BeyondTrust CTO on Code Red and AI Security

Hey guys, thanks for the throw. We're here with Mark Mayfred, who's the CTO for BeyondTrust, and we're having a little chat about, well, something that happened almost a quarter of a century ago. It was this discovery of this Code Red worm that was running around, and we're now talking about the anniversary of that event.

And sadly, it looks like we may not have learned anything in the last 25 years, but I'm going to let Mark explain. Mark, for the uninitiated, walk us through what happened here with Code Red, and why is it still relevant today? Yeah.

So Code Red was back in 2001, July 2001. It was one of the first automated computer worms for Microsoft environments. So it would basically infect, at the time, Microsoft's web server software that was used by many companies, and it would spread automatically from one web server to another, infecting as it would go.

We're lucky that for Code Red, it didn't really have too nasty of a payload. It basically did two things. It would change the website to say, "Hacked by Chinese," was what it literally said.

And then, it also was programmed that on a specific date, every server that had been compromised by Code Red would eventually try to flood the White House web server. And what was interesting about Code Red, being one of these first automated worms, particularly for Microsoft software, there had previously been stuff like the Morris worm, et cetera, is it was a giant wake-up call at the time for the industry. Code Red had been spreading throughout different companies for over two weeks, up until myself and a colleague at the time, Ryan Perma, actually discovered it.

And so that ability for such an automated kind of attack to spread, to go undetected for two-plus weeks, to cause the havoc that it had, was really a new and different thing at the time. And it caused a lot of the industry to rethink their overall security policies, strategies, et cetera. And you can see a lot of parallels to what's happening now from an AI perspective, where AI is happening extremely fast, creating a lot of the new risks.

Everything about AI is how do you connect it to more systems, how do you automate it more fully, et cetera. And so there's a lot that we have to think about of, if we're just trying to respond quickly, that's not enough. Right?

The ability to respond, that time window continues to shrink. From the days of Code Red, where we didn't have great monitoring to even know these things were happening for two weeks, to today with AI, where an attack can unfold at machine speed in minutes, right? And we actually saw that just in the last week where, at OpenAI, they were actually testing one of their internal models, and the model actually broke out.

It decided in order to achieve its goal, it needed to hack into a third-party company, Hugging Face, that hosts a lot of AI models, and the model did that. Which you can't talk about automated computer worms and not think about what's happening with AI, where it's like the recipe for the ultimate worm that never sleeps, never stops, always gets smarter. And, yeah, it's a crazy contrast.

I think we've definitely learned some things from the days of Code Red, but some of the patterns of how we think about attack surface and controls and response, there's a lot of parallels that are timeless first principles. To your point about that, are we maybe too obsessed with guardrails on the AI agents and maybe not enough on the controls on the data that the AIA is trying to access, and that's where the trouble lies, and maybe we're just looking at the wrong end of the horse? Yeah, I think it's a great question.

I think AI, like most technology, two things happen. So number one, AI is amplifying all that's come before. So all the same sort of attacks, worries, all the safety guardrails that you would put in place, all of that is still very much applicable.

AI is just making it happen more and faster from an adversary's perspective, also from a defender's perspective. So that's one bucket where it's just a new technology that, like a lot of technology, is amplifying what came before, and how do you react to that? Secondarily, AI itself does represent new attack vectors, new risks that are AI-specific.

So when you think about companies that are racing to adopt AI-driven software development, you're putting AI on all of your endpoints. That AI has the ability now to-- It wants to be really, really helpful, and so maybe it decides it needs to go fix your production database for you. And it'll try so hard to be helpful, it'll steal your local, say, AWS CLI keys, go access production, and possibly not fix it, but destroy it in some way, or reset the database.

And these aren't theoretical things. We've seen all sorts of things online, where AI will run amok. Whether it's this recent OpenAI breach, where the model literally escaped and directly targeting a company, or where it's just AI misbehaving.

Where it's not even necessarily nefarious, it's just trying to be helpful. It turns out it's doing it in a way that's destructive to the business. So both of those ends are true.

Do you think cybersecurity folks are looking at all of this and going, "We've seen this movie before. " And they're waiting for permission to put these controls in place, because I feel like a lot of organizations were hell-bent on AI, and anything that got in the way of that was to be ignored. Yeah.

I think that the velocity that happens with new technology-- I was joking with a friend that most of these major technology shifts, it always ends up starting in the shadows. While companies are trying to figure out their top-down executive approach of what's the business going to roll out and do from a strategy perspective for AI, there's already the employees in the business who are adopting, using it, they're ahead of the curve, and we've seen that consistently. I was joking with somebody of like, you go back to the early days of Wi-Fi, while every business was figuring out how they were going to Wi-Fi interconnect their network, there was already the person that was shoving an access point under their desk just for convenience.

And so same thing in AI. We do these kind of free identity security risk assessments, and it's eye-opening for companies where they'll say what they think their current AI strategy and level of adoption is, and then we'll show them, "Here's actually what's in your environment and what's active," and it's always eye-opening. It's not surprising to me because, again, that 25-plus years in security, it always goes this way.

Anytime there's this major technology that can help advance things and bring a lot of good into the world, it's always rapidly adopted, just by folks that are down there, getting hands-on with it. How do cybersecurity people have this conversation? Because I think we've all seen this before.

A lot of folks go out of their way to avoid the security people because they don't want to have things put in their way or any additional obstacles or hurdles, and that usually comes back and bites them later. " Yeah. I think there's that tension that always exists of if you're purely that security team and no.

" You're just nothing but friction and kind of friction on the business. And so I think security teams right now, everybody's trying to figure out how do we allow the company to adopt AI, move quickly, but safeguard as it's going. And there's always business risk calculations.

Like do you hold back till you have the perfect security plan to adopt AI? A lot of companies that we see right now, they're running ahead. Security's trying to catch up.

And so a lot of what we try to do at BeyondTrust is figuring out what are the guardrails that you can get to control the broader blast radius. You're always going to want to fine-tune and get deeper, but how do you get the broader guardrails in place to limit the things that you want to avoid most so that people can adopt and move more quickly? But that is 100% the tension in this type of scenario, and almost every time there's one of these major technology shifts.

Same thing happened when everybody was getting out of the data centers, going the cloud. It's like, "Which cloud? Where?

Who's adopted it? " All of these things, and everybody was trying to figure out how to do cloud security while businesses were racing to adopt the cloud. And no different in AI.

I think the worry is that we've never seen a technology like AI in the sense of the level of intelligence, the ability for it to have the autonomy. It's taken something where when you think of this kind of realm of shadow IT, which we've all lived with through all these different iterations, the bar has been so severely lowered where it's not shadow IT, where it's just the person that is an engineer that can go stand up some cloud service and not have worked through security. Now you can have a person who's in marketing or sales, Claude will fully walk them through standing up infrastructure, putting something online.

One thing I'm always explaining to customers is that it's not just like how are you securing your developers who are adopting agentic AI coding. Everybody's a developer now if they want to be. And that is a very different level of shift than we've seen with other technology inflection points.

Correct me if I'm wrong, but I can't help but wonder, AI seems to be able to do everything except put the security controls in. So did we sidestep that whole process on purpose, or is this something we're going to catch up with later as we go build applications that the DevSecOp workflows that we need will be built in from the ground up- Yeah ... or are we going to constantly having to layer something on?

Yeah, it's a great question. I think one of the challenges that everybody's struggling with is just the nature of AI systems being these kind of like, excuse me. By the kind of heart of them is nondeterministic.

You could run the same thing 10 times, who knows what you're going to get. So everybody's trying to figure out how do you guardrail and guide to predictable outcomes, and I think there's a lot of security applicability there. Right now, if you think about the next 12 to 18 months, AI's ability to discover new software vulnerabilities, for example, is going to explode the number of vulnerabilities that people need to be worrying about, and it's already happening.

At the same time, if you look further out, unless you're just a business that's developing software who's just not adopting AI, we're just going to end up with much more secure and better software. It will normalize out, and I think we can look back to the days of Code Red and really the explosion and those types of worms and a lot of the threat of that moment. It became something where it wasn't even about could I patch fast enough because there were so many zero-day unknown vulnerabilities that were coming out.

There was no patch, and so you had to figure out how do I limit my attack surface? How do I be more resilient in the face of attacks where there is nothing to kind of patch or fix immediately, right? And so that requires you to build different architectures and I think a lot of businesses right now are figuring out what are the next architectures that you need, right?

What is the AI-driven SOC that the AI is equally responding from a defensive perspective as it is to kind of what's happening with adversaries? What is AI being applied to do much deeper attack surface analysis that most companies would love to do but rarely have the people and time. So I think there's a lot of good things that'll come from it, but I think no doubt every time we've had one of these inflection points, there's a lot of pain in the process and a lot of learning, and it feels like the unavoidable growth that happens in that kind of tension of technology advancements and security.

You think about Code Red, it was painful, but it was actually served as more of a wake-up call. It could've been much worse and so you're always apologies. You're always looking for that to catch the kind of common cold that ups your immune system right?

And doesn't totally take you out. And so I think we've had some good examples of that with AI that are causing some good wake-up calls and hopefully we're caring enough and kind of deeply enough and quickly enough, right? So what exactly are we supposed to be doing?

Because I think people understand that there are these AI models that can discover vulnerabilities faster than ever and new ones we've never seen before. And we also understand that they can create exploits probably in minutes, but I don't think we know what to do to defend because- Yeah ... I mean, historically, we've been kind of running around and to your earlier point, somebody was building a patch, testing it, and deploying it, and that took months, and we don't have months anymore.

Yeah, totally. I think the main thing is, and this is kind of why making this kind of parallel with things like Code Red is as an industry, if you look at the early 2000 timeframe, we lived through an era where there were so many unknown vulnerabilities that had no patch that were being exploited that the idea of just I'm going to patch and update quicker, we've lived a point in time in that early 2000 timeframe where that was true, and so it became very important that there should be no one single vulnerability that kind of brings the whole house down, right? How do you build in that level of resiliency?

There was a lot that happened in technology there where things were shifted from being configured by default to kind of be wide open to more secure by default. I think there's lessons there that we haven't necessarily learned that are being reproduced with some of the various AI technologies and vendors where it's like, yes, you want to be competitive in the level of productivity that you provide, but if everything's kind of opened up security defaults, somebody at some point is going to live that in the way that you got to reconfigure those things. So I think some of those lessons will play out very similar ways.

But, I mean, security to me has always been crucial of it can't be the one vulnerability that takes the whole house down. Sometimes it is, but that's what you're always fighting against. AI just makes it unavoidable.

It's been true before. AI makes it unavoidable. You have to operate in that way.

And so I think that the kind of bar raising there is not necessarily asking people to do a new thing per se, but it's a forcing function of if you haven't been doing it till now, it's going to be hard times. To your point about whether we've learned anything in the last 25 years, though, I still feel like our default is to not have the controls on, and then we have to go actually manually put those in place. And- I agree.

We go in these cycles. I mean, it's a very like... Yeah, we go in the cycles.

" It's not as a pessimist thing. I just think some of this is unavoidable of we go in these cycles of part of it's probably just human nature. We're always going to kind of default.

And so, I could tell you all the kind of... And I know you have the experience, too, of all the kind of lessons that we should kind of have learned and hung onto from 25 years ago, right? But there's people who have been now in the game for maybe three years or two years, right?

And these are the lessons I think we relearn, and I think that's one of the things that I always kind of try to, when I'm talking to people in infosec the most, is you're looking for what are those timeless concepts, right? So you take a concept like least privilege. It was equally applicable 20 years ago when we were talking about Windows, Linux, Multics, and beyond, right?

From an OS perspective, what does least privilege mean? It's equally applicable now when we think about AI agents, and the agent becomes more powerful the more access you give it, right? So how do you control the privilege level of that?

How do you rightsize that in real-time and at runtime and so forth? Those are very hard things, but that concept there, for example, of least privilege, right? It's a thing to understand and kind of apply, and it'll be equally true 20 years from now, whatever the new technology is, right?

" Yeah. So ultimately, are we going to be waiting on a handful of catastrophic events, like code red, and then we'll get our act together? Or is this going to be another instance where there's going to be death by a thousand cuts before somebody wakes up and says, "You know what?

" I think the biggest predictor for me is right now most of the better advanced AI models, they all have to be kind of tethered to a mothership, if you will. Right? So if you were to write a purely AI-driven worm right now, and our research team has actually done proof of concepts and spoken at conferences about what would an AI-driven worm actually be, this worm that's always self-evolving, et cetera.

The one thing that we have going right now is that the average compute, the average desktop, the average laptop is not great at running a model locally and self-contained. And so you always have this choke point of, if there's an AI worm out there propagating in the world, you're eventually finding some server somewhere, or it's talking directly back to OpenAI or Anthropic or whatever. There's always that choke point you can cut off.

I think the thing that worries me most is that the industry is trying to move, rightfully, to where people can run their own models, self-host, et cetera. Right? And the hardware does continue to advance.

And if you were tomorrow to have an environment in which your average or maybe above average kind of computer and environment could actually run these models in a better way, then you start to have where a worm that gets kind of released in that mode never dies ultimately. Right? You have less of the choke point to cut off because the amount of kind of environments and systems that it's able to propagate and live on is much broader than today.

It's a handful of companies in the world that kind of serve these models that act as choke points. So what is your best advice to security folks out there? " I think my timeless thing I always go back to is almost everything in security comes down to attack surface.

You either know your attack surface better than the attackers, you know where your AI exists or not. Very plainly, you can't secure what you don't know about. And so when you think about attack surface, it's always, do I have visibility into it?

Totally to all the questions you asked earlier, do you have all the right controls in place? Right? Do you have the balance of controls in place that control the blast radius of it's not one vulnerability that takes you down?

There's more layers to it than that. And I think that balance of how you think about your attack surface, how you analyze it, is the timeless thing. Oversimplifying a bunch of hard things that you got to do on top.

But I think the question is not what's the new widget to throw on top of AI to secure it? Right? It's stepping back and what does this new attack surface mean to my business?

And question number one always comes back to visibility, and then understanding as a security person, where is the business trying to go, right? Because that'll help inform what are the things you're going to be guardrailing or doing in the future. All right.

Folks, you heard it here. Hey, if the bad guys know more about your attack surface than you do, you're already behind the AI eight ball, and it's not going to get any better. Hey, Mark, thanks for being on the show.

Absolutely. Thanks for having me, man. All right.

And back to you guys in the studio.