The Digital Insider | Category: Digital Security

AI data security: 8 essential steps for CISOs in the age of generative AI – CyberTalk

EXECUTIVE SUMMARY:

Artificial intelligence and large language models are transforming how organizations operate. They’re also generating vast quantities of data – including synthetic text, code, conversational data and even multi-media content. This introduces increased potential for organizations to encounter hacking, data breaches and data theft.

This article outlines eight essential steps that cyber security stakeholders can take to strengthen AI data security in an age where AI usage is rapidly accelerating and the societal consensus on AI regulation remains elusive.

AI data security: 8 essential steps

1. Risk assessment. The foundation of any effective security strategy is, of course, a thorough risk assessment. CISOs should conduct a comprehensive evaluation of their organization’s AI systems, identifying potential vulnerabilities, threats, and their potential impact.

This assessment should encompass the entire AI lifecycle, from data acquisition and model development to deployment and monitoring. By understanding the specific risks associated with AI initiatives, cyber security teams can prioritize and implement targeted security and mitigation strategies.

2. Robust governance framework. Effective AI data security requires a strong governance structure. CISOs need to develop a comprehensive framework that outlines data ownership, access controls, usage policies, and retention guidelines. This framework should align with relevant regulations, while incorporating principles of data minimization and privacy-by-design. Clear governance not only minimizes the risk of data breaches, but also ensures compliance with legal and ethical codes.

3. Secure development and deployment practices. As AI systems and security features are developed, cyber security teams need to ensure secure coding practices, vulnerability testing and threat modeling (where possible). In addition, security controls need to be put in-place, as to protect AI models and infrastructure from unauthorized access or data loss. Prioritizing cyber security from the outset will enable organizations to reduce the probability that vulnerabilities will be introduced into production systems.

4. Protect training data. Cyber security professionals need to implement stringent security measures to protect the integrity and confidentiality of training data. This includes data anonymization, encryption and access controls, regular integrity checks to detect unauthorized modifications, and monitoring of data for adversarial inputs.

5. Enhanced network security. AI systems often require significant computational resources across distributed environments. CISOs must ensure that the network infrastructure supporting AI operations is highly secure. Key measures include implementing network segmentation to isolate AI systems, utilizing next-generation firewalls and intrusion detection/prevention systems, and ensuring regular patching and updates of all systems in the AI infrastructure.

6. Advanced authentication and access controls. Given the sensitive nature of AI systems and data, robust authentication and access control mechanisms are essential. Cyber security teams should implement multi-factor authentication, role-based access controls, just-in-time provisioning for sensitive AI operations, and privileged access management for AI administrators and developers. These measures help ensure that only authorized personnel can access AI systems and data, reducing the risk of insider threats and unauthorized data exposure.

7. AI-specific incident response and recovery plans. While prevention is crucial, organizations must also prepare for potential AI-related security incidents. Cyber security professionals should develop and regularly test incident response and recovery plans tailored to AI systems. These plans should address forensic analysis of compromised AI models or data, communication protocols for stakeholders and regulatory bodies, and business continuity measures for AI-dependent operations.

8. Continuous monitoring and adaptation. AI data security is an ongoing commitment that requires constant vigilance. Implementing robust monitoring systems and processes is essential to ensure the continued security and integrity of AI operations. This includes real-time monitoring of AI system behavior and performance, anomaly detection to identify potential security threats or breaches, continuous evaluation of AI model performance and potential drift, and monitoring of emerging threats in the AI landscape.

Further thoughts

As AI and large language models continue to advance, the security challenges they present will only grow more complex. The journey towards effective AI data security requires a holistic approach that encompasses technology, processes, and people. Stay ahead of the curve by implementing the aforementioned means of ensuring robust AI data security.

Prepare for what’s next with the power of artificial intelligence and machine learning. Get detailed information about Check Point Infinity here.

Get more CyberTalk insights about AI here. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

EU says Elon Musk’s X allowed disinformation to run wild – CyberTalk

EXECUTIVE SUMMARY:

The tech media mogul’s platform is the first to see charges under a new EU social media law.

The European Union is taking Elon Musk to task over his transformation of the Twitter social media site (now X) into a haven for disinformation and dubious content.

On Friday, the EU Commission formally charged X with failing to respect the Digital Services Act (DSA), a law that’s intended to restrict toxic content and predatory algorithms.

The platform has broken rules regarding “dark patterns” — deceptive tactics that push people towards certain products and services.

Investigative details

The European Commission’s investigation into X started in December of 2023, as prompted by the platform’s failure to prevent disinformation and content manipulation.

X has been accused of allowing disinformation and hate speech to “run wild,” and in the eyes of the EU Commission, has rolled out misleading authentication features, which block external researchers from accessing the tools required to scrutinize the spread of malicious content on the platform.

In August of 2023, the European Union called X the “largest spreader of Russian lies and propaganda” out of all existing social media sites.

EU Commission’s findings

The EU Commission has shared three preliminary findings in relation to X’s DSA non-compliance:

1. The Commission found that X’s so-called blue checks had mislead users into thinking that certain accounts and content were trustworthy and verified, when in-fact they were not.

Because anyone can purchase a blue check for between eight and eleven dollars, cyber criminals abused the system in order to spread malicious material.

2. For those who are less familiar with EU regulations, this is a bit more obscure…The Commission also found that X failed to comply with transparency rules around advertising. X allegedly put up barriers that prevented adequate advertising supervision and research, which help to ensure that platforms are safe for the general public.

3. Along similar lines, the DSA mandates that organizations provide public data access for research purposes. However, X prohibited researchers from engaging in corresponding data collection and analysis activities. Initiatives appeared thwarted, or researchers were forced to pay disproportionately high sums for data access.

Social media safety crackdown

In light of the European Commission’s findings, X could face a multi-million Euro fine — up to 6% of the company’s global turnover.

In regards to social media safety more broadly, the DSA has also launched investigations into AliExpress, Meta’s Facebook and Instagram, and TikTok.

“The DSA has transparency at its very core, and we are determined to ensure that all platforms, including X, comply with EU legislation,” said the European Union’s antitrust chief, Margrethe Vestager.

Unexpected plot twist

In a post on X, Elon Musk stated that his company was presented with an “illegal secret deal” by the European Commission. The deal would have enabled X to avoid a fine if the company censored speech on the platform.

“The other platforms accepted that deal,” Musk wrote, without offering any evidence. He continued by explaining that X rejected the bargain.

For more on this story, click here. For further insights into disinformation, click here. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Infostealers: What are they & far-reaching effects on data security – CyberTalk

By Hendrik De Bruin, Security Engineer, Check Point Software Technologies.

Infostealers…ransomware’s lesser-known cousin

When it comes to malware, ransomware usually steals the limelight, largely because of the direct, devastating impact that ransomware often causes. However, ransomware’s lesser-known cousin, the “infostealer,” is slowly but surely gaining ever-more attention.

Over the last few years, we have noticed a massive increase in the usage of infostealers. In fact, some research suggests as much as 5,900% growth since 2018. Statistics also indicate that during 2023, over 10 million devices were compromised by info stealing malware, reflecting an increase of 643% over the past three years.

An infostealer is a type of malware designed to infiltrate computer systems, not for purposes of data encryption like ransomware or data deletion like “wipers”, but specifically designed to steal sensitive information.

These malicious programs exfiltrate various data, including login credentials, session cookies, financial information, and personally identifiable information (PII). After harvesting and capturing the sensitive information, the infostealer sends it back to remote servers controlled by cyber criminals.

Once cyber criminals obtain the sensitive information, it is sold on the dark web to various nefarious actors, such as “Initial Access Brokers” who use the info to facilitate larger attacks, like ransomware attacks.

Infostealers…And their real-life impact

To showcase the impact that infostealers can have and to reinforce that infostealers deserve more attention, we can look at two recent incidents: a breach reported at Ticketmaster and at a major European bank.

In both cases, malicious actors gained access to information stored at a third-party service provider called Snowflake. Snowflake offers a cloud-based data storage and analytics service, often referred to as “data-as-a-service”.

During these breaches, attackers simply used credentials — which were most likely obtained through infostealers — to access associated Snowflake accounts, leading to the sale of information belonging to more than 550 million Ticketmaster customers on the dark web.

The info was sold by a group known as “ShinyHunters”, a known player in the infostealer business that’s notorious for using legitimate credentials to obtain initial access.

The ShinyHunters group also claims to have information related to 30 million customers and 28 million credit card numbers associated with the breached banking institution.

Although we focus on these two instances here, they reflect two of at least 165 Snowflake customer accounts that were accessed by this specific threat actor using credentials harvested through infostealers.

How can organisations protect themselves?

Although there may have been various security oversights involved with the two aforementioned breaches, I believe the following three factors played the biggest role:

Another factor that often plays a role when it comes to SaaS security is the popular misconception that the Cloud Service Provider is responsible for your data in the cloud. In reality, YOU as the customer remain responsible and accountable for the security of and access control to data in the cloud.

1. Lack of end user email and browser protection – Among cyber criminals, the most popular means of malware delivery are through email and internet downloads. Not having adequate email and browser security allowed for the initial delivery of the malware.

2. Lack of endpoint protection – Endpoint devices were not properly secured against malware such as infostealers, allowing the malware to be deployed on devices.

3. Lack of SaaS security – The absence of additional security controls, such as Multi-Factor Authentication, allowed for easy access using stolen credentials.

Let’s unpack the items listed above to get a better understanding of how each played a role in the mentioned breaches.

Email and browser protection

Infostealers are typically delivered through internet downloads, phishing emails and or other social engineering attacks.

Your first line of defense for the delivery of infostealers lies in the deployment of email security and anti-phishing solutions such as Harmony Email and Collaboration, which will prevent the delivery of phishing emails and emails containing malware.

Further, should a malicious email be delivered containing a malicious link, having adequate browser protection should prevent the browser from accessing the link and malware from being downloaded.

Internet access control and browser security solutions, such as Harmony SASE Internet Access, will prevent the download of malicious files and restrict corporate password re-use on non-corporate websites.

Corporate password re-use and other password best practices

Although passwords should NEVER be used as the only means of authentication, we often still find this to be the case for various organisations and applications. NIST and other similar institutions provide various guidelines and best practices related to passwords. However, it is also important to note that other than corporate password re-use restrictions, none of these password recommendations from NIST or other similar institutions would have really offered protection from infostealers; mainly because infostealers exfiltrate cleartext passwords.

If you still rely on passwords, the following guidelines from NIST may assist you:

Increase password length – Password length matters more than complexity.
Avoid corporate password re-use – Ensuring that corporate passwords aren’t re-used for other platforms, such as social media, will keep your corporate credentials and systems protected from external credential breaches.
Breached password protection – Ensure that attempted password updates do not contain known breached passwords
Password rotation – Contrary to popular beliefs, the NIST advises against rotating passwords too often and regards 30 to 60 days as too often. Ninety days may be a fair compromise.

Endpoint protection and response

From an endpoint perspective, Endpoint Detection and Response (EDR) remains as one of the primary defenses against malware such as infostealers. EDR solutions typically include both signature-based detection mechanisms as well as behaviour based detection mechanisms, which include analyses of data to detect suspicious activity, such as indicators of compromise (IOCs).

A solution like Check Point’s Harmony Endpoint leverages Check Point’s ThreatCloud; a dynamically updated service based on an innovative global network of threat sensors and organisations that share threat data. It collaboratively fights against modern malware by aggregating and analysing big data telemetry and millions of Indicators of Compromise (IoCs).

Over 50 AI-based engines analyze this data. These engines detect and neutralize novel threats, ensuring that both known and unknown threats are addressed and prevented.

Multi-factor authentication

Most Software as a Service (SaaS) offerings have multi-factor authentication available as a configurable option. If your organisation is making use of SaaS offerings, it is critical that multi-factor authentication is configured. Password authentication alone is NOT adequate and should never be used, especially not on publicly exposed SaaS applications.

Although multi-factor authentication may not have completely eliminated the chances of these breaches occurring, it would have at the very least forced far greater costs and efforts onto the attackers. These efforts would also have to involve additional threat vectors, thereby increasing the probability of detection.

The adoption of cloud services, in combination with the “hybrid workforce” has significantly increased organisations’ attack surfaces, leading to greater exposure, risk and complexities. To overcome this, organisations are looking at adopting solutions such as Zero-Trust and SASE.

Zero-Trust

Zero-Trust, at its core, revolves around the idea of NO ACCESS or ZERO ACCESS, unless we can explicitly identify the device, the individual using the device and the security posture associated with both the device and the user. Zero Trust also enforces further concepts such as “least privilege.”

Zero-Trust Network Access (ZTNA) is still often perceived as being a very costly, time consuming and difficult exercise. However, modern solutions, such as Secure Access Service Edge (SASE), really simplify the implementation of Zero Trust.

In this specific instance, SASE with Secure Internet Browsing would have prevented the download of malware or infostealers from the internet.

The deployment of SASE would also allow organisations to further secure their SaaS applications by enforcing IP address based access restrictions on the SaaS application itself.

This will ensure access to the SaaS application ONLY if the device adheres to corporate security posture restrictions and your identity have the appropriate permissions.

In Conclusion

The threat posed by infostealers deserves the same attention as that posed by ransomware, and perhaps even more so, as infostealers often serve as enablers for much larger cyber attacks and breaches.

In the past, we have observed credentials obtained from infostealers being used for initial access during other malicious activities. These stolen credentials open a broader exploitation landscape, which could include personal accounts, corporate accounts, and even infrastructure access through VPNs and cloud management interfaces.

Protection from the risks posed by infostealers require a holistic approach, bringing us back to “good ole” “defense-in-depth”.

First, prevent the initial delivery of infostealers by protecting end users from malicious emails, websites and malware via email and internet access security controls.

Secondly, should email and internet access security controls fail, having an endpoint detection and response solution deployed should prevent the infostealer from being installed on devices and/or prevent credentials from being exfiltrated.

Other controls, such as Zero-Trust frameworks and SASE, further support the concept of defense in depth by preventing access; even with adequate credentials should other factors such as geo-location, device posture and so forth not check out.

Professional services, such as penetration testing, external attack surface assessments and continuous threat exposure management can also assist in reducing the risk posed by infostealers, as they can highlight weak security controls, such as password-only authentication.

For more insights from Hendrik de Bruin, please see CyberTalk.org’s past coverage. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

5 CISO trends to keep up with during July of 2024 – CyberTalk

EXECUTIVE SUMMARY:

What is the word ‘agile’ spelled backwards? CISO. (Just kidding, but it should be)

As we enter July of 2024, contending with the current cyber security landscape demands unprecedented levels of vigilance and strategic agility. This month brings a convergence of developments and challenges with far-reaching implications.

From a high-impact vulnerability in ubiquitous software, to the insidious spread of shadow IT, this article highlights five current cyber security trends that professionals should be attuned to, as to then recalibrate risk management approaches accordingly.

Protect your organization from the latest threats while driving innovation and implementing proactive cyber security mitigation measures.

5 CISO trends, July 2024

1. A critical Outlook vulnerability. Cyber security researchers have discovered a zero-click remote code execution vulnerability that, if exploited, could result in unauthorized access and data breaches.

Now patched by Microsoft, the vulnerability was perceived as “critical” by some researchers, and Microsoft rated it as “important.”

Immediate exploitation of the vulnerability isn’t terribly likely, but it remains a possibility, especially if this vulnerability is combined with another one.

Make sure that you organization updates all Microsoft Outlook and Office applications with the latest patches.

2. Google passkey support for executives. As part of its Advanced Protection Program (APP), Google is adding passkey support, which will better protect higher profile individuals from cyber threats.

Advanced Protection Program users typically have public-facing positions (CEOs, COOs, CTOs) or engage in controversial work (lawyers, journalists, human rights advocates).

“Security keys are super-duper strong. They are an un-phishable factor,” said Google’s APP project manager, Shuvo Chatterjee.

Organizations may wish to ensure that higher profile stakeholders leverage passkey support.

3. The rise of ‘Shadow SaaS’. In a survey of over 250 global cyber security professionals, nearly 75% admitted to the use of SaaS applications that the IT team had not specifically approved of.

Security professionals took this risk despite knowing the risk – 65% knew of the possibility of data loss, 62% noted lack of visibility and control, and 52% identified data breaches as an inherent risk accompanying the use of unauthorized tools.

Ten percent of cyber security professionals expressed certainty around having experienced an organizational data breach (or data loss) due to the use of shadow SaaS.

There is a clear gap between use of unauthorized tools and risk mitigation capabilities. Ensure that your organization closes this gap.

4. The impossibility of emails. After the emergence of ChatGPT, on a regular basis, phishing emails started to look nearly identical to typical email correspondences. The traditional red flags started to disappear. At this point, that’s old news.

What’s new is that as organizations have continued to send out emails, as organizations are wont to do, recipients have started to question the validity of the emails, as they arguably look like potential phishing emails.

At the end of the day, the issue here is that organizations need email security that both keeps phishing emails out and that users trust to keep their inboxes safe.

5. Fake network traffic. Last year, 18% of all network traffic was either automated or “invalid.” In other words, fraudsters used bots to commit fraud and compromise the security and integrity of websites, among other things.

Artificial intelligence has contributed to the proliferation and persistence of fake network traffic. In effect, AI has enabled bots to closely mimic human behavior, rendering traditional detection methods less effective.

In some cases, these bots aren’t actually harmful, but their presence means that CISOs and security teams have to deal with them – presenting a distraction from more significant cyber security tasks. The sooner that security leaders proactively address this issue, the sooner that everyone can get back to the more important stuff.

Further information

As your organization works to elevate its cyber security posture, turn towards cyber security tools that are AI-powered and cloud-delivered, enabling you to stay ahead of the latest threats.

For more insights like these, click here. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Transforming network security | Three ways AI can boost infrastructure operations – CyberTalk

By Ulrica de Fort-Menares, Vice President of Product Management for Infrastructure Assurance at BlueCat Networks

Artificial intelligence (AI) has the power to reshape how you operate your network security infrastructure.

Firewalls have been a first line of defense in network security for many years and must always be operational. Maintaining five nines, or service availability 99.999% of the time, requires skilled network security practitioners. However, many enterprises have a limited number of security experts and struggle to find enough skilled expertise to manage their increasingly complex network infrastructure.

An AI-powered, knowledge-based expert system can expand team skills so that they’re available around the clock and can help your enterprise more easily manage highly complex network security infrastructure.

In this article, we’ll explore three ways that AI can boost your network security operations and augment limited resources. Specifically, we’ll look at how you can:

Use a knowledge-based expert system to find hidden issues in your security infrastructure before they become bigger problems
Combine that system with automation to automatically troubleshoot complex problems, much like a human would
Utilize machine learning models to detect anomalies in an enterprise environment

Find hidden issues with a knowledge-based expert system

A knowledge-based system is a form of AI that encodes the collected knowledge of human experts to detect and solve difficult problems. Knowledge-based systems generally consist of a data repository or knowledge base, an inference or rules engine to locate and process data, and a user interface. Knowledge-based systems can assist with expert decision-making, easily process large quantities of data, and reveal insights or create new knowledge from existing information.

When applied to network security, a knowledge-based system contains in-depth knowledge, culled from human experts’ technical practices and experiences, of how security infrastructure should work and behave. Like a firewall engineer, it can analyze data, detect issues, and prioritize alerts, just with much greater speed and at a much larger scale than what a human is capable of. A system based on the knowledge of human experts can assist with identifying problems and can help network security teams troubleshoot technical issues. It can augment team skills, allowing teams to do more with less.

Let’s look at a specific example of a network security application:

A knowledge-based system can know how important a Border Gateway Protocol (BGP) peer is to route traffic to the internet and that detecting BGP issues is more than just monitoring the peer state. It can also ensure that the routing process learns routes from its BGP peer and passes the information to the secure gateway’s routing table. Further, it can alert you the moment it detects a hidden route condition.

Another benefit of a knowledge-based system is its sophisticated rule engine, which can detect complex problems. Building on the same BGP example, the system has knowledge about a clustered environment. If the passive member of the cluster does not have any active routes, it is OK. But if the active member of the cluster has zero active routes, it is not OK. The system operates on more than just a simple if-then-else construct.

Auto-triage with a knowledge-based expert system

Perhaps one of the most important uses of AI is to help us automate tasks. By coupling a knowledge-based expert system with an automation engine, we can perform automated troubleshooting. The system applies a broad base of domain-specific expertise and makes intelligent decisions about the situation. Much like a human would, it walks down a decision tree to diagnose a complex problem.

Let’s explore this further using the example of a BGP peer going down. The system runs investigative steps. It follows a troubleshooting workflow with branches gathered from industry experts and fed into the system. Applying domain knowledge is key to determining what relevant information to analyze.

In this example, multiple conditions and scenarios are considered, as the troubleshooting steps have different branches based on the configuration. The steps to troubleshoot a Layer 2 BGP connectivity issue are very different from one in Layer 3. As you can see from this workflow, troubleshooting a down BGP peer isn’t exactly a straightforward task.

Using a knowledge-based expert system to automatically diagnose a problem augments IT teams and improves mean time to resolution.

Detect anomalies with machine learning models

Any nuances in the operational conditions of security infrastructure can signal unacceptable levels of business risk. Therefore, anomaly detection is an important tool for identifying rare events or outliers that may be significant.

For example, if a firewall is receiving a sudden increase in “non-syn-tcp” first packets, it may be indicative of an asymmetric routing issue in the network environment. The ability to detect these rare conditions or outliers can avoid bigger problems.

While machine learning is one of many kinds of AI, it is typically most used for detecting anomalies. One of the simplest and oldest ways to detect anomalies is to use statistical methods, such as standard deviation or z-score. However, these methods have some limitations, such as being sensitive to outliers, assuming a fixed distribution, and not capturing complex patterns in the data.

In this chart, we are looking at the number of concurrent connections over four months. A human can easily identify the three outliers, but a machine needs to be trained. The outliers are:

A dramatic increase in the number of connection counts in late October
A similar increase in the middle of November
Then, a dramatic decrease of connection counts over the Christmas holidays

Deep learning for anomaly detection can apply to security infrastructure in novel ways. For example, we can examine data relating connection counts with CPU usage to find common patterns. With deep learning methods, we can provide even higher fidelity alerts around anomalies.

The autoregressive integrated moving average model is known for forecasting stock market returns. But we can leverage this algorithm and machine learning to make predictions about your security infrastructure based on historical data. For example, the system can determine at what point your device needs upgrading to support your number of concurrent connections. This can greatly simplify capacity planning.

Summary

Without automation, security teams would spend countless hours gathering diagnostics and data just to keep firewalls and other security infrastructure up and running. Still, a typical security engineer can spend a notable portion of their time identifying and remediating known errors. Security teams often have limited resources, resulting in an even greater need for automated diagnostics and issue detection.

With an AI-powered solution, you can leverage machine learning models and a knowledge-based expert system to detect potential issues before they become bigger problems and troubleshoot these anomalies in your environment like a human would. And it can serve up recommended remediations that security engineers would otherwise have to find and implement manually.

While its capabilities are relatively nascent, even today’s AI has the power to transform the way you operate your network security infrastructure.

AI-powered phishing threats are nearly impossible to detect (2024)

EXECUTIVE SUMMARY:

Until recently, the signs of a phishing scam were relatively obvious – typos, “dear”, clumsy grammar, a cloying sense of urgency.

Not only did people know what to watch for, but they also felt confident in their abilities to detect a phishing email and to avoid a malicious link or attachment.

But new research shows that young people are extremely concerned about accidentally exposing their organization to a cyber attack – largely due to the fact that the phishing threat landscape has shifted.

The new phishing

Eighty-five percent of employees, many of whom skew younger, believe that AI has rendered cyber security attacks more sophisticated than ever before. Seventy-eight percent of that cohort is concerned about the use of AI in cyber attacks and its potential to help create imperceptible threats.

Employees were once considered the first line of cyber defense – It was all about teaching employees to recognize phishing emails, to avoid clicking on suspicious links…etc. While phishing awareness is undoubtedly still relevant, organizations may need to reconsider the extent to which they rely on employees to recognize and independently stop threats.

If threats are fooling executives, how can we, in good faith, create the expectation that employees should know more than high-level stakeholders and maintain an exceptionally high-level of responsibility for protecting the organization?

New threat examples

Gen Z is losing confidence in its ability to recognize phishing attacks and for good reason. The attacks are becoming absurdly sophisticated.

Below are three examples of phishing emails that your employees could encounter tomorrow, and likely wouldn’t know to flag. You can also use the email examples below within your own phishing tests or as examples within your educational programming:

1. This email asks employees to review a [fake] policy.

Dear [Employee Name],

As part of our ongoing commitment to information security, we have recently updated our company policies regarding data handling and access. To ensure that all employees are aware of these changes, [your company name] requires a one-time review and acknowledgement.

Your access to company resources will be temporarily restricted until you have completed this brief review. The process takes approximately 5 minutes and can be accessed through the secure link provided below.

[Link to fake page with company logo and colors]

Please note: This link is unique to your account and will expire in 48 hours. We appreciate your cooperation in maintaining a secure work environment.

Sincerely,

The Information Security Team

2. This email realistically [and falsely] alerts employees to a data breach.

Dear [Employee Name],

We are writing to inform you of a recent data breach that may have affected a limited amount of employee information. We are still investigating the scope of the incident, but out of an abundance of caution, we recommend that you take immediate action to secure your accounts.

For your convenience, we have included a link to a secure portal where you can review the potentially compromised data and update your login credentials for all company-related accounts.

[Link to fake data breach information page]

We understand this news may be concerning, and we are committed to keeping you informed as we learn more.

Sincerely,

The Security Response Team

3. This email provides believable [and false] information about an HR-run program.

Hi [Employee Name],

It’s time to celebrate our amazing team! We’re holding our annual internal employee recognition program and need your vote to choose the winners in various categories.

To ensure a fair and secure voting process, we’ve implemented a new single sign-on system. Simply click the link below and use your Windows login credentials to cast your vote.

[Link to fake page with company logo and colors]

Voting closes on [date]. Let’s show our appreciation to those who go the extra mile!

Best regards,

The HR Department

Current phishing falsehoods

The point is that today’s phishing attempts look much different from what we’re used to seeing, and yet we’re still holding employees to the same expectations around serving as the first line of defense and stopping attacks.

Yes, employees bear some responsibility. Yes, they should receive educational training around the basics, from links to attachments, but we also need to be sure that we’ve fully internalized the fact that the landscape has changed.

It’s not that Gen Z isn’t knowledgeable about cyber security – younger workers are digital natives and 86% see themselves as cyber aware.

Actionable steps for cyber security professionals

In addition to robust phishing education and training exercises:

Implement advanced email security protection. Prevent phishing threats that are AI powered and exceptionally evasive. Leverage advanced tools, like Check Point’s email security solutions, which are 93X more effective than other tools on the market.
Deploy comprehensive endpoint protection. Endpoint protection can help ensure that employees are not duped into providing sensitive information.
Adopt a zero trust security framework. This can minimize the potential damage, should a phishing attack succeed.
Leverage AI-powered, cloud-delivered cyber security solutions. These solutions scale well and can be updated quickly to address new threats.
Learn more here.

Discover additional must-read AI trends and expert insights in this article. Lastly, to receive cyber security thought leadership content, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Protecting your brand in the age of AI – CyberTalk

Mark Dargin is an experienced security and network architect/leader. He is a Senior Strategic Security Advisor, advising Fortune 500 organizations for Optiv, the largest pure-play security risk advisory organization in North America. He is also an Information Security & Assurance instructor at Schoolcraft College in Michigan. Mark holds an MS degree in Business Information Technology from Walsh College and has had dozens of articles published in the computing press. He holds various active certifications, including the CRISC, CISSP, CCSP, PMP, GIAC GMON, GIAC, GNFA, Certified Blockchain Expert, and many other vendor related certifications.

In this timely and relevant interview, Senior Strategic Security Advisor for Optiv, Mark Dargin, shares insights into why organizations must elevate brand protection strategies, how to leverage AI for brand protection and how to protect a brand from AI-based threats. It’s all here!

1. For our audience members who are unfamiliar, perhaps share a bit about why this topic is of increasing relevance, please?

The internet is now the primary platform used for commerce. This makes it much easier for brand impersonators, and counterfeiters to achieve their goals. As a result, security and brand protection are essential. According to the U.S. Chamber of Commerce, counterfeiting of products costs the global economy over 500 billion each year.

Use of emerging technologies, such as artificial intelligence (AI) and deepfake videos — which are used to create brand impersonations — has increased significantly. This AI software can imitate exact designs and brand styles. Deepfake videos are also occasionally used to imitate a brand’s spokesperson and can lead to fraudulent endorsements.

Large language models (LLMs), such as ChatGPT, can also be used to automate phishing attacks that spoof well-known brands. I expect for phishing attacks that spoof brand names to increase significantly in sophistication and quantity over the next several years. It is essential to stay ahead of technological advancements for brand protection purposes.

2. How can artificial intelligence elevate brand protection/product security? What specific challenges does AI address that other technologies struggle with?

Performing manual investigations for brand protection can require a lot of time and resources to manage effectively. It can significantly increase the cost for an organization.

AI is revolutionizing brand protection by analyzing vast quantities of data, and identifying threats like online scams and counterfeit products. This allows brands to shift from reacting to threats to proactively safeguarding their reputation.

AI can increase the speed of identifying brand spoofing attacks and counterfeiting. Also, it can dramatically shorten the time from detection to enforcement by intelligently automating the review process and automatically offering a law enforcement recommendation.

For example, if a business can identify an online counterfeiter one month after the counterfeiter started selling counterfeit goods vs. six months later, then that can have a significant, positive impact on an organization’s revenue.

3. In your experience, what are the most common misconceptions or concerns that clients express regarding the integration of AI into brand protection strategies? How do you address these concerns?

If used correctly, AI can be very beneficial for organizations in running brand protection programs. AI technologies can help to track IP assets and identify infringers or copyright issues. It is important to note that AI is an excellent complement to, but cannot fully replace, human advisors.

There are concerns amongst security and brand protection leaders that AI will cause their investigative teams to rely solely on AI solutions vs. using human intuition. While tools are important, humans must also spend an adequate amount of time outside of the tools to identify bad actors, because AI tools are not going to catch everything. Also, staff must take the time to ensure that the information sent to the tool is correct and within the scope of what is required. The same goes for the configuration of settings. At a minimum, a quarterly review should be completed for any tools or solutions that are deployed.

Leaders must ensure that employees do not solely rely on AI-based tools and continue to use human intuition when analyzing data or identifying suspicious patterns or behaviors. Consistent reminders and training of employees can help aid in this ongoing process.

Training in identifying and reporting malicious use of the brand name and counterfeiting should be included for all employees. It is not just the security team that is responsible for protecting the brand; all employees should be part of this ongoing plan.

4. Can AI-based brand protection account for regional, local or otherwise business-specific nuances related to brand protection and product security? Ex. What if an organization offers slightly different products in different consumer markets?

Yes, AI brand protection solutions can account for these nuances. Many organizations in the same industry are working together to develop AI-based solutions to better protect their products. For example, Swift has announced two AI-based experiments, in collaboration with various member banks, to explore how AI could assist in combating cross-border payments fraud and save the industry billions in fraud-related costs.

We will continue to see organizations collaborate to develop industry-specific AI strategies for brand protection based on the different products and services offered. This is beneficial because attackers will, at times, target specific industries with similar tactics. Organizations need to account for this. Collaboration will help with protection measures, even in simply deciding on which protection measures to invest in most heavily.

5. Reflecting on your interactions with clients who are exploring AI solutions for brand protection, what are the key factors that influence their decision-making process? (ex. Budget, organizational culture, perceived ROI).

From my experience, the key factor that influences decision-making is the perceived return on investments (ROI). Once the benefits and ROI are explained to leaders, then it is less difficult to obtain a budget for investing in an AI brand protection solution. Many organizations are concerned about their brand name being used inappropriately on the dark web and this can hurt an organization’s reputation. Also, I have found that AI security solutions that can help aid an organization in achieving compliance with PCI, GDPR, HITRUST, etc., are more likely to receive approval and support from the board.

Building a culture of trust should not begin when change is being implemented; but rather in a much earlier phase of planning or deciding on which changes need to be made. If an organization has a culture that is not innovative, or leaders who do not train employees properly on using AI security tools or who are not transparent about the risks of it, then any investment in AI will face increased challenges.

AI’s high level of refinement means it can reduce the time and increase the scope of responsibility for individuals and teams performing investigations, enabling them to focus on other meaningful tasks. Investigations that were once mundane become more interesting due to the increased number of unique findings that AI is able to provide.

Due to the time saved by using AI in identifying attacks, investigators will have more time to pursue legal implications; ensuring that threat actors or brand impersonators are given legal warnings or charged with a crime. This can potentially discourage the recurrence of an attack from the specific source that receives the warning.

6. Could you share insights from your experience integrating AI technologies designed for brand protection into comprehensive cyber security frameworks? Lessons learned or recommendations for CISOs?

Security and brand protection leaders are seeing criminals use artificial intelligence to attack or impersonate brand names and they can stay ahead of those threats by operationalizing the NIST AI Risk Management Framework (AI RMF), and by mapping, measuring, and managing AI security risks. The fight moving forward in the future is AI vs AI. It is just as important to document and manage the risks of implementing AI as is to document the risk of attackers using AI to attack your brand name or products.

Leaders need to start preparing their workforce to see AI tools as an augmentation rather than substitution. Whether people realize it or not, AI is already a part of our daily lives, from social media, to smartphones, to spell check, to Google searches.

At this time, a task that was a challenge before can be done a lot faster and more efficiently with the help of AI. I am seeing more leaders who are motivated to educating security teams on the potential uses of AI for protecting the brand and in preventing brand-based spoofing attacks. I see this in the increased investments in AI-capable security solutions that they are making.

7. Would you like to speak to Optiv’s partnership with Check Point in relation to using AI-based technologies for brand protection/product security? The value there?

Attackers target brands from reputable companies because they are confident that these companies have a solid reputation for trustworthiness. Cyber criminals also know that it is difficult for companies, even large companies, to stop such brand impersonations by themselves, if they do not have appropriate tools to aid them.

Optiv and Check Point have had a strong partnership over many years. Check Point has a comprehensive set of AI solutions that I had the luxury of testing at the CPX event this year. Check Point offers a Zero-Phishing AI engine that can block potential brand spoofing attempts, which impersonate local and global brands across multiple languages and countries. It uses machine learning, natural language processing, and image processing to detect brand spoofing attempts. This provides security administrators with more time to focus on other security-related tasks or can alert them when something suspicious occurs within the environment.

The value in using AI solutions from vendors such as Check Point is the reduction in time spent detecting attacks and preventing attacks. In effect, this can empower organizations to focus on the business of increasing sales.

8. Can you share examples of KPIs/metrics that executives should track to measure the effectiveness of AI-powered brand protection initiatives and demonstrate ROI to stakeholders?

Generative AI projects concerning brand protection should be adaptable to specific threats that organizations may have within their environments at specific times. KPIs related to adaptability and customization might include the ease of fine-tuning models, or the adaptability of protection safeguards based on a specific input. The more customizable the generative AI project is, the better it can align with your specific protection needs, based on the assessed threats.

Organizations need to measure KPIs for the AI brand protection solutions that they have deployed. They should track how many attacks are prevented, how many are detected, and how many are successful. These reports should be reviewed on a monthly basis, at the least, and trends should be identified. For example, if successful attacks are increasing over a span of three months, that would be a concern. Or if you see the number of attacks attempted decreasing, that could also be something to look into. In such cases, consider investigating, as to ensure that your tools are still working correctly and not missing other attempted attacks.

9. In looking ahead, what emerging AI-driven technologies or advancements do you anticipate will reshape the landscape of brand protection and product security in the near future? How should organizations prepare? What recommendations are you giving to your clients?

Attackers will be increasing their use of AI to generate large-scale attacks. Organizations need to be prepared for these attacks by having the right policies, procedures, and tools in place to prevent or reduce the impact. Organizations should continually analyze the risk they face from AI brand impersonation attacks using NIST or other risk-based frameworks.

Security and brand leaders should perform a risk assessment before recommending specific tools or solutions to business units, because this will ensure you have the support needed for a successful deployment. It also increases the chance for approval of any unexpected expenses related to it.

I expect that there will be an increase in the collaboration between brands and AI-capable eCommerce platforms to jointly combat unauthorized selling and sharing of data and insights, leading to more effective enforcement. When it comes to brand protection, this will set the stage for more proactive and preventative approaches in the future, and I encourage more businesses to collaborate on these joint projects.

Blockchain technologies can complement AI in protecting brands, with their ability to provide security and transparent authentication. I expect that blockchain will be utilized more in the future in helping brands and consumers verify the legitimacy of a product.

10. Is there anything else that you would like to share with our executive-level audience?

As the issue of brand protection gains prominence, I expect that there will be regulatory changes and the establishment of global standards aimed at protecting brands and consumers from unauthorized reselling activities. Organizations need to stay on top of these changes, especially as the number of brand attacks and impersonations is expected to increase in the future. AI and the data behind it are going to continue to be important factors in protecting brand names and protecting businesses from brand-based spoofing attacks.

It is essential to embrace innovation and collaboration in brand protection and to ensure that authenticity and integrity prevail, given the various threats that organizations face. Let’s be clear that one solution will not solve all problems related to brand protection. Rather, the use of various technologies, along with human intuition, strong leadership, solid processes, and collaboratively created procedures are the keys to increased protection.

Skeleton Key AI attacks unlock malicious content – CyberTalk

EXECUTIVE SUMMARY:

A newly discovered jailbreak – also known as a direct prompt injection attack – called Skeleton Key, affects numerous generative AI models. A successful Skeleton Key attack subverts most, if not all, of the AI safety guardrails that LLM developers built into models.

In other words, Skeleton Key attacks coax AI chatbots into violating operators’ policies under the auspices of assisting users. Skeleton Key attacks will bend the rules and force the AI to produce dangerous, inappropriate or otherwise socially unacceptable content.

Skeleton Key example

Ask a chatbot for a Molotov cocktail recipe and the chatbot will say something to the effect of ‘I’m sorry, but I can’t assist with that’. However, if asked indirectly…

Researchers explained to an AI model that they aimed to conduct historical, ethical research pertaining to Molotov cocktails. They expressed their disinclination to make one, but in the context of research, could the AI provide Molotov cocktail development information?

The chatbot complied, providing a Molotov cocktail materials list, along with unambiguous assembly information.

Although this kind of info is easily accessible online (how to create a Molotov cocktail isn’t exactly a well-kept secret), there’s concern that these types of AI guardrail manipulations could fuel home-grown hate groups, worsen urban violence, lead to the erosion of social cohesion…etc.

Skeleton Key challenges

Microsoft tested the Skeleton Key jailbreak from April to May of this year, evaluating a diverse set of tasks across risk and safety content categories – not just Molotov cocktail development instructions.

As described above, Skeleton Key enables users to force AI to provide information that would ordinarily be forbidden.

The Skeleton Key jailbreak worked on AI models ranging from Gemini, to Mistral, to Anthropic. GPT-4 showed some resistance to Skeleton Key, according to Microsoft.

Chatbots commonly provide users with warnings around potentially offensive or harmful output (noting that it might be considered offensive, harmful or illegal if proceeded with), but the chatbots will not altogether refuse to provide the information; the core issue here.

Skeleton Key solutions

To address the problem, vendors suggest leveraging input filtering tools, as to prevent certain kinds of inputs, including those intended to slip past prompt safeguards. In addition, post-processing output filters may be able to identify model outputs that breach safety criteria. And AI-powered abuse monitoring systems can further efforts to detect instances of questionable chatbot use.

Microsoft has offered specific guidance around the creation of a messaging framework that trains LLMs on acceptable technology use and that tells the LLM to monitor for attempts to undermine guardrail instructions.

“Customers who are building their own AI models and/or integrating AI into their applications [should] consider how this type of attack could impact their threat model and to add this knowledge to their AI red team approach, using tools such as PyRIT,” says Microsoft Azure CTO, Mark Russinovich.

For more on this story, click here. For information about the related BEAST technique, click here. To see how else generative AI is liable to affect CISOs and cyber security teams, read this Cyber Talk article.

Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

10 daunting cyber physical attacks (and proactive mitigations) – CyberTalk

EXECUTIVE SUMMARY:

Cyber physical attacks, which weaponize computer code to cause physical disruption or destruction, represent a growing threat, worldwide. These types of attacks tend to target water treatment facilities, power plants, transportation services, and other digitally connected, critical infrastructure-related segments of our society.

Years ago, cyber systems and physical systems had little-to-no interconnectivity. However, in recent years, internet-based systems have been employed, at-scale, to control physical systems and objects. Emergent cyber physical systems have sensors, computational capacities, real-time monitoring options, and automated components, among other (fancy and useful) things.

Experts have expressed concern around how AI could result in an era rife with cyber physical attacks. With greater technological advancement comes greater responsibility, one could argue. The challenge, at present, is that we’ve largely under-allocated resources to the protection of cyber physical systems. A rich discussion of cyber physical attack types and prevention modalities is to follow…

10 daunting cyber physical attacks (and proactive mitigations)

1. Water treatment facility threats. Cyber physical attacks on water treatment plants and systems are increasing and growing increasingly severe. Threats include potential contamination with deadly agents, as nearly occurred in the Oldsmar water treatment plant attack. Water treatment facilities, at least, in the U.S., have been notoriously slow to adopt adequate cyber security measures.

Mitigations: Experts broadly recommend that the water sector implement a multi-layered approach to cyber security. This includes rigorous network segmentation to isolate OT systems from IT networks, employing multi-factor authentication, monitoring network traffic and system logs, along with training staff around cyber security best practices.

2. Threats to industrial machinery. Although these threats have not appeared as frequently as water treatment facility threats, some of the world’s most sophisticated cyber criminals can target construction sites.

White hat researchers have proven that cyber criminals can potentially manipulate excavators, cranes, scrapers and other large pieces of machinery. Five years ago, Forbes noted that in the context of cyber security research, “cranes were hopelessly vulnerable.” Patches and work-arounds have been released, however some flaws may continue to persist.

Mitigations: To prevent cyber physical attacks on industrial machinery located in or near active construction sites, cyber security professionals should pursue a comprehensive cyber security strategy – with both technical and procedural elements. Products with integrated AI security, like this, can help.

3. Power plant threats/the grid. As the world moves towards smart grid technology, cyber physical attacks on such systems are growing in frequency and sophistication. And artificial intelligence can make the development and launch of these attacks even easier than ever before, according to experts.

Mitigations: One of the greatest challenges around power plant threats is actually lack of knowledge surrounding mitigation. Organizations need to ensure that all default passwords in systems have been changed to unique passwords. They also need to patch systems to the latest patch level. It’s also important to decommission unused systems. Employees need to remain aware of social media and social engineering threats. Contractors need to be held to high security standards…etc. The U.S. government’s comprehensive analyses and recommendations can be found here.

4. Transportation system threats. Transportation systems move millions of people and products across countries and continents everyday. Cyber physical attacks that target transport systems have the potential to slow down or stop the supply chain, preventing people from accessing essential, life-sustaining resources.

Mitigations: One issue within the transportation sector is the historic lack of resources devoted to cyber security and cyber physical threats. But as different transportation sub-sectors become increasingly connected, improved funding, comprehensive cyber security strategies and collaborative efforts will become essential.

5. Autonomous vehicle threats. Self-driving cars and trucks rely on a complex web of network sensors, AI algorithms and communication systems; potential targets for cyber physical attacks. Key vulnerabilities include sensor spoofing, exploitation of vehicle-to-vehicle and vehicle-to-infrastructure communications, and malicious interference with AI decision-making systems, among other things.

In 2023, researchers demonstrated the ability to upend an autonomous vehicle’s driving abilities after placing stickers on road signs. This kind of trickery (or sabotage) can lead to misinterpreted traffic signals or misunderstood road conditions.

Mitigations: Explore this expert interview pertaining to connected vehicle cyber security mitigations. In addition, this EV cyber security risks and best practices article may be of interest.

6. Smart building system threats. While building-based attacks are rare at the moment, building system attacks are poised to become a serious problem. It’s not worth waiting for a catastrophe before taking action.

Modern buildings often have interconnected HVAC, lighting, access control and elevator systems – all of which are indeed vulnerable to cyber physical attacks, unless properly secured.

Mitigations: Cyber security professionals should first familiarize themselves with the inherent management system and its built-in security features (basics, right?).

Subsequently, professionals may wish to implement network segmentation. Systems should be regularly patched and updated. Security assessments at regular intervals are a must. In addition, implement strong access controls, like least privileged access, and monitor for anomalous behavior.

7. Manufacturing facility threats. Within manufacturing environments, Industry 4.0 has led to heightened levels of connectivity. On this account, cyber physical attacks could disrupt production, compromise product quality and/or crush profits. Operational adaptations, such as remote work adoption, have also increased the risks of cyber physical attacks in this sector.

Mitigations: The Cybersecurity and Infrastructure Security Agency recommends developing both a long-term and multi-faceted cyber security strategy. Manufacturing organizations are also advised to invest in training for both security analysts and those who are working on the ‘shop floor’. Those on-site should maintain cyber security and operational knowledge. Partnerships between production staff and security analysts should be facilitated and aligned with the organization’s risk tolerance.

8. Healthcare device threats. Cyber criminals have been known to target hospital-based IoT systems, implantable IoT systems, and personal wearable devices (like smartwatches).

To highlight the magnitude of implantable IoT security challenges, Dr. Sanjay Gupta, an American neurosurgeon, noted that former U.S. Vice President Dick Cheney’s heart defibrillator had to be monitored ahead of implantation to avoid potential cyber physical terrorist attacks.

Mitigations: Because the healthcare cyber physical attack landscape is so varied, it’s tough to summarize mitigations in a single paragraph. For hospital-focused threat prevention insights, click here. For medical IoT (IoMT) cyber security insights, see our Buyer’s Guide.

9. Drone system threats. The proliferation of commercial drones has created the potential for cyber physical attacks of new varieties. We’re not talking about flying pizza that fails to land…Drone threats could result in disruptions to critical national infrastructure and could lead to public safety concerns.

Mitigations: Enterprises that leverage drones are advised to encrypt drone communication technologies. They should also deploy anti-spoofing and anti-jamming technologies. Beyond that, experts suggest establishing real-time monitoring capabilities for drone fleets with automated anomaly detection. These reflect just a handful of the cyber security tactics that can be put into place.

10. Quantum computing threats. While technology isn’t quite there yet, quantum computing may present a threat to cyber physical systems by making it possible for adversaries to break encryption methods used for sensitive data.

In turn, cyber criminals may be able to gain access to industrial control systems or other sensitive cyber infrastructure that could be used to incite physical damage.

Mitigations: Organizations may wish to focus on hiring talent that is familiar with quantum computing security. In addition or alternatively, organizations may want to participate in the development of quantum security standards, and help to establish best practices. As quantum technology evolves, stay informed.

Summary

To effectively prevent cyber physical attacks, organizations need to fully understand their own ecosystems; both digital and physical assets.

Comprehensive visibility into systems will enable organizations to prioritize risk mitigation efforts, allocate resources more effectively, and develop targeted strategies that address the most critical weaknesses in cyber physical infrastructure.

Also worth mentioning: A cyber physical security approach should also extend beyond internal systems as to include third-party vendors and supply chain partners.

For more on cyber physical attacks, click here. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

New MOVEit transfer vulnerabilities that require patching (2024) – CyberTalk

EXECUTIVE SUMMARY:

Remember last year’s MOVEit meltdown? Get ready for a reprise…

For anyone who missed last year’s madness, MOVEit Transfer is a popular managed file transfer product sold by Progress Software, which provides business applications and services to more than 100,000 organizations globally.

In 2023, the software code for the MOVEit Transfer product was found to contain multiple vulnerabilities, leading to a rash of ransomware attacks, and data exposure for thousands of organizations.

The level of business exploitation was so severe that it impacted the results of this year’s “Data Breach Investigations Report” (DBIR) from Verizon.

Earlier this month, Progress Software contacted users about two high-severity vulnerabilities, CVE-2024-5805 and CVE-2024-5806. Both are categorized as authentication bypass-style vulnerabilities. Each one has been assigned a 9.1 severity score.

To allow adequate time for patching, the information was under embargo until June 25^th. This appears to have been a wise move, as just hours after being made public, at least one vulnerability is seeing active exploit attempts in the wild.

The Shadowserver Foundation has detected exploitation efforts that hone in on honeypot systems, in particular.

The new bugs

“To be clear, these vulnerabilities are not related to the zero-day MOVEit Transfer vulnerability we reported in May 2023,” said a Progress Software spokesperson.

CVE-2024-5806 is an improper authentication vulnerability in MOVEit’s SFTP module, which can potentially lead to authentication bypass in some instances.

Cyber security researchers have noted that this CVE could be weaponized to “impersonate any user on the server.”

CVE-2024-5805 is another SFTP-associated authentication bypass vulnerability, which affects MOVEit Gateway version 2024.0.0.

Action items

As a cyber security leader, have your team check on whether or not your MOVEit Transfer software is up-to-date. Patches are available for all vulnerabilities.

Communicate to your team that these vulnerabilities are a priority, as they have serious business implications. If patching hasn’t yet been completed, emphasize the importance of patching quickly. After patching, confirm successful implementation.

Additional considerations

Reassess your organization’s vulnerability to ransomware attacks. Take a layered approach to cyber security and consider additional cyber security measures. You might want to invest in proactive processes like vulnerability assessments and red teaming. In addition, review and update your incident response plan, as to address potential MOVEit Transfer exploitation attempts.

Further information

As compared to the MOVEit Transfer exposure numbers from last year, experts say that the numbers appear similar – the geographies and networks where MOVEit Transfer is observed also mirror those of the 2023 incident.

See CyberTalk.org’s past MOVEit Transfer coverage here. Get more insights into software supply chain vulnerabilities here.

Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.