Is Your Website Safe?
After a flurry of costly AI-website hacks, security pros are suggesting the unthinkable: Shut It Down.
It’s a growing and somewhat shocking option for many organizations selling products or information on websites: Shut it down.
Earlier this month, one firm—makers of software used by many HR departments worldwide—pulled the plug on its best-selling product for several days to stop a security hack. Government-run websites across the world did the same thing in response to the same flaw. And for their part, security services worldwide advised outlets to close their sites to the public until the security vulnerabilities could be patched.
Welcome to the new world of defending heavily used websites from AI-assisted hacks. Far more often than in the past, experts say, leaders are going to be asking “Should we shut it all down?” In a stunning announcement, the developer of a widely-used programming language disclosed that, because of a newly-discovered flaw, 70% of all websites worldwide were now vulnerable to a AI attack, creating a series of difficult security decisions across hundreds of companies. “There’s a growing belief that events like this can become the new normal,” says John Williams, Korn Ferry’s vice president of security.
AI-aided attacks on websites have been a serious concern for cybersecurity experts for the last few years. But cyber pros hit the panic button earlier this month when website-software makers disclosed a security flaw that affected seven in ten websites. The flaw, it turns out, is more than 30 years old, but it took AI to discover it—a development which made some security experts even more worried: The disclosure likely means that bad actors using AI have a good chance of finding additional critical weaknesses. “Vulnerabilities can be found much more easily with AI,” Williams says.
But shutting down an entire website is no easy decision, causing loss of actual sales and disruption for both customers and employees of affected companies. After all, software makers have been patching security holes for nearly as long as there’s been software. The problem this time, experts say, is that many organizations, for the moment, might not have the right tools to make fixes quickly and surgically.
Many of the most recent flaws have been identified—and subsequently fixed—by cutting-edge AI models that many organizations don’t have access to. Unfortunately, hackers might get those tools before many firms do. “Cyber warfare is shifting to a velocity that humans can’t keep up with,” says Kara Ruskin, a senior client partner in the Global Technology practice. Most security leaders don’t want to shut down entire systems when a flaw is found, but—at least right now—they might prefer taking this measure to having their company’s website hijacked or confidential data stolen. “I’m not sure the right behavior is moderation,” says Bryan Ackermann, Korn Ferry’s head of AI strategy and transformation.
Experts say these tough calls need to be debated within organizations. The ensuing decisions should follow procedures that, ideally, firms have had around cybersecurity for several years. The risks aren’t new, Williams says, even if the speed and method of the hacks are. Executives have to assess how critical the system with the security flaw is, and whether the organization can withstand having it shut down for what could be a significant chunk of time. “Leaders have to make sure that the medicine is not worse than the disease,” he says. If a firm does have to take a drastic action like a shutdown, it should let stakeholders know that the reason is a security emergency, not run-of-the-mill maintenance. The firm should consider creating a channel where stakeholders can get answers to their questions. “Having some means of communicating is important,” Williams says.
AI-assisted hacks in the headlines might have one silver lining: They could help chief security officers make their case to senior executives about resources and priorities. “A media storm around this could give you an opportunity to move things forward,” Williams says.
Learn more about Korn Ferry’s AI in the Workplace capabilities.
