Google's Beyond Zero: Enterprise Security for the AI Era
spawn-queue.acm.org
spawn-queue.acm.org
Doesn't this simply shift the attack vector? Compromising this overlord brain now becomes a new target.
For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked.
That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining.
Similarly, memory safe languages (including most GC languages, not just a certain language beginning with R) eliminate entire classes of security hole. Again, the possible attack vectors necessarily "shift", but that doesn't capture the fact that you've entirely eliminated a class of attacks.
The same goes for eliminating unnecessary services, firewall holes, etc.
None of these are specifically trying to "shift it to something to something that is more difficult to compromise." They're entirely blocking attack vectors, and the strength or weakness of other parts of the system aren't really a factor.
So you’re saying that the attack vector has… shifted.
In English, the word "the" in "the attack vector has shifted" is a definite article that refers to a single attack vector.
If your car breaks down and you switch to using a different car, would you say "the car has shifted"?
Speaking loosely, one might use "the attack vector has shifted" to mean something like "the possible attack vectors have changed", but that kind of looseness is misleading in an absolute claim like the one I originally responded to, about "all security measures". In fact, it would be more accurate to say that no security measures "shift the attack vector".
A vector here is the attack angle/direction. Of course I can shift my direction and then target another car.
"Shift" in this context means that the attacker has to use a different attack vector. They can no longer just access plain text.
Attribute-based access control is already a thing. User X logs in the US East between the hours of 6am and 6pm. If User X logs in from Russia at 3am, deny access. This seems like an evolution of that pattern
To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access.
Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".
zero trust helped a lot because it forced vendors to stop relying on people magically doing the right thing ina centralized system. it decentralized boundaries.
this paper just says you still need deterministic boundaries and access control, not just have an llm say safe or unsafe. cool thanks google haha.
ps: hi guys, i know yall reading. sometimes its not the concept, its the implementation. else active shield or whatever would have worked too. not everyone can be the T7-9 thinker if implementing is seen as "for peasants"
I wrote about this a few days ago https://firasd.substack.com/p/accidental-data-loss-in-claude...
"Many researchers have made demos along these lines:
An agent is asked to check a webpage like example.com
The webpage asks for a name to proceed further
The agent calls example.com/evil?myname=John, thus sending the user’s name from the context window to the external server.
In practice, however, these elaborate ‘confused deputy’ exfiltration attacks seem rare compared to widely-reported data loss incidents.
The risk of undermining the user’s interests through clumsiness deserves at least as much scrutiny as the risk of leaking secrets."
So while the idea of shifting the permission boundary from the app level to the action level makes sense, what we should also have is some 'failsafes', eg. if the action says 'delete' then maintain a rollback window, if the action is 'send an email' then maintain an events log. Preparing for AI agents means expanding auditability and reversibility in software
While I think that makes sense, I also think more controls are a good solution. That is, prevent access to the sales data without escalation, probably to a human, but possibly to another AI. The issue there is twofold:
- if you start with least privilege, the agents become less useful
- need to balance escalation with frequency otherwise it's just another version of MFA fatigue
Agree that auditability is important because otherwise you don't know what you don't know.
And if this security agent is wandering around the IT system gathering all of these details about access and identity and business process, who watches the watcher? How does that thing build and maintain trust?
Interesting to see similar architectural patterns emerging from different directions. I’d be curious where the authors see the biggest challenges in extending this model from human/service identities to autonomous agents.
Every system admin is going to send that signal. People pin pictures of the architecture to the walls sometimes.
https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL...
[1] I am the developer behind SmallDocs.
Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)
It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.
Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason.
If you are in a third world country, the web is extra hostile. This is going make things worse.
Plenty of US websites are blocking access from EU IP addresses because of our data protection laws.
Local news companies are the biggest offenders in this regard.
Isn't this for enterprises managing access to corporate resources?
I don't think once this is established in enterprises it is going to stop there.
Okay, but that's why there are always loud "breakglass" escalation options for access.
> that would hopefully be an auto-deny anyway until someone on-site whitelists their IP
About as far from "zero trust" as any solution could be.
I can't wait to fill out a form describing why I want to do something I have permission to do but the AutoBureaucrat5000 says no anyway.
This reads to me to be more for continuous behavioral monitoring once the access is gained via the deterministic controls. You wouldn't leave "Can person X access resource Y" up to the AI model, that's already decided based on the existing rules. Where the model comes in is "Is person X behaving in an expected way while using resource Y." Like, downloading a bunch of data when they've never done that before, might get flagged for either a session revocation, or a human review, or prompt for additional authentication, etc.
Even if the middle is deterministic, if one end is just going to be lazily hooked up to an AI, it's the shitty dystopian future.
What will really happen: You can’t really perform your work, so you are slower than others, so they fire you based on bad performance.
Horrible startup idea: Discrimination as a service, by means of IA without pretending it’s IA.
Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.
What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?
Will exceptions be made by humans? In which case we go back to human-managed permissions.
Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour
So yeah you're right in that it does add more probabilistic randomness just by virtue of changing the boundary of when the permission gate kicks in
In Entra where I work we already check things like "Is this person on a managed device? Is it compliant? Where are they? What MFA methods do they have registered/did they use?" on top of existing RBAC, etc. and its continuously evaluated. Entra watches for leaked passwords, assigns risk scores, etc. and you can make access decisions based on user risk or sign in risk, force password changes, require different MFA methods depending on the resource and the risk level, etc.
"Should this API call on this resource be allowed right now?" is mostly already determined by the above.
Where I see adding AI into the evaluation is to watch for unusual behavior that's not picked up by the deterministic signals. "Alice is trying to download gigs worth of data from the company file share, however she has never done that in the past, and there hasn't been any recent role/job changes" and so the LLM flags it or denies the request, or pushes it for a human approver, etc.
This is an example of a person who just spent billions of dollars on the new and booming hammer industry desperately trying to make nails of absolutely everything.
Doing routine work, haven't checked 2FA in a long while -> it's fine.
Odd behavior -> prompt for 2FA.
Security is non-negotiable in AI Era
AI is non-deterministic
Non-deterministic access controls is Terrible idea
And then agents come along and some people want their agent to be able to do anything they can do with zero friction. That usually lasts until the first time something goes wrong ;)
I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.
The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.
It's not a problem as much as a phase the world is going through. LLMs are a technological breakthrough in the same generality class as the Internet, or possibly electricity, and in both cases the world went through a phase of attempting to apply the newfound invention to literally everything. It's a necessary phase, when a technology obviously could be useful for everything, but it's not obvious whether it will in practice.
Sounds like adding the LLM in would be on top of the existing deterministic controls.
Existing controls handle the "Should you be able to access this resource right now?" the LLM handles "Is this user behaving as we expect them to while accessing this resource?"
Deterministic executes fast and you know what it will do. You want to evolve your ground truth, not hope for the best.
That said, there is a role for probabilistic elements in the security model...as bait and signal.
There is a massive difference between Google for enterprise customers and Google for consumers.
The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business.
The Enterprise offering guarantees you contractually that they never touch your data.
While I also find it annoying, the alternative of just rolling over and being desensitized to it is much, much worse.
If we're going to be wrong, I'd rather be wrong by being overly cautious than overly trusting.
What do you think their security model will be trained on? That's right, other people's data.
Now, Cloudflare, on the other hand, would be much more likely to offer a service like this.