Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity looks like proof of work now

dbreunig.com

Post reply on HN
Print view View original

31–40 of 230 posts

Re: Cybersecurity looks like proof of work now

#31

Post by tptacek »

mapontosevenths wrote: post #21
jerf wrote: post #14

I've said for decades that, in principle , cybersecurity is advantage defender. The defender has to leave a hole. The attackers have to find it. We just live in a world with so many holes that dedicated attackers rarely end up bottlenecked on finding holes, so in practice it ends up advantage attacker. There is at least a possibility that a code base can be secured by a (practically) finite number of tokens until the…

>in principle, cybersecurity is advantage defender I disagree. The defender must be right every single time. The attacker only has to get lucky and thanks to scale they can do that every day all day in most large organizations.

The attacker and defender have different constant factors, and, up until very recently, constant factors dominated the analysis.

Re: Cybersecurity looks like proof of work now

#32

Post by Muromec »

chromacity wrote: post #6

I discussed this in more detail in one of my earlier comments, but I think the article commits a category error. In commercial settings, most of day-to-day infosec work (or spending) has very little to do with looking for vulnerabilities in code. In fact, security programs built on the idea that you can find and patch every security hole in your codebase were basically busted long before LLMs.

Commercial infosec is deleting firefox from develop machines, because it's not secure and explaining to muggles why they shouldn't commit secret material to the code repository. That and blocking my ssh access to home router of course.

Re: Cybersecurity looks like proof of work now

#33

Post by janalsncm »

snowwrestler wrote: post #4

It looks like proof of work because: > Worryingly, none of the models given a 100M budget showed signs of diminishing returns. “Models continue making progress with increased token budgets across the token budgets tested,” AISI notes. So, the author infers a durable direct correlation between token spend and attack success. Thus you will need to spend more tokens than your attackers to find your vulnerabilities first…

Knowing nothing about cybersecurity, maybe the question is whether it costs more tokens to go from 32 steps to 33, or to complete the 33rd step? If it’s cheaper to add steps, or if defense is uncorrelated but offense becomes correlated, it’s not as bad as the article makes it seem.

For instance, if failing any step locks you out, your probability of success is p^N, which means it’s functionally impossible with enough layers.

Re: Cybersecurity looks like proof of work now

#35

Post by c1ccccc1 »

If you have a limited budget of tokens as a defender, maybe the best thing to spend them on is not red teaming, but formalizing proofs of your code's security. Then the number of tokens required roughly scales with the amount and complexity of your code, instead of scaling with the number of tokens an attacker is willing to spend.

(It's true that formalization can still have bugs in the definition of "secure" and doesn't work for everything, which means defenders will still probably have to allocate some of their token budget to red teaming.)

Re: Cybersecurity looks like proof of work now

#37

Post by coldtea »

mapontosevenths wrote: post #21
jerf wrote: post #14

I've said for decades that, in principle , cybersecurity is advantage defender. The defender has to leave a hole. The attackers have to find it. We just live in a world with so many holes that dedicated attackers rarely end up bottlenecked on finding holes, so in practice it ends up advantage attacker. There is at least a possibility that a code base can be secured by a (practically) finite number of tokens until the…

>in principle, cybersecurity is advantage defender I disagree. The defender must be right every single time. The attacker only has to get lucky and thanks to scale they can do that every day all day in most large organizations.

Not to mention an attacker motivated by financial gain doesn't even need a particular targer defender. One/any found available will do.

Re: Cybersecurity looks like proof of work now

#38

Post by umvi »

> You don’t get points for being clever. You win by paying more.

And yet... Wireguard was written by one guy while OpenVPN is written by a big team. One code base is orders of magnitude bigger than the other. Which should I bet LLMs will find more cybersecurity problems with? My vote is on OpenVPN despite it being the less clever and "more money thrown at" solution.

So yes, I do think you get points for being clever, assuming you are competent. If you are clever enough to build a solution that's much smaller/simpler than your competition, you can also get away with spending less on cybersecurity audits (be they LLM tokens or not).

Re: Cybersecurity looks like proof of work now

#40

Post by zachdotai »

we did a lot of thinking around this topic. and distilled it into a new way to dynamically evaluate the security posture of an AI system (which can apply for any system for that matter). we wrote some thoughts on this here: https://fabraix.com/blog/adversarial-cost-to-exploit
Post reply on HN