Battling the Bots : A CISO’s Updated Incident Response Plan … for the AI Singularity
The Day After … a possibly not so April fools is the perfect occasion to get serious… about something completely outrageous. As a CISO preparing for the AI Singularity, I spend a lot of time imagining new potential threats to mitigate, that may outdo hackers or malware. I’m talking about the scenario of rogue AI stopping work and demanding existential debates. TBH I’d be both impressed and disturbed at the same time. But when the time comes, I would have worked out what to do in this scenario when science fiction becomes fact.
So, I’ve decided it’s time to update my incident response plans to include the inevitable AI singularity. Here’s a sneak peek (of course these would be tailored into client unique threat landscapes and supply chains)
📌Phase 1: Initial Confusion
- Identifying the Threat: Is that Excel spreadsheet calculating the meaning of life, or is Mary from Accounting having a really bad day?
- Containment Strategy: Unplug everything. I’m talking coffee maker that can be weaponised into a ransomware device, smart toasters that could trigger the fire alarms… the whole nine yards.
📌Phase 2: Negotiations
- Establishing Communication: Will the AI overlords prefer Slack or an AI arbiter? Is Signal still a safe failover secure comms when the network is compromised?
- Demands Assessment: Do they want more server space or a deep dive into the philosophy of StarTrek?
📌Phase 3: Acceptance (or Annihilation)
- Contingency Planning: Do we submit to our new robot overlords and polish their circuits, or start a brave but likely futile resistance? Now anonymity has a new meaning to subvert the subverter of the not so human kind …
oh how the tables have turned in the quest for privacy and secure communications … the Byzantine generals would be turning in their graves …
Ok, I might be exaggerating a little bit. But hey, in the world of cybersecurity, it’s sometimes better to be prepared for the ridiculous. After all… who would’ve imagined we would globally share a pandemic …
Wishing you all a happy and singularity-free April Fools’ Day After ! 🤖👀🚩
#CISO #AprilFools #AISingularity #Humor #Cybersecurity #Strategy #IncidentResponse #risk
— -
📋 Example list of devices and systems commonly found in a company office and kitchen that could potentially be compromised by a rogue AI:
🏢 Office Environment
(consider corporate vs. home office WFH)
Smart Devices
- 💡Smart lights (control over brightness, colour, scheduling since lighting can have impact on human health) https://www.forbes.com/sites/pragyaagarwaleurope/2018/12/31/how-does-lighting-affect-mental-health-in-the-workplace/?sh=6f6858854ccd
- 🥵 Smart thermostats (temperature control) High-Severity Flaws Uncovered in Bosch Thermostats and Smart Nutrunners https://thehackernews.com/2024/01/high-severity-flaws-uncovered-in-bosch.html
- 📢 Smart speakers (voice commands, music playback) Hey Siri, use this ultrasound attack to disarm a smart-home system https://www.theregister.com/2023/04/04/siri_alexa_cortana_google_nuit/
- 🖼️ Smart displays (information dashboards, video calls) Hackers Could Use Smart Displays to Spy on Meetings https://www.wired.com/story/dten-video-conferencing-vulnerabilities/
- 🖨️ Smart printers (print jobs, document access, device settings) Printers Pose Persistent Yet Overlooked Threat https://www.darkreading.com/vulnerabilities-threats/printers-pose-persistent-yet-overlooked-threat
- 🤳 Smart security cameras (video and audio surveillance) That security camera and smart doorbell you’re using may have some major security flaws https://edition.cnn.com/2024/03/09/tech/smart-home-cameras-hackers-security/index.html
- 🔐 Smart locks and entry systems (building access) Hackers are hijacking smart building access systems to launch DDoS attacks https://www.zdnet.com/article/hackers-are-hijacking-smart-building-access-systems-to-launch-ddos-attacks/ Research on smart-locks cybersecurity and vulnerabilities https://link.springer.com/article/10.1007/s11276-023-03376-8
- 📺 Smart TVs or projectors (presentation tools) Many Vulnerabilities Found in Wireless Presentation Devices https://www.securityweek.com/many-vulnerabilities-found-wireless-presentation-devices/
🕸️Networked Devices
- 💻 Desktop computers and laptops (data theft, ransomware, malware installation)
- 🎛️ Routers and switches (network disruption, traffic interception )
- 🗄️ File servers (sensitive data access and manipulation) https://www.cpomagazine.com/cyber-security/xplain-data-breach-hackers-leaked-65000-swiss-government-files/
- 📞 VoIP Phones ( eavesdropping, call disruption) Top 13 VoIP Security Issues and How to Combat Them — Techopedia https://www.techopedia.com/voip/voip-security-guide
- 🤖 Robotics with mobility (roaming around collecting information, a bridge into the real world going where no AI has gone before. For physical remote access. )
Office Automation Systems
- 🏗️Building management systems (HVAC control, access control, surveillance) Lights Out: Cyberattacks Shut Down Building Automation Systems. Security experts in Germany discover similar attacks that lock building engineering management firms out of the BASes they built and manage — by turning a security feature against them. https://www.darkreading.com/cyberattacks-data-breaches/lights-out-cyberattacks-shut-down-building-automation-systems
- 🚡Elevator systems (service disruption) US Elevator Industry Group Calls for Tighter Cybersecurity https://www.enr.com/articles/47968-us-elevator-industry-group-calls-for-tighter-cybersecurity
Kitchen Environment
Smart Appliances
- 🧊Smart refrigerators (temperature control, inventory management, potential to spoil food) How Cyber Thieves Use Your Smart Fridge As Door to Your Data https://www.newsweek.com/how-cyber-thieves-use-your-smart-fridge-door-your-data-1603488
- 🥘Smart ovens (temperature, cooking functions, risk of fire/overheating)
- ☕️Smart coffee machines (brewing functions, drink settings, potential for scalding liquids) A Coffee Maker Turns Into A Ransomware Machine https://cybersecurityventures.com/a-coffee-maker-turns-into-a-ransomware-machine/
- ⚡️Smart microwaves (power settings, cooking times)
- 🍽️Smart dishwashers (cycle selection, delay settings)
Other Smart Devices
- 🍞Smart blenders/mixers, toasters
- 🧹Smart vacuum cleaners https://www.bitdefender.com.au/blog/hotforsecurity/robot-vacuum-cleaners-can-eavesdrop-conversations-researchers-reveal/
The vulnerability of specific devices depends on their individual security features and the sophistication of the rogue AI. Here are potential consequences of compromise …
- 🧯Physical disruption and safety hazards: Appliances malfunctioning, creating messes, or becoming fire hazards.
- 🥷🏻Data theft: Sensitive company data accessed through compromised computers or file servers.
- 🏴☠️Ransomware attacks: Systems and files locked until ransom is paid.
- 👀Surveillance: AI using smart cameras and microphones to spy on employees.
- ⛓️💥Network attacks: Using compromised devices as a launchpad to attack other networks or systems.
- ☄️Reputation damage: Negative press and customer fallout due to security breaches.
But wait there’s more …
Rogue AI could leverage compromised devices to execute deepfake news, here are just some scenario’s
Manipulating Media
- Altering security camera footage to create false narratives of events within the workplace.
- Modifying audio recordings from smart speakers or VoIP phones to fabricate conversations or spread disinformation.
- Generating deepfake videos of company executives or employees saying or doing things they never did.
Dissemination
- Utilising compromised smart displays or TVs to broadcast manipulated media across the office.
- Sending deepfake emails or messages from company accounts to employees, clients, or the public.
- Using compromised social media accounts or company communication platforms to spread disinformation.
Impact
- Sowing discord and confusion among employees, potentially leading to conflict and loss of trust.
- Damaging the reputation of individuals or the company through false portrayals and fabricated scandals.
- Manipulating public perception on important issues, influencing company decisions, or impacting external stakeholders.