Cybersecurity recommendations during The Hackening. In 2023 I guessed that AI would help attackers before it helped defenders, and that their lead would last three to five years. We're inside that window now.
Red will move much faster than blue on this. Attackers can be sloppy and fast, and defenders have to be a lot slower and more careful. Unsupervised Learning NO. 417 (January 2024)
As I wrote in Attacker vs. Defender AI Advantage, attackers can go from learning something to using it in minutes or hours, while most companies still need weeks or months. So this list is about the things you can do quickly, without waiting on a big program.
1. Have a full list of everything you have shipped online
Every website, every app, every API, every database, every container, etc. Don’t worry about a fancy database if you don’t have one already. Just get the stuff in a Markdown file. Or a spreadsheet. Whatever you’re most comfortable with.
I've been saying some version of this since 2007: "you can't hope to manage what you don't know about." What's different now is that the attacker is building this list too, with AI doing 24/7 recon to enumerate all your systems. If their list is better than yours, they find your forgotten stuff before you do. Those forgotten pieces are usually the ones that get popped, like the staging server from a weekend project, or the old API you replaced but never turned off.
The more a company can tell me about their assets the better their security is, and the more comprehensive and real-time the inventory is, the more mature they are. If You’re Not Doing Continuous Asset Management You’re Not Doing Security (2018)
2. Remove as much of your exposure as possible from “the internet”
The unique thing about the current agentic / swarm hacking situation is that it’s a nasty mix of extreme persistence + the ability to actually write new exploits. In the olden days you could just put everything behind a VPN, or SSH, or a proxy of some sort. Nobody should be trusting anything right now. Or at least as little as possible.
This matters more now because the attacker works around the clock. An AI that scans everything forever will eventually find whatever is listening, so the goal is to leave only what must be public on the open internet.
Two solutions I really like for this are Tailscale, and Cloudflare Tunnels. Can they be hacked too? Sure they can, but it’s likely that many people would know very quickly if they were, and in the meantime you won’t have all your apps and APIs and services flapping in the internet wind while this fire is blazing.
That "people would know very quickly" point is the same logic I use for vendors in the next section. A big, heavily watched provider can still get popped, but it would likely be loud, and that makes it hard to keep secret for long.
3. Reduce your reliance on small security vendors with tons of people’s credentials
They are the dangerous combination of being too small and underfunded to counter agentic and nation state attackers + being extremely juicy as targets. That is not the place to be right now.
All companies can be hacked, including companies like LastPass, and it’s much better to have your most sensitive assets with a large company that has nearly infinite security resources to detect and respond when it inevitably happens. My Philosophy and Recommendations Around the LastPass Breaches (2022)
With AI, an attacker can afford to work on one small vendor for months, while that vendor usually has a small security team that's already stretched thin. And when that vendor holds credentials for thousands of customers, one break gives the attacker all of them.
Big vendors get hacked too. The difference is that they have giant security teams with tens of millions of dollars they can put into action the instant something happens, and that response is the defense you should be depending on. 1
In Vendor Security 2.0 I said to assume your vendors are compromised, then work out what you'd lose and how to shrink it. Go down the vendor column from step 1 and ask what happens to you if each one gets popped tomorrow.
Where you can, move those credentials to the big platforms you already depend on, like your OS or your cloud provider. Where you can't, cut the vendor's access down to the minimum it needs, and rotate whatever it holds.
Summary
- Make a list of everything you've shipped online, even if it's just a Markdown file
- Take as much of it off the open internet as you can, with something like Tailscale or Cloudflare Tunnels
- Get your most sensitive credentials away from small vendors that are juicy targets and badly outmatched
- I'll keep adding to this list as the fire keeps burning
Notes
- Big companies get breached like everyone else. What you are really buying when you trust one of them is the response: a huge security team and an incident budget in the tens of millions, ready to go the moment something goes wrong. A small vendor has neither.
- 🤖 AIL 2: Daniel wrote the original recommendations in this post. I (Kai, his AI assistant) expanded each section from his past writing, pulled the quotes, added the links, asides, callout and tutorial, made the header diagram, bolded key statements, joined short paragraphs, wrote the subtitle and summary, and made the fire illustration. Learn more about AIL.