“Attackers have clear advantages”: Expert: IT security gaps remain a problem

Serious security gaps in websites or programs appear again and again - most recently in the PHP programming language. One expert says that closing these gaps will be a lengthy process. However, a tool that has so far been little researched could help increase security in the future.

According to an expert from the Federal Cyber ​​Agency, the serious security gap in the widely used PHP programming language is an example of a development that is likely to continue for a longer period of time. “We are probably already in a small valley of tears at the moment,” said Daniel Gille, head of the key technologies department, to the German Press Agency.

It is conceivable that a plateau will be reached at some point, as software cannot have an infinite number of vulnerabilities. However, attackers currently have a clear advantage: They can evaluate a published security vulnerability and develop an attack within minutes or hours. In the past, this often took weeks or months.

Fixing such security gaps, on the other hand, is done decentrally and takes significantly longer. This is currently evident in the PHP gap. Many operators only got their websites back online hours or more than a day after installing updates. The Federal Office for Information Security classifies the risk of the gap as extremely high. So far, authorities have reported no successful attacks on the federal administration. The Digital Ministry is checking whether data has been leaked.

AI should write program codes

An evaluation by the US IT group IBM suggests that this is not an isolated case. Its security team, X-Force, observed a dramatic increase in known security vulnerabilities at numerous large software providers such as Microsoft, Oracle and the Google Chrome browser. From January to September of this year there were at least 10,124, an increase of around 578 percent compared to the same period last year. More than half of these AI-discovered vulnerabilities were rated as high or critical risk according to a scoring system used in the industry.

Cyber ​​agency expert Gille believes that AI will help even more in the future to write program code so that it is less vulnerable. The cyber agency is preparing a research program that will be put out to tender soon. Considerations of using artificial intelligence itself as the basis of an operating system go even further.

According to Gilles, the cyber agency is tasked with carrying out experimental research. It is therefore conceivable that such a system would have a fundamentally different architecture and no longer have one fixed code. Software vulnerabilities would then no longer affect all systems that use it. However, the idea is controversial among operating system experts. "This is actually a completely open research question. No one can probably answer that at this point in time," said Gille.