Dutch Security Agencies Explain How Artificial Intelligence Is Changing Cyber Threats

In a joint statement by the Dutch Intelligence and Security Agency (AIVD) and the Dutch Military Intelligence and Security Service, as well as the National Cyber ​​Security Center (NCSC), the National Counter-Terrorism and Security Coordinator (NCTV), the Public Prosecutor's Office, the State Informatics Directorate (CIO Rijk) and the National Police Service, it was reported that artificial intelligence has significantly changed the threat environment.

In the statement, it was stated that vulnerabilities in the systems are detected and exploited faster, and long-existing weak points have grown with the influence of artificial intelligence. It was noted that attackers deployed artificial intelligence to find and exploit vulnerabilities before the defense side even noticed, and it was emphasized that "immediate action should be taken to be prepared for this."

In the statement, it was underlined that cyber incidents cause long-term disruptions in vital systems and victimize many people in cases where defense is inadequate, and that a large amount of names, addresses and citizenship numbers were seized, which has serious privacy and financial consequences.

DISINFORMATION IS GETTING EASIER

The statement stated that thanks to artificial intelligence, attackers can launch attacks faster, develop malware more easily, write more convincing phishing emails, and personalize disinformation on a large scale. It was stated that attackers do not need the most advanced artificial intelligence models for this, and such attacks can already be made with existing and easily accessible models.

In the statement, it was suggested that the first step that administrators can take immediately is to complete basic security measures. The statement stated that the attack surface should be reduced and old systems that no longer receive security updates should be replaced, and it was emphasized that it is "untenable" that attacks could occur due to updates not being installed at all or being installed late.

The statement called on institutions to assume that an attacker could enter the system and prepare accordingly, and asked to take the warning signs regarding artificial intelligence seriously.

"THE MAIN STEP IS NOT TECHNICAL, BUT CULTURAL"

NCSC Director General Matthijs van Amelsfort also commented on the statement: "Artificial intelligence automates the attack chain, from finding vulnerabilities to exploiting them. This technology can accelerate and strengthen existing cyber threats. This is exactly why it is more important than ever to take basic precautions." made his assessment.

In the declaration, it was stated that the most important step to be taken is not technical but cultural and awareness-related, and it was stated that cyber security is not "an information technology problem to be solved in a basement or a data center", but is an institutional, managerial and ultimately social issue.

It was pointed out that the weakest link in the chain is often not in technology but in the awareness of management and employees about cyber threats.