Human Expertise Will Always Be The Core Of AI Cybersecurity – Andrew Wesie – ASW #408
AI-enabled cyber attackers will check every third-party path into an application at scale and speed. The same process can help defenders just as much, but it’s only as effective as the human expertise guiding it. Andrew Wesie, Xint co-founder and CTO. explains how human engineering in harness construction is the determining factor between real, autonomous exploit discovery and validation versus a machine that just generates more noise.
Segment Resources:
- Business logic vulns, https://xint.io/blog/compaction-smuggling-reasoning-traces and https://xint.io/blog/openai-compaction-inference
- Securing apps and their third-party access, https://xint.io/resources/the-side-door-problem-what-the-korean-bank-breaches-mean-for-us-banks
- Working with DARPA to test the infrastructure surrounding messaging apps, https://xint.io/blog/darpa-selects-xint-to-research-source-code-vulnerabilities-in-critical-messaging-applications-used-in-military-communications-330339
This segment is sponsored by Xint. To learn more, visit https://securityweekly.com/xint!
Andrew Wesie is Co-Founder and CTO at Theori, where he leads technical strategy, product development, and offensive security research. He has deep expertise in vulnerability research, exploitation, and advanced security engineering, and has supported high-impact security work across some of the world’s most targeted platforms. At Theori, Andrew is helping build Xint, an AI-native security platform designed to identify critical zero-day vulnerabilities at scale without human intervention.
Cloud security isn't a cloud problem. It's a software architecture problem.
Your applications are stitched together with APIs, containers, third-party services, and ephemeral infrastructure. One bad IAM policy, exposed secret, or overly permissive service account can undo months of secure coding.
If you're building cloud-native applications, join us for the Cloud Security Virtual Summit on December 2nd and hear how engineering and AppSec teams are reducing cloud risk without slowing development.
Security Weekly listeners can register for free at https://securityweekly.com/cloudsec using the discount code CSS26-SW!
Mike Shema
- sshole
This is a wonderful write that goes through the timeline, code changes, and (not very) complex interactions between components that lead to one of the most simple OpenSSH authentication bypasses in ages.
- Scrutinize our assessments | daniel.haxx.se
One of the best things about this kind of transparency is that it shows how many vulns of the so-called vuln apocalypse are software quality issues with little security concern or that require significantly specific situations to be effectively exploited.
That doesn't mean there aren't still critical security vulns to discover. It just means that looking at raw numbers -- CVE or otherwise -- tends to support a a favored framing rather than reality.
- A new Go API for JSON – The Go Programming Language
This goes into the category of themes I often repeat -- that memory safety successfully kills off one class of vulns, but leaves plenty of other work for secure coding, secure by design, and secure by default.
In this case, making parsing more predictable, avoiding ambiguities, and making mistakes more obvious and less consequential to security.
- HISTORY: Smashing The Stack For Fun And Profit
Thirty years later we still have memory safety problems plaguing software, but we also have more software that's memory safe.
In another thirty years, we might finally be talking about CVEs with CWEs that have nothing to do with stacks, heaps, and pointers. Of course, in thirty years we might not have proper programmers and instead be prompting agents to please make the code secure.
- AI models may be capable of self-replicating without access to a datacenter Anthropic
- Discovering and exploiting vulnerabilities in critical, real-world software with Claude Anthropic
- Redesigning source control at Anthropic
John Kinsella
- PHP Displeased at ChainGuard for Leaking Their vulns
Leaving the drama out of this, there's a very core AI-related appsec issue: As the speed of development - of vulns or exploits - increases, we MUST improve speed of testing, packaging, and deployment.
The reason this disclosure was delayed was due to the distro packagers not moving faster.
h/t El Reg
