Como você garante que seu algoritmo seja seguro e resistente a ataques?

Don't underestimate the dynamic nature of this choice. The suitability of an algorithm is not a static decision: it evolves as new vulnerabilities are discovered and as your data and application contexts change. Therefore, continuously monitor the algorithm's performance and security landscape. Also, I've always found it beneficial to engage with the wider AI and cybersecurity communities. Collaborations and knowledge sharing can provide early warnings about potential security threats and insights into emerging best practices.

Al seleccionar un algoritmo que se adapte a los requisitos del problema, es importante evitar el uso de algoritmos obsoletos que puedan tener vulnerabilidades conocidas. Además, se deben considerar las ventajas y desventajas en términos de velocidad, complejidad y seguridad. Un ejemplo de uso diario. Para almacenar contraseñas de usuarios o información sensible, es común utilizar hashes generados mediante algoritmos como AES o SHA-256.

An efficient algorithm which follows a BIBO system, implemented efficiently and updated time to time is secured and resistant.

The first thing to consider is if the servers running your algorithms or compute need to be connected to the internet? They can be airgapped, and data could be delivered to them using an internal network. You wouldn't need to secure the boxes that actually run the compute.

In my experience, implementing robust anomaly detection systems is a needed step because these systems not only flag data points that are statistical outliers, but also identify patterns indicative of adversarial attacks or data corruption. My suggestion is to use machine learning models themselves to predict and validate the expected range of outputs based on historical data. This approach can significantly enhance the detection of subtle, yet potentially harmful, anomalies that traditional validation methods might overlook.

Es importante validar tanto la entrada como la salida de nuestro algoritmo para evitar que, usando caracteres especiales, puedan llegar a hacer uso de él, de una manera no contemplada, como una reverse Shell o la conocida inyección SQL ' or 1=1/*

Input sanitization and validation is very important. This is very tricky, do you discard data that could potentially have a lot of information because it looks suspicious? In that case could you morph it or snip it such that you can still feed it into the system? However, as mentioned, you should check for the obvious things such as input types, malicious signatures such as the possibility of scripts being embedded in data, harmful characters, SQL injection etc and this can be accomplished by using a vulnerability checker against known databases of insecure inputs.

Es importante seguir buenas prácticas al programar el algoritmo, permitiendo el acceso únicamente a aquellos autorizados. Además, evitar el uso de valores de seguridad por defecto y tener en cuenta que si algo puede salir mal, saldrá mal. Piensa en todos los posibles escenarios y cómo alguien podría llegar a comprometer tu sistema.

The best way is to not leave anything to chance, and use code analyzers such as sonar qube to make sure that the code is safe!

Es importante realizar pruebas unitarias, de integración, regresión o estrés para cubrir diferentes aspectos y escenarios. Esto permite garantizar que todo funcione según lo previsto y que no tenga fallas o errores que puedan afectar su seguridad.

Documentation is a great way to explain our code to a newbie or a person how to understand what's going on with the codebase without looking into the actual code, in some cases code might be written in a different programming language. A good documentation may or may not be lengthy, can be precise that it should cover all the edge cases along with a graphical representation. It will definitely help in the future on one day.

Documenting your algorithm is not just about clarity and comprehensibility, it's a critical component of your algorithm's security strategy. Documentation should be treated as a living entity, evolving alongside your algorithm. Don't forget to incorporate a versioning system for your documentation, mirroring changes in the algorithm. This practice ensures that any modifications, especially those related to security updates, are accurately and promptly reflected.

Maintenance isn't just about fixing what's broken: it's about continuously enhancing and fortifying your algorithm against the threats of tomorrow. Updating and maintaining your algorithm is a strategic process that demands foresight and responsiveness. You need to incorporate an anticipatory maintenance strategy: ie. not just reacting to known issues but proactively seeking potential future vulnerabilities and performance bottlenecks. Employ predictive analytics to identify patterns that could signal impending problems. And keep abreast of the latest advancements in AI and cybersecurity. Technologies and threats evolve rapidly: staying informed helps you anticipate the need for updates before vulnerabilities are exploited.

During the entire SLDC, Application security will be a continuous process. Depending on the application seviority SCA, SAST and DAST (can include IAST, RASP) scans should be performed monthly or quarterly to check for any vulnerabilities that exists in the codebase. Depending on the Report, Critical/High > Medium > Low should be remediated/patched based on the priority. And Finally check for any new algorithms that can be implemented with the existing flow so that Time and Space complexity will be optimal.

Ensure that the algorithm itself cannot be guessed or reverse engineered using clever input manipulation and reading the output, like a black box guessing game. This has happened to many image machine learning models where purposefully manipulated images were fed into the system to effectively disable it, and the way to manipulate the system could then be applied to all inputs basically to render the system useless. Example, wearing sunglasses in front of a facial recognition system

Educating users on best practices for using the algorithm securely, such as choosing strong passwords and being cautious of phishing attempts.