Countering AI Cyberattacks Through Defense in Depth.
How to Prevent AI Cyberattacks Through a Defense-in-Depth Approach.
In recent years, cyberattacks have experienced an almost exponential growth year after year. This trend appears to intensify with the incorporation of advanced technologies, such as generative artificial intelligence, into the hands of threat actors. In 2023, security experts reported a surprising 75% increase in cyberattacks, of which 85% were driven by generative AI. These fast and precise cyber threats have the ability to automatically determine optimal attack strategies, modify their code to evade detection, and launch continuous automated attacks.
For businesses to defend themselves against these enhanced attacks, they must find ways to leverage artificial intelligence to their advantage. However, it is not as simple as using the same systems against the attackers; AI-based cybersecurity tools are also vulnerable to attacks, and any interference, even small, with datasets or inputs can compromise systems. Companies cannot rely on a single solution to face the growing level of AI-driven cyber threats, especially when their capabilities are not fully understood. The only way to confront this growing security emergency is through proactive planning that considers multiple contingencies to prevent, detect, and eliminate cyber threats through overlapping security tools and protocols. This comprehensive approach is known as defense in depth.
The list of vulnerabilities that can be exploited by cyberattacks is extensive. Language models (LLMs) are particularly effective in quickly identifying these weaknesses, including zero-day vulnerabilities. This type of flaw can quickly become a single point of failure that attackers can use to bypass existing security measures, allowing them to cause cascading failures within the cybersecurity infrastructure and extensively access business systems.
Cybersecurity teams should operate under the premise that all software and hardware in use contains flaws that can be exploited to access business systems, whether in their own IT infrastructure or in third-party services. For this reason, one cannot rely solely on a single security defense; rather, deeper and more varied security defenses must be implemented.
The defense-in-depth philosophy focuses on three key levels of security: prevention, detection, and response. This approach prioritizes the "overlapping" of multiple defenses at these levels to thoroughly protect all security controls, including tools and best practice procedures among staff teams. Technical controls such as firewalls and VPNs, administrative and access controls, data handling procedures, ongoing security posture testing, and documentation, as well as physical controls like biometric access, should all be taken into account. If one tool or approach proves inadequate, another will be available to support the defense. Hence the name defense in depth, which ensures that business systems do not rely on a single point of failure, thus protecting against total disruption in the event of a component malfunction.
The key principle is that these three levels must work together: if prevention fails, detection can identify the threat; if detection also fails, a robust response can limit the damage. It is a dynamic solution and not static. The goal of cybersecurity teams is to create an active and reactive ecosystem that can be easily assessed and adapted. Reporting measures and regular testing protocols are essential for any cybersecurity strategy, especially for defense in depth, which involves a wide variety of tools and processes that are easy to overlook. What works today may not be effective tomorrow, especially in the face of rapid advances in AI-driven cyber threats.
For the defense-in-depth approach to be successful, cybersecurity teams must select their tools carefully and strategically. Diversity in tools is key to establishing this defense. While AI has become essential in every cybersecurity strategy, it would be unwise to rely solely on AI software, as all such tools could be vulnerable to the same types of attacks, such as adversarial attacks, which involve providing incorrect data to induce erroneous behavior.
Diverse cybersecurity strategies help prevent attackers from exploiting a single system vulnerability, even slowing down AI-enabled attacks so that they can be identified and eliminated before systems are compromised. For instance, data protection practices should include not only encryption but also additional reinforcements like data loss prevention tools, as well as processes for data backup and recovery.
Additionally, businesses should use as much of their own data as possible when forming their cybersecurity defense to create customized AI tools capable of more effectively identifying unusual user behaviors or network activity than an external AI tool. Naturally, tools should be selected according to the company’s systems and operations; for example, those with critical online services may implement more defenses against DDoS attacks.
Staff training is also crucial. Educating system users about the importance of data protection and authentication is essential. A network monitoring tool can detect a threat, but user education and processes will strengthen diligence in protecting credential data, for example, by avoiding shared passwords and promoting the use of single sign-ons or two-factor authentication, resulting in reduced unauthorized access for attackers.
Cybersecurity teams must plan for all possible scenarios, including new or optimized threats that have been enhanced by AI or other emerging technologies. It is crucial that necessary resources are provided to investigate potential unknown threats and stay abreast of emerging developments and risks in the industry.
The most important takeaway is that although no security measure is completely foolproof, defense in depth offers a level of redundancy and resilience that significantly hinders an attacker’s ability to penetrate the system, allowing businesses not to feel powerless against these threats. The more organizations adopt this defense philosophy, the more complicated it becomes for threat actors to exploit the data of companies and their customers.
