3 ms·
> As a field, we already know how to do security Uhhh, no, we actually don't. Not when it comes to people anyway. The industry spends countless millions on tra
by NitpickLawyer 1y ago
> As a field, we already know how to do security
Uhhh, no, we actually don't. Not when it comes to people anyway. The industry spends countless millions on trainings that more and more seem useless.
We've even had extremely competent and highly trained people fall for basic phishing (some in the recent few weeks). There was even a highly credentialed security researcher that fell for one on youtube.
- simonw 1y agoI like using Troy Hunt as an example of how even the most security conscious among us can fall for a phishing attack if we are having a bad day (he blamed jet flag fatigue): https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/ https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mail...
- zbentley 1y agoWould LLMs help with that? Seems like they could be phished as well. Also, there’s a difference between “know how to be secure” and “actually practice what is known”. You’re right that non-AI security often fails at the latter, but the industry has a pretty good grasp on how to secure computer systems. AI systems do not have a practical answer to “how to be secure” yet.