How should defenders respond as AI accelerates vulnerability discovery and exploitation?
Use AI to strengthen defence
Apply AI to identify, address and fix vulnerabilities, and build systems that avoid them.
And so I think it is possible, I think it may not be immediate, but over time we're going to perhaps use AI to help us write more secure software or build more secure systems.
And I fully agree with Ari. Now the trip for the white hats is to apply AI to that process, to use the power of AI to think through vulnerabilities, address vulnerabilities, fix vulnerabilities, design new systems without those same vulnerabilities going forward.
Now we have seen that there is an uptick of the AI assisted hacks that started to happen in March this year. So AI systems became smart enough, attackers started to use them to assist in these hacks.
For me, pacing the frontier is just really investing ahead and also investing way more than we even think we ought. Investing in the alignment and safety of the models, investing in security, investing in the guardrails.
Start with an incremental first wave, assess how it works, and expand measures as needed.
I would term what the White House did to be in the right direction, but incremental. And that's probably not a bad way to go. Let's see how this first wave works and then they can expand it as need to be.
How should security risks in hardware supply and response be managed?
Buy directly, limit handling
Reduce physical-security risk by limiting how many hands handle a device and buying from its producer.
I think if you care purely about physical security, minimizing the number of hands that devices are passed through before they reach you is a sensible approach. So obviously buying directly from Ledger in this case would be the best way to minimize that risk.
But I personally would advocate that hardware wallets are probably still the best solution for retail users that want to self custody. Clearly, at least right now I would definitely buy devices directly from the producers and don't rely on the reseller network.
Issue general customer guidance when risks are known and improve industry response so assets can be secured faster.
The fact that this has been known by Ledger for a while should have at least triggered Ledger to issue some generic guidance so that maybe some customers would look at their device.
I would say if we, if as an industry we had a better way of responding in these instances such that we could secure those freezes more quickly. Actually in this instance we could have saved a lot of money.
And so I think it is possible, I think it may not be immediate, but over time we're going to perhaps use AI to help us write more secure software or build more secure systems.
And I fully agree with Ari. Now the trip for the white hats is to apply AI to that process, to use the power of AI to think through vulnerabilities, address vulnerabilities, fix vulnerabilities, design new systems without those same vulnerabilities going forward.
And so I think it is possible, I think it may not be immediate, but over time we're going to perhaps use AI to help us write more secure software or build more secure systems.
AI security is only a question of stronger safeguards.
情報源が示すこと
The claims also frame AI as accelerating attacks and as a tool defenders could use to find and fix vulnerabilities.
Now we have seen that there is an uptick of the AI assisted hacks that started to happen in March this year. So AI systems became smart enough, attackers started to use them to assist in these hacks.
Monitor protocol conditions and invariants, and build systems to detect risky situations quickly.
That's why we understand that it is extremely important to monitor the state and monitor the invariance and the different condition of the protocol in order to be able to quickly react.
Invest early in alignment, safety, security and guardrails.
For me, pacing the frontier is just really investing ahead and also investing way more than we even think we ought. Investing in the alignment and safety of the models, investing in security, investing in the guardrails.