacking

FAQ

Q: Are attackers using AI models for hacking purposes? A: Yes, attackers leverage both open-source and commercial AI models to automate reconnaissance, generate exploits, and perform advanced attacks.

Q: How serious is the threat of AI in cybersecurity? A: Very serious. AI can automate and scale up attacks effectively, making them more sophisticated and harder to defend against.

Q: How can individuals start a career in AI cybersecurity? A: Start with the basics like networking and ethical hacking certifications (e.g., CCNA, Pentest+). Then, focus on understanding AI technologies, relevant programming languages like Python, and cybersecurity fundamentals.

Q: Is the industry taking steps to secure AI? A: Yes, there are efforts from various organizations like Oasis, NIST, and NSA, collaborating with companies to create guidelines and frameworks for securing AI.

Q: Will traditional cybersecurity skills become obsolete? A: No, but they will evolve. The fundamentals will remain important, but skills in AI, machine learning, and advanced security techniques will also become essential.