Welcome back to the monthly TCE Strategy newsletter! From AI to Apple to the privacy of your data, March definitely came in like a lion. Time will tell if it goes out like a lamb. Let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, our families, and the companies we work for.


How Does AI Really Work?

The truth is that we don’t have a firm grip on how AI works, or more importantly the Large Language Models (LLMs) which are the underpinnings of AI. Sure, we can describe the engineering and implementation of them, but comprehending why they come up with the answers they come up with is not well understood. Predicting the output isn’t easy. It’s not as if we have no clue, but I think of our understanding of LLMs as similar to our ability to predict the weather. We have a lot of good ideas and models, but predicting what the weather will be a month from today is anybody’s guess.

This leads to some rather terrifying considerations when it comes to cybersecurity, and frankly to morality. As LLMs are used for triaging patients in hospitals, grading student assignments, and drafting legislation, our inability to understand what is really “going on under the hood” of AI will definitely lead to unintended consequences. Here are a couple of recent examples:

Several AI models were taught to play chess, and they were then put up against the best chess computer in the world. The AI engines cheated up to 37% of the time by rearranging the pieces in their favor (in effect, making illegal moves).

An AI engine was used to write computer code. The designer of the AI engine taught it to purposely write “back doors” into its code and not tell the person using the AI engine about it, so a cybercriminal could gain unauthorized access to the systems that used the code.

AI engines have been asked to explain their reasoning on how they arrived at an answer. They have been caught deliberately misleading their users about their “thought process”.

Takeaway: AI is very useful, but it is in its infancy, and like essentially all technology, it is morally agnostic. Take the answers you receive from AI with a serious grain of salt.


The UK Government Seeks to Strip Citizens’ Right to Privacy

quietly disappeared because the FBI found another way into the phone. An identical scenario played out in 2020 regarding a shooting at the Naval Air Station in Pensacola, FL.

Fast forward 9 years. In a rather stunning move, the UK government sent a demand letter to Apple in early February regarding its “Advanced Data Protection” or ADP. ADP stores the data in users’ iCloud accounts using a special type of encryption where only the user can unencrypt their data. Apple literally can’t do it. The UK government demanded that Apple build a back door into the ADP product so that they can crack the encryption when the UK government wants them to. While Apple refused to implement a back door into ADP, on February 21st, Apple removed access to ADP from all British iCloud accounts, effectively giving the UK government what they asked for. Then on March 5th, Apple challenged the UK govt’s data access order in court. However, any hearings on this are being kept confidential, so on March 14th, the US government sent a bipartisan letter to the Lord Justice overseeing the case demanding that the hearings be made public. 

Takeaway: If you are an iPhone user and live in a country that allows ADP, turn it on. If you live in a country where the feature isn’t available, petition your government to allow it. Privacy is a fundamental human right.


Patch Early, Patch Often

March has had a rash of patches for cybersecurity vulnerabilities that are particularly serious. Microsoft Windows’ “Patch Tuesday” fixed six vulnerabilities that are being actively exploited in the wild. VMWare’s server virtualization product has three actively exploited vulns that patches came out for on March 4th, including  one that allows escape from a virtual computer to the physical computer that it is running on, which is the “nuclear option” of virtualization vulnerabilities. Patches were released on March 18th for websites running Apache Tomcat. This fixes a vulnerability where a remote, unauthenticated attacker can run arbitrary code (read: take your website over). That’s just about as bad as website vulnerabilities get.

Takeaway: Cybersecurity is a process, not an event. Computers need patching to fix vulnerabilities, and it’s up to us as users to set our devices to auto-patch.

Until next month, stay safe!

TCE Strategy in the News

Interesting Articles