Carbon-based vuln hunters will always be better at infosec than AI, insist puny humans
(2020/06/24)
- Reference: 1592992812
- News link: https://www.theregister.co.uk/2020/06/24/bugcrowd_hacker_survey/
- Source link:
Puny humans still think they're superior to AI when it comes to infosec – and a significant number still don't venture into meatspace or get enough sunlight.
So reckons a survey carried out on behalf of Bugcrowd, which also made the edifying finding that 64 per cent of independent infosec researchers are on median incomes below $25,000/year – with half being aged 24 or younger.
Bugcrowd, which competes with HackerOne in the "crowdsourced security" bug bounty market, released its "In The Mind of a Hacker" [1]report to shed some light on the sorts of people using its services. While it referred to them throughout as "hackers", it meant both infosec researchers and pentesters who claim bug bounties through its platform – the people whose work helps thwart criminal hackers with bad intentions.
Financial reward was not the number-one motivation of the survey's 3,500 respondents either: just under a third (30 per cent) said "learning" was their main motivation, followed by a quarter who cheerfully admitted they were doing it for the cash. A fifth said they enjoyed the problem-solving element of vuln hunting.
"Hackers will always be one step ahead of AI when it comes to cybersecurity because humans are not confined by the logical limitations of machine intelligence," said Jasmin Landry, top-ranked Bugcrowd hacker. "For example, hackers can adapt four to five low-impact bugs to exploit a single high-impact attack vector that AI would likely miss without the creative flexibility of human decision-making."
Eye-catchingly, or perhaps not, the company's survey found that 87 per cent of humans agreed with Landry. No AI pentesting solutions were asked to respond.
Of the 3,500 people who answered the survey, just under half (48 per cent) reckoned healthcare orgs were most vulnerable to cybercrime during the COVID-19 pandemic. Although some ransomware gangs announced earlier this year they would stop targeting healthcare organisations, other notable names from the underworld declined to join those calls.
Bugcrowd also asked ethical infosec researchers how much sunshine they had access to during the year. A third answered "less than three hours a day", helping reinforce the stereotype that begins with an angry young man hiding inside a hoodie, an image 71 per cent said depicted them. And yes, at present it's almost always men: 94 per cent of respondents said they were male. ®
Sponsored: [2]Running Your Modern .NET Application on Kubernetes
[1] https://www.bugcrowd.com/blog/demystifying-hackers-bugcrowds-2020-inside-the-mind-of-a-hacker-report/
[2] https://go.theregister.com/tl/1956/-8477/running-your-modern-net-application-on-kubernetes?td=wptl1956
So reckons a survey carried out on behalf of Bugcrowd, which also made the edifying finding that 64 per cent of independent infosec researchers are on median incomes below $25,000/year – with half being aged 24 or younger.
Bugcrowd, which competes with HackerOne in the "crowdsourced security" bug bounty market, released its "In The Mind of a Hacker" [1]report to shed some light on the sorts of people using its services. While it referred to them throughout as "hackers", it meant both infosec researchers and pentesters who claim bug bounties through its platform – the people whose work helps thwart criminal hackers with bad intentions.
Financial reward was not the number-one motivation of the survey's 3,500 respondents either: just under a third (30 per cent) said "learning" was their main motivation, followed by a quarter who cheerfully admitted they were doing it for the cash. A fifth said they enjoyed the problem-solving element of vuln hunting.
"Hackers will always be one step ahead of AI when it comes to cybersecurity because humans are not confined by the logical limitations of machine intelligence," said Jasmin Landry, top-ranked Bugcrowd hacker. "For example, hackers can adapt four to five low-impact bugs to exploit a single high-impact attack vector that AI would likely miss without the creative flexibility of human decision-making."
Eye-catchingly, or perhaps not, the company's survey found that 87 per cent of humans agreed with Landry. No AI pentesting solutions were asked to respond.
Of the 3,500 people who answered the survey, just under half (48 per cent) reckoned healthcare orgs were most vulnerable to cybercrime during the COVID-19 pandemic. Although some ransomware gangs announced earlier this year they would stop targeting healthcare organisations, other notable names from the underworld declined to join those calls.
Bugcrowd also asked ethical infosec researchers how much sunshine they had access to during the year. A third answered "less than three hours a day", helping reinforce the stereotype that begins with an angry young man hiding inside a hoodie, an image 71 per cent said depicted them. And yes, at present it's almost always men: 94 per cent of respondents said they were male. ®
Sponsored: [2]Running Your Modern .NET Application on Kubernetes
[1] https://www.bugcrowd.com/blog/demystifying-hackers-bugcrowds-2020-inside-the-mind-of-a-hacker-report/
[2] https://go.theregister.com/tl/1956/-8477/running-your-modern-net-application-on-kubernetes?td=wptl1956
Vive la difference
"attack vector that AI would likely miss without the creative flexibility of human decision-making."
That sums up exactly what the difference is between artificial and real intelligence. AI is essentially token matching (mentation at the level of the bumble bee) whereas the human can be creative. We don't understand the mechanism of creativity - we can only infer from examples, and the range of inferences is almost as wide as the range of examples. Consequently we can't tell a mindless machine how to do it. I suspect that a key component of it is understanding .