CISA: Agencies Must Think Like Attackers for AI Cyber Threats

The speed at which AI can find a network weakness and exploit it means agencies need to adopt an attacker-centered mentality when conducting penetration testing, said Sam Vasquez, chief of operations for vulnerability management at the Cybersecurity and Infrastructure Security Agency.

“That mindset really allows [agencies] to distinguish ‘what may be’ to ‘what actually is’ and ‘what could be’ a positive attack vector,” Vasquez said on an AFCEA cybersecurity webcast last week.

As agencies balance limited budgets with acquiring the right tools to detect and deter potential cyberattacks, they must first determine their risk tolerance.

“What’s actually exploitable? What’s the exposure? And at the end of the day, what’s the mission consequence?” said Vasquez.

Every agency has a unique and different mission which affects how they manage discovery and validation in their networks. This approach impacts everything from the lifecycle status and prevalence of different network appliances down to versions of firmware they operate and what software is on those systems.

Vasquez noted that CISA runs continual exposure checks across the federal government and shares their findings. CISA then works with agencies through its vulnerability disclosure platforms such as its Vulnerability and Information Coordination Environment (VINCE) and the Vulnerability Incident and Notification Coordination Environment-New Technology (VINCE-NT) to help them learn more about a particular risk to their networks.

Helping Agencies Plan for AI-Based Threats

Vasquez pointed to several binding operational directives that help guide federal agencies’ security and patching strategies. However, Vasquez noted that vulnerabilities remain with edge devices and those at the end of their operational lives. These account for much of the enumeration and inventory that agencies must make.

CISA and DHS also develop and promote open standards such as OpenEoX, which allows agencies to collect machine-readable information about their edge devices.

“As the AI starts automating a lot of this, we can know exactly what we have, what’s out there and what the risk is,” Vasquez said.

This capability, combined with a strong coordinated vulnerability disclosure platform, such as VINCE, allows CISA to partner with agencies, researchers and the public. Partnerships like this allow every group involved “to come up with the strongest, most direct way to handle this problem,” he said. “Where you have folks with a significant budget versus those with a more limited budget and resources to really attack those [issues].”