Apple Shifts Security Update Strategy Amid AI-Driven Cyber Threats
Apple now releases security patches more frequently to tackle the growing threats posed by AI-enhanced cyberattacks.
Key points
- Apple released security updates for iPhones, iPads, and Macbooks on June 29, 2023.
- The updates were not tied to major operating system releases.
- Rocky Cole, CEO of iVerify, warns that AI-accelerated attacks mean faster patching won't fully close security gaps.
- Apple's traditional patching model is seen as outdated in the face of AI-driven vulnerabilities.
Apple has altered its approach to security updates, as reported by Dark Reading. Historically, the company bundled bug fixes into major operating system (OS) updates. But with the rise of threats powered by artificial intelligence (AI), Apple now releases patches more frequently, independent of OS updates.
On June 29, Apple issued security updates for its iPhones, iPads, Macbooks, and its Safari browser. This move isn't unprecedented—Apple has released updates outside of major version releases before. However, the motivation this time is different. According to Reuters, Apple stated that AI accelerates the creation of hacking tools, necessitating a shorter time from announcing updates to making them available to users.
Rocky Cole, CEO of security firm iVerify, acknowledges that while faster updates help, they aren't a complete solution. AI-accelerated discoveries make it likely that some vulnerabilities will still go unnoticed. Cole points out that the average time for hackers to exploit a vulnerability has decreased dramatically—from 63 days in 2018 to before patches are even released now.
How did AI change Apple's patch strategy?
AI enables hackers to find and exploit security flaws faster, prompting Apple to rethink its update schedule. The company aims to minimize the window of opportunity for hackers by releasing security patches more swiftly. However, this approach's effectiveness hinges on users promptly installing these updates—a challenge given Apple's history of coupling security and usability updates.
Many Apple users avoid updates due to controversial changes in user interface (UI), like recent design overhauls. This mindset can leave devices vulnerable, as seen in a recent case where an outdated iOS left a user exposed to malware. Faster updates are only effective if users install them.
For enterprises, the situation is more complex. Apple's iOS security model lacks the extended detection and response (EDR) frameworks common in other systems, leaving organizations to rely heavily on Apple's assurances. Cole suggests that a security framework allowing companies to manage their defenses, similar to other platforms, is necessary.
Apple's shift to more frequent updates is a step forward, but experts argue that the fundamental security model still falls short. As AI continues to drive new vulnerabilities, Apple's strategy may need further refinement to protect its vast user base effectively.
