EP 88: Securing the Infrastructure AI Just Made Vulnerable

Let's talk a little bit about the threat landscape.

This is certainly changing now that Anthropic has Mythos and OpenAI has Opus.

They're capable of pattern matching, finding vulnerabilities long before the humans do.

And this is going to create an influx of new vulnerabilities.

How's that going to impact critical infrastructure?

So the paradigm shift that we are seeing because of entropic mythos and basically the AI entering the cyber landscape is basically that in the past, we as defenders, we were focusing on identifying the vulnerable systems, especially in the critical infrastructure, as well as in OT, as well as in IOMT.

And we were trying basically to patch the systems that we knew are vulnerable and there were certain priorities that we were attaching to different systems.

So basically when there was a critical vulnerability and we knew that it existed, for instance, there's a part of our critical infrastructure that has a critical vulnerability, we were focusing on addressing this system first and we were basically trying to patch and secure all vulnerable systems.

I think the paradigm has shifted now because, frankly speaking, everyone is assuming that all systems are vulnerable, right? And, you know, even though you might not know about the open, you know, vulnerability, people and folks in security just assume that all systems are vulnerable, right? So I think it changed, you know, the landscape and the way that especially the vulnerabilities are being approached.

A lot of these systems were put in place because they thought the devices were unreachable.

Clearly, they are reachable today with all the interconnectivity that we have.

What sort of mitigations, then, can exist if these devices were built without security, without any sort of plan for that future?

In my opinion, I think we still should not forget about the security foundations.

If the system does not require the external network connectivity, it should not have such, you know, I think these are the basics and what we have seen here in Poland in some of the publicly documented attacks on our critical infrastructure, they were basically using very basic misconfigurations.

So I think how I should call them, we are talking basically about routers and firewalls, which had an external access enabled with default passwords.

This is not a rocket science, it's just very, very basic Yeah, I mean, just the basic, it's not even a vulnerability, it's just misconfiguration.

But when we are talking about the small critical infrastructure facilities, very often you will have a single IT person or security person supporting tens or dozens of these.

So I think, you know, just going back to the basics, just making sure that when the infrastructure does not require the network connectivity, just make sure that the The points of contacts, like the jump was the firewalls, they are just basically configured properly.

And I think this is a great starting point.

Now going further, as you mentioned, sometimes it's impossible.

Sometimes some of these devices do require the external connectivity or some internal network connectivity.

We need to think about, I mean, in these scenarios, I think, again, going back to the basics, try to avoid having a flat infrastructure, flat network within the infrastructure.

It's very rare that everything needs to talk to everything else.

I love this analogy of ships or submarines where we have this, where we are basically segmenting or building this containment zones, right? When there is a leak or flood, the whole ship doesn't go down.

It's just a part of the ship that is being impacted.

Let's talk a little bit about the threat landscape.

This is certainly changing now that Anthropic has Mythos and OpenAI has Opus.

They're capable of pattern matching, finding vulnerabilities long before the humans do.

And this is going to create an influx of new vulnerabilities.

How's that going to impact critical infrastructure?

So the paradigm shift that we are seeing because of entropic mythos and basically the AI entering the cyber landscape is basically that in the past, we as defenders, we were focusing on identifying the vulnerable systems, especially in the critical infrastructure, as well as in OT, as well as in IOMT.

And we were trying basically to patch the systems that we knew are vulnerable and there were certain priorities that we were attaching to different systems.

So basically when there was a critical vulnerability and we knew that it existed, for instance, there's a part of our critical infrastructure that has a critical vulnerability, we were focusing on addressing this system first and we were basically trying to patch and secure all vulnerable systems.

I think the paradigm has shifted now because, frankly speaking, everyone is assuming that all systems are vulnerable, right? And, you know, even though you might not know about the open, you know, vulnerability, people and folks in security just assume that all systems are vulnerable, right? So I think it changed, you know, the landscape and the way that especially the vulnerabilities are being approached.

A lot of these systems were put in place because they thought the devices were unreachable.

Clearly, they are reachable today with all the interconnectivity that we have.

What sort of mitigations, then, can exist if these devices were built without security, without any sort of plan for that future?

In my opinion, I think we still should not forget about the security foundations.

If the system does not require the external network connectivity, it should not have such, you know, I think these are the basics and what we have seen here in Poland in some of the publicly documented attacks on our critical infrastructure, they were basically using very basic misconfigurations.

So I think how I should call them, we are talking basically about routers and firewalls, which had an external access enabled with default passwords.

This is not a rocket science, it's just very, very basic Yeah, I mean, just the basic, it's not even a vulnerability, it's just misconfiguration.

But when we are talking about the small critical infrastructure facilities, very often you will have a single IT person or security person supporting tens or dozens of these.

So I think, you know, just going back to the basics, just making sure that when the infrastructure does not require the network connectivity, just make sure that the The points of contacts, like the jump was the firewalls, they are just basically configured properly.

And I think this is a great starting point.

Now going further, as you mentioned, sometimes it's impossible.

Sometimes some of these devices do require the external connectivity or some internal network connectivity.

We need to think about, I mean, in these scenarios, I think, again, going back to the basics, try to avoid having a flat infrastructure, flat network within the infrastructure.

It's very rare that everything needs to talk to everything else.

I love this analogy of ships or submarines where we have this, where we are basically segmenting or building this containment zones, right? When there is a leak or flood, the whole ship doesn't go down.

It's just a part of the ship that is being impacted.