The document discusses cybersecurity, artificial intelligence, and how AI can help improve cybersecurity. It notes that while organizations spend billions on cybersecurity, chief information security officers still feel highly exposed. Traditional security methods focus on preventing infiltration but are always one step behind evolving threats. The document argues that AI can help enforce cyber hygiene practices like least privilege to shrink the attack surface, making the problem more bounded and manageable compared to always chasing threats. It discusses how AI is well-suited for understanding intended application behavior based on established rules and data from good software.

1. CYBERSECURITY AND AI
PINEDA, DEXTER JAN P.
DAGANDAN, AL FRANCIS D.

2. What is
cybersecurity?

3. CYBER SECURITY IS THE PRACTICE OF PROTECTING
SYSTEMS, NETWORKS, PROGRAMS, FROM DIGITAL
ATTACKS. THESE ATTACKS ARE USUALLY AIMED AT
ACCESSING, CHANGING, OR DESTROYING SENSITIVE
INFORMATION ; EXTORTING MONEY FROM USERS OR
INTERRUPTING NORMAL BUSINESS PROCESSES.

4. What is ai?

5. SOMETIMES CALLED MACHINE INTELLIGENCE, IS
INTELLIGENCE DEMONSTRATED BY MACHINES, IN CONTRAST
TO THE NATURAL INTELLIGENCE DISPLAYED BY HUMANS
AND OTHER ANIMALS. IN COMPUTER SCIENCE AI RESEARCH
IS DEFINED AS THE STUDY OF “INTELLIGENT AGENTS":
ANY DEVICE THAT PERCEIVES ITS ENVIRONMENT AND
TAKES ACTIONS THAT MAXIMIZE ITS CHANCE OF
SUCCESSFULLY ACHIEVING ITS GOALS.[1] COLLOQUIALLY,
THE TERM "ARTIFICIAL INTELLIGENCE" IS APPLIED WHEN A
MACHINE MIMICS "COGNITIVE”.

6. • Security is not working.
• While security as a percentage of IT spend continues to grow
at a robust rate, the cost of security breaches is growing
even faster.
• Organizations are spending close to $100 billion on a dizzying
array of security products. In fact, it is not uncommon for CISO
organizations to have 30 to 40 security products in their
environment. However, if you ask chief information security
officers how they feel about their security risk, they will
express concerns over being highly exposed and vulnerable.
• Artificial intelligence (AI) and machine learning (ML) can offer IT
security professionals a way to enforce good cybersecurity
practices and shrink the attack surface instead of constantly
chasing after malicious activity.

7. WHY ISN’T
CYBERSECURITY
WORKING AS IT
SHOULD?

8. • There are many reasons security measures are falling behind, like
the ever-increasing sophistication of adversaries and traditional
perimeters virtually disappearing due to the rise of cloud and mobile
technologies. But one of the biggest reasons we are not succeeding
is that we always seem to be one step behind the bad guy.
• Most security products are focused on understanding malware or
attacks. This is an unbounded problem and, as a result, we are
always playing catch-up with malicious actors. The number of
malware and file less attacks run into the billions, with hundreds
of millions getting added each year. On top of that, the bulk of
these products focus on infiltration prevention. By homing in on
preventing infiltration almost exclusively, we are conceding the
asymmetry advantage to the attackers — while they just have to
get it right once, we must get it right every time.
• We must figure out a way to bound the problem. Focusing solely (or
primarily) on chasing the bad is not going to help us succeed.

9. HOW
CYBERSECURITY
THREATS CAN BE
CONTAINED?

10. • The principle of least privilege is one of the oldest information security
principles, with the original formulation by Jerry Saltzer stating: “Every
program and every privileged user of the system should operate using the
least amount of privilege necessary to complete the job.”
• If we enforce this principle to our IT environments, where every application
is confined to performing only what it must to complete its job, we’d have
dramatically reduced the attack surface, and would consequently have
bounded the problem.
• While this doesn’t eliminate the need to monitor for threats, it simplifies
the problem. You are no longer looking for a needle in a haystack,
but looking for a needle in a few pieces of hay.
• So, the right solution architecture would include two components:
1. A foundational piece that shrinks the attack surface by enforcing least
privilege (also known as cyber hygiene)
2. A complementary piece that controls residual risk by monitoring for
threats

11. •THE LIMITS AND
PRIVILEGE IN
CYBERSECURITY?

12. • Customers have tried implementing least-privilege environments
in the past through whitelisting. While whitelisting solutions
can be effective, they have been a nightmare to operationalize.
• The constant changes during the normal course of operating
an IT environment at scale are very hard to keep up with. So, in
this case, instead of playing catch up, we were chasing our own
tails. These changes include patching, upgrades, network
reconfigurations, new integrations, administrative activities like
backup, management activities and many other things.
• In fact, most whitelisting solutions had limited scope, focusing
largely on file integrity as against behavioral integrity of
programs. If we want to extend least privilege to include
behavior, arguably we’d have an even more complex operational
problem than the traditional whitelisting solutions. What is the
answer?

13. CAN AI AND
MACHINE LEARNING
HELP SHRINK THE
ATTACK SURFACE?

14. • Some argue that AI can solve the problem of “chasing bad” and
dramatically increase our security. If this were true, one might argue that
we do not need the foundational piece described above. There is little
doubt that with the resurgence of deep learning owing to multiple
factors, we have seen phenomenal improvements in heretofore hard
problems in AI. This includes object detection in images and videos, speech
recognition, natural language processing, self-driving cars, search,
recommendation engines, games like chess and Go, healthcare and much
more.
• Some of these problem domains are adversarial but have well-defined
rules like chess and Go. There are others like self-driving cars and
speech processing that have few rules that can be used to describe them.
However, these problems often do not have adversaries involved and
frequently have large amounts of data — a prerequisite for deep learning
algorithms. Chasing bad guys in cybersecurity is uniquely difficult due to
three factors:
1. It has sophisticated adversaries.
2. They are guaranteed to not follow any rules.
3. There is scarcity of labeled data on malware or attacks.

15. ON THE OTHER HAND, WE HAVE ESTABLISHED THAT ENSURING GOOD IS ALWAYS
GOING TO BE MORE EFFECTIVE THAN CHASING BAD. THIS APPROACH GETS EVEN
BETTER WITH THE RISE OF MODERN AI/ML.
AI/ML TECHNIQUES ARE IDEAL FOR ACHIEVING CYBER HYGIENE AND SHRINKING THE
ATTACK SURFACE AT SCALE, WHICH REQUIRES AN AUTOMATED UNDERSTANDING OF
THE INTENDED STATE OF AN APPLICATION. THERE ARE TWO DISTINCT ADVANTAGES
THAT MAKE IT IDEAL FOR AI/ML.
RULES EXISTS FOR THE BEHAVIOR OF GOOD SOFTWARE (THERE A LOT OF THEM,
BUT AI/ML CAN TAKE ADVANTAGE OF THEM, UPDATE THEM AND IMPROVE
SECURITY AS A RESULT).
THERE IS PLENTY OF DATA LABELED “DATA FOR GOOD WARE.”
THE PRIMARY CHALLENGE HAS BEEN THE CONSTANT CHANGE AT SCALE. THE
NATURE OF CHANGE, THOUGH, IS PREDICTABLE AND FOLLOWS PATTERNS. THIS IS
THE KIND OF PROBLEM THAT AI/ML EXCELS IN.
USING AI AND ML TO ACHIEVE CYBER HYGIENE AND ENFORCE LEAST PRIVILEGE
ENVIRONMENTS AT SCALE IS THE BREAKTHROUGH IDEA THAT WILL HELP US SECURE
MODERN IT ENVIRONMENTS AGAINST EVER-EVOLVING THREAT LANDSCAPE.