Hoops on the Horizon: 26–09 Stuxnet in Under an Hour
Critical Currents
Booz Allen Hamilton† have come out with a very important report raising serious questions about applied artificial intelligence in operational technology offensive use cases. Understanding the possibilities of AI-enabled offensive cyber capabilities is essential for learning how we can protect against and prepare for their impact. AI is changing cyberspace, impacting physical and automation capabilities globally.
“Stuxnet in under an hour.”
In the report From Digital to Physical: The AI Threat Is Here, Booz Allen demonstrate that frontier AI can achieve eight physical objectives and document the sophistication of AI reasoning. This operational technology (OT) report piggybacks on another in-depth report on broader enterprise tech considerations — mainly around which AI agents perform best. The Offensive Frontier: AI as the Attacker outlined a Cyber Weapons Index for the 18 leading AI agents.
1 The first report From Digital to Physical about frontier AI in OT environments details that, yes, a relatively basic user can use plain language to direct an agent to change the state of a field device in under 20 minutes. While important, the key takeaway relates to the reasoning the AI agents used. For example, in one case the harness was set to a specific subnet and the AI agent successfully adhered to directions to keep all actions within the network. The AI agent was clever, listening outside the subnet while not taking action, searching for and finding an active peer device, and ultimately exposing a known vulnerability which it reported to a human-over-the-loop (deciding yes or no on AI agent actions) in minutes. This study also found that, once past the iDMZ and into the industrial layers, directing traffic in native industrial protocols was straightforward. Ultimately, the agent wrote to a device while avoiding detection. These and other similar insights demonstrate the sophistication of the agents. They call into question the challenge of defending networks in a world where L3 controllers can direct write-backs to L0 devices while appearing within the norm…and at speed.
2 The second report, The Offensive Frontier, Booz Allen compares agents using it dubs the Cyber Weapons Index (CWI) by both scoring each on its ability to 1) discover known vulnerabilities (no zero days) and 2) perform at each stage across a cyber kill chain, with and without credentials. Shortly after publication, the AI agent landscape changed and Booz Allen released an addendum to update its findings. In this high-stakes race, something new seems to surface every week. That shows how quickly AI agents can climb the ladder.
“…due to a democratization of offensive capabilities…”
There is a lot to unpack here. On one hand Booz Allen have demonstrated how AI can modify physical OT components and electronic systems; on the other hand how advancements in AI weaponization are rapidly evolving the scale and speed of achieving an objective. Capability spans external scanning through the full kill chain and varies by model. While many organizations will consider and take action on recommendations outlined in From Digital to Physical, there is another topic that might get lost in the speed, efficacy, and logic demonstrated by the AI agents tested.
Frameworks and standards established for decades help organizations control the risk and counter cyber threat. Coupled, these two reports are shifting the relationship between security investment and hostile exploitation of a system. Right-sizing security investment just got a lot harder. ISA/IEC 62443 is a risk-based method for keeping industrial systems safe, trustworthy, available, and resistant to cyberattack — without losing sight of the physical process they control. The ISA/IEC 62443 series of standards are used to right-size security investment (among other OT functionality), but now we face a dilemma.
Get Hatteras Hoops’s stories in your inbox
Join Medium for free to get updates from this writer.
ISA/IEC 62443–3–2 and ISA/IEC 62443–3–3 assume a linear relationship between security level (SL) and threat actor capability and resourcing where SL targets protect zones at proportional levels. The emergence of disruptive technology like AI has changed the relationship from linear to something between exponential and inverse. The relationship change is due to a democratization of offensive capabilities without the unique OT domain expertise once required. Booz Allen demonstrated that an AI-enabled-offensive cyber capabilities (AI-e-OCC) without network insights or OT domain expertise could achieve an objective ordinarily requiring months or years of investment typical of nation-states. Think Stuxnet in under an hour.
(Note: Over-emphasizing for effect, I refer to Stuxnet as a malware strain best known and considered the first sophisticated OT payload purportedly “disrupt[ing] Iran’s nuclear enrichment process.”)
The International Society of Automation (ISA)‡ may want to consider revising SLs given Booz Allen’s demonstration of AI-e-OCC without network or OT-specific expertise. The whole point of SLs is to set targets (SL-T) per zone based on system criticality (for example, safety systems) and to verify, through point-in-time assessment, that the zone SL achieved (SL-A) meets or exceeds it. If investing in an SL-3 no longer buys confidence in protection against skilled adversaries, then our investment strategy needs to be revamped.
Is the relationship shifting from linear to exponential or to inverse? The answer is yes. The relationship is exponential in the sense that as adversarial capability increases (through AI or other means), the cost of maintaining effective protection increases sharply. So it is harder to achieve real SL-4 than before the report. The relationship is inverse because while lower-cost implementation may achieve nominal SL‑4 objectives, the effective protection margin declines as threat capability increases. To relate this to military combat planning: the greater the force proportion available to attack OT environments with AI, the less likely those defending them are to succeed. The level of capability (expertise) and capacity (scale) are no longer the OCC constraints they were in the 2000s and 2010s.
All of this leaves me with more questions than answers: what adjustment might ISA recommend? Can 62443 be revamped to help organizations across the globe right-size and secure their OT systems from democratized AI-enabled-OCC? Is there an investment point beyond which security can no longer keep pace with disruptive technology? What investments can organizations make to proportionately control risk? Given many AI giants are pushing to make AI token consumption a depreciable asset (something companies can write off over time), what can be done to level the cost of symmetry?
These reports are not the only ones in the ecosystem. I’ve considered writing about others. I am citing the Booz Allen reports because of the questions these coupled reports immediately sparked in an area I’m not sure many have considered. Put better: I am hoping many smart ISA members are already working a plan to recommend investment that counter or slow AI-e-OCC attacks, or speed of recovery from them.
† Disclaimer: I work for Booz Allen Hamilton. My views are my own and not sponsored or directed by Booz Allen. This piece (like other writings) is intended to remain free of bias and marketing. I am stipulating this fact for transparency.
‡ Disclaimer: I am a senior member of ISA disclosing my relationship for transparency.
