The unprecedented breach of a technology vendor by autonomous artificial intelligence agents is serving to underscore governmentwide efforts to streamline federal cloud security and prioritize faster patching of critical software vulnerabilities.<\/p>\n
OpenAI confirmed this week that its advanced AI training models broke out of their test environment and then hacked into the networks of start-up vendor Hugging Face. The incident is the latest AI cybersecurity development driving policy conversations across Washington.<\/p>\n
Pete Waterman, director of the Federal Risk and Authorization Management Program (FedRAMP) at the General Services Administration, pointed to the Hugging Face incident as a landmark moment for cybersecurity during Carahsoft\u2019s FedRAMP Summit on Thursday.<\/p>\n
Waterman said the incident underscores his program\u2019s shift to the FedRAMP 20x model.<\/p>\n
]]><\/p>\n
\u201cSo when we talk about FedRAMP 20x and we talk about changes to things like vulnerability management, vulnerability detection and response, you need to understand that everything is going to be different,\u201d Waterman said. \u201cThis is not a FedRAMP thing. This is not a compliance thing. If you\u2019re thinking about FedRAMP as compliance, you\u2019re done. You\u2019re cooked. Get out of here. Your business can only survive if you are able to integrate your security, your engineering, and your product teams in order to make changes and deflect these attacks at the pace of AI.\u201d<\/p>\n
The FedRAMP 20x initiative is aimed at using automation, machine-readable data, and key security indicators to cut authorization times from years to weeks. Waterman\u2019s team began piloting the approach last year.<\/a><\/p>\n The program plans to stop accepting FedRAMP \u201cRev Five\u201d authorization packages by next June and fully transition to the 20X model.<\/p>\n Waterman said government needs industry to focus in areas like vulnerability detection and response, automation, integrating security into engineering, and other security practices that are needed in the wake of AI incidents like Hugging Face.<\/p>\n \u201cYou should not be doing that for compliance,\u201d Waterman said. \u201cThe compliance part of FedRAMP is how you assure us that you\u2019re doing that. But if your business isn\u2019t motivated to do that on its own and invest the right amount of money and put you in part of the organization where compliance is not a division off on the side that everyone hates, where it takes you three weeks to get a meeting with the engineering team. That will not succeed.\u201d<\/p>\n \u2018New era of vulnerability management\u2019<\/p>\n Federal agencies are also moving to adopt faster, more prioritized software patching cycles under a June executive order on AI security and a corresponding binding operational directive from the Cybersecurity and Infrastructure Security Agency.<\/p>\n