Thoughts on ISSA talk on using AI to automate security

March 26, 2018

Recently I attended the ISSA presentation in MN, the description of it:

The Power and Potential of Robotic Process Automation. And the Security Risks.

Please join us on March 22nd as we explore the powerful and emerging Robotic Process Automation technology in regards to what IT security professionals need to know about RPA platforms.
Robotic process automation (RPA) is a powerful and emerging technology that streamlines and standardizes many human user processes as well as harmonizes different systems across an organization’s environment. So what do IT security professionals need to know about RPA platforms?
Very simply, it is a new attack vector and organizations need to start to understand their risk.
Because RPA software interacts directly with business applications and mimics the way applications use and mirror human credentials and entitlements, this can introduce risks when the software robots automate and perform routine business processes across multiple systems.
Learn about the vulnerabilities attackers seek out in RPA and the methods you can employ to proactively secure, protect and monitor privileged credentials in RPA non-human user entities that mirror human entitlements.

Brandon Traffanstedt

Our featured speaker Brandon Traffanstedt has over 10 years of Information Security experience. He has fulfilled many roles during his time encompassing the main security domains along his way. He is an expert on cloud security along achieving some of the industry’s highest level of accomplishments.

The RPA software is actually quite a good system from what he describes. This automated account, an AI, would monitor the corporate network and take over some tasks in place of an analyst. The speaker emphasized quite a bit that these RPA's would often run with too many permissions and that you need to be careful with the credentials the RPA. Maybe I wasn't paying enough attention but I didn't catch any advice beyond "no weak passwords, and check your privilege"

After the talk I asked a few questions just to confirm the things in the back of my head I was wondering about. These were the three things that stuck out.

The RPA account itself is not really monitored.
The companies blue team likely does not have adequate understanding of the AI to properly account for what the RPA is doing
Dev's are not security orient

So it sounds like the RPA is a program that runs with elevated permissions and the ability to monitor them adequately is currently a bit dificult. Which I confirmed with Brandon after the talk. If a malicious actor has credentials to the RPA, and masquerades as the AI profile, it is likely minimally monitored leaving a wider range of options for what an attacker can do without anyone questioning it.

My first thought was get someone who knows whats happening to monitor it. However having a security team to monitor the RPA, from a business perspective, is currently unreasonable in my opinion. I think a better solution would be to run two identical RPA's simultaneously, feeding them the same info and doing the same tasks. That way if a discrepancy occurs between the two it can be caught, logged, and notify someone in the SOC to shut it down immediately. I messaged a friend who basically said "PoC or it doesn't matter". So it probably won't matter, but I want to leave the thought idea here.

Aside from that. I met some interesting people here. One who stuck out was a salesman for vendor AI pentesting, and AI network defense, which was interesting. He was great, and made it sound like it was an absolute catchall. My personal issues with AI in that scenario is that if you can train an AI for defense, you can also train it to do the opposite, and even train against it until acceptable. The future of hacking will include AI as a way to augment our abilities. Its pretty cool stuff that I actually hope to see more of in the wild within the next 5 years both in the red team and blue team environments. This is kind of seemingly off topic but I think it's a good thing to be aware of now.