The Digital Insider | Category: Digital Security

How the Internet of Things (IoT) became a dark web target – and what to do about it – CyberTalk

By Antoinette Hodes, Office of the CTO, Check Point Software Technologies.

The dark web has evolved into a clandestine marketplace where illicit activities flourish under the cloak of anonymity. Due to its restricted accessibility, the dark web exhibits a decentralized structure with minimal enforcement of security controls, making it a common marketplace for malicious activities.

The Internet of Things (IoT), with the interconnected nature of its devices, and its vulnerabilities, has become an attractive target for dark web-based cyber criminals. One weak link – i.e., a compromised IoT device – can jeopardize the entire network’s security. The financial repercussions of a breached device can be extensive, not just in terms of ransom demands, but also in terms of regulatory fines, loss of reputation and the cost of remediation.

With their interconnected nature and inherent vulnerabilities, IoT devices are attractive entry points for cyber criminals. They are highly desirable targets, since they often represent a single point of vulnerability that can impact numerous victims simultaneously.

Check Point Research found a sharp increase in cyber attacks targeting IoT devices, observing a trend across all regions and sectors. Europe experiences the highest number of incidents per week: on average, nearly 70 IoT attacks per organization.

How the Internet of Things (IoT) became a dark web target – and what to do about it – CyberTalk

Gateways to the dark web

Based on research from PSAcertified, the average cost of a successful attack on an IoT device exceeds $330,000. Another analyst report reveals that 34% of enterprises that fell victim to a breach via IoT devices faced higher cumulative breach costs than those who fell victim to a cyber attack on non-IoT devices; the cost of which ranged between $5 million and $10 million.

Other examples of IoT-based attacks include botnet infections, turning devices into zombies so that they can participate in distributed denial-of-service (DDoS), ransomware and propagation attacks, as well as crypto-mining and exploitation of IoT devices as proxies for the dark web.

4% browsing, 90% confidentiality, 6% anonymity

The dark web relies on an arsenal of tools and associated services to facilitate illicit activities. Extensive research has revealed a thriving underground economy operating within the dark web. This economy is largely centered around services associated with IoT. In particular, there seems to be a huge demand for DDoS attacks that are orchestrated through IoT botnets: During the first half of 2023, Kaspersky identified over 700 advertisements for DDoS attack services across various dark web forums.

IoT devices themselves have become valuable assets in this underworld marketplace. On the dark web, the value of a compromised device is often greater than the retail price of the device itself. Upon examining one of the numerous Telegram channels used for trading dark web products and services, one can come across scam pages, tutorials covering various malicious activities, harmful configuration files with “how-to’s”, SSH crackers, and more. Essentially, a complete assortment of tools, from hacking resources to anonymization services, for the purpose of capitalizing on compromised devices can be found on the dark web. Furthermore, vast quantities of sensitive data are bought and sold there everyday.

AI’s dark capabilities

Adversarial machine learning can be used to attack, deceive and bypass machine learning systems. The combination of IoT and AI has driven dark web-originated attacks to unprecedented levels. This is what we are seeing:

Automated exploitation: AI algorithms automate the process of scanning for vulnerabilities and security flaws with subsequent exploitation methods. This opens doors to large-scale attacks with zero human interaction.
Adaptive attacks: With AI, attackers can now adjust their strategies in real-time by analyzing the responses and defenses encountered during an attack. This ability to adapt poses a significant challenge for traditional security measures in effectively detecting and mitigating IoT threats.
Behavioral analysis: AI-driven analytics enables the examination of IoT devices and user behavior, allowing for the identification of patterns, anomalies, and vulnerabilities. Malicious actors can utilize this capability to profile IoT devices, exploit their weaknesses, and evade detection from security systems.
Adversarial attacks: Adversarial attacks can be used to trick AI models and IoT devices into making incorrect or unintended decisions, potentially leading to security breaches. These attacks aim to exploit weaknesses in the system’s algorithms or vulnerabilities.

Zero-tolerance security

The convergence of IoT and AI brings numerous advantages, but it also presents fresh challenges. To enhance IoT security and device resilience while safeguarding sensitive data, across the entire IoT supply chain, organizations must implement comprehensive security measures based on zero-tolerance principles.

Factors such as data security, device security, secure communication, confidentiality, privacy, and other non-functional requirements like maintainability, reliability, usability and scalability highlight the critical need for security controls within IoT devices. Security controls should include elements like secure communication, access controls, encryption, software patches, device hardening, etc. As part of the security process, the focus should be on industry standards, such as “secure by design” and “secure by default”, along with the average number of IoT attacks per organization, as broken down by region every week.

Functional requirements, non-functional requirements

Collaborations and alliances within the industry are critical in developing standardized IoT security practices and establishing industry-wide security standards. By integrating dedicated IoT security, organizations can enhance their overall value proposition and ensure compliance with regulatory obligations.

In today’s cyber threat landscape, numerous geographic regions demand adherence to stringent security standards; both during product sales and while responding to Request for Information and Request for Proposal solicitations. IoT manufacturers with robust, ideally on-device security capabilities can showcase a distinct advantage, setting them apart from their competitors. Furthermore, incorporating dedicated IoT security controls enables seamless, scalable and efficient operations, reducing the need for emergency software updates.

IoT security plays a crucial role in enhancing the Overall Equipment Effectiveness (a measurement of manufacturing productivity, defined as availability x performance x quality), as well as facilitating early bug detection in IoT firmware before official release. Additionally, it demonstrates a solid commitment to prevention and security measures.

By prioritizing dedicated IoT security, we actively contribute to the establishment of secure and reliable IoT ecosystems, which serve to raise awareness, educate stakeholders, foster trust and cultivate long-term customer loyalty. Ultimately, they enhance credibility and reputation in the market. Ensuring IoT device security is essential in preventing IoT devices from falling into the hands of the dark web army.

This article was originally published via the World Economic Forum and has been reprinted with permission.

For more Cyber Talk insights from Antoinette Hodes, please click here. Lastly, to receive stellar cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Must-know insights when navigating the CISO career path – CyberTalk

EXECUTIVE SUMMARY:

The CISO career path is as exciting as it is fraught with perils. Modern CISOs exist at the intersection of technology, security and business strategy. The stakes are high and the simplest of initiatives can easily command commendation or crumble and collapse, ending in highly visible, catastrophic failures.

Succeeding within a CISO role requires a unique skill set and a unique blend of industry perspectives. In this article, we’ll highlight essential approaches for both aspiring and seasoned CISOs to pursue in setting themselves up for success.

CISO career path insights

Regardless of where you are along your CISO career path, enrich your everyday with these pragmatic insights. Ensure that you maintain and emphasize:

1. Agility in an evolving landscape

Cyber threats and technologies evolve at a mind-bending pace. For instance, as artificial intelligence and deepfake technologies are becoming increasingly prevalent, hackers are identifying new tactics that enable them to leverage the tools to disrupt new targets, at-scale. To that effect, enterprise CISOs need to adapt in conjunction with trends — all the while, taking resource availability and changing business needs into consideration.

2. Data-driven decision-making

As a CISO, you’re not only a guardian of data; you’re also a steward of resources. In turn, it’s imperative to communicate the return on investment (ROI) of security initiatives to senior management and stakeholders. Showcase how security measures have not only protected assets, but how they have also contributed to compliance and have positively shaped other aspects of the business.

3. Strategic communication

CISOs must be able to translate technical jargon into language that non-technical stakeholders can grasp. The ability to articulate the utility of security investments, corresponding risks and risks associated with lack of action is critical. It means a higher probability of gaining support and the resources required to truly advance security.

4. Cross-functional partnerships

Strong CISOs work cross-functionally with other departments, including IT, the legal department, and human resources, among others. In so doing, CISOs help ensure that cyber security initiatives are integrated into the fabric of the organization, rather than languishing as isolated efforts. This approach also increases overall business resilience.

5. Continuous learning

Ensure that you’re a member of any and all relevant information security trade associations and training organizations. For instance, the International Society of Forensic Computer Examiners (ISFCE) and The Scientific Working Group on Digital Evidence (SWGDE) can serve as good starting points. See a comprehensive list of cyber security industry associations here.

In addition to formal trade group participation, CISOs should maintain less formal channels for ongoing education purposes. CISOs should pursue industry publications, attend webinars, participate in cyber security conferences, and make connections with other people. For cyber security professionals, staying updated on emerging threats, technologies and regulations is a non-negotiable.

Further information

A savvy CISO not only secures networks and workloads, but also secures their own future. With that in mind, aim for personal growth, work to achieve extraordinary outcomes, and become an inspiring leader who can guide the next generation through effective CISO career path development.

For more CISO career path insights, please see our past coverage. Lastly, discover more timely insights and analyses when you sign up for the cybertalk.org newsletter.

How platformization is transforming cyber security – CyberTalk

With more than 15 years of experience in cyber security, Manuel Rodriguez is currently the Security Engineering Manager for the North of Latin America at Check Point Software Technologies, where he leads a team of high-level professionals whose objective is to help organizations and businesses meet their cyber security needs. Manuel joined Check Point in 2015 and initially worked as a Security Engineer, covering Central America, where he participated in the development of important projects for multiple clients in the region. He had previously served in leadership roles for various cyber security solution providers in Colombia.

In this insightful Cyber Talk interview, Check Point expert Manuel Rodriguez discusses “Platformization”, why cyber security consolidation matters, how platformization advances your security architecture and more. Don’t miss this!

The word “platformization” has been thrown around a lot recently. Can you define the term for our readers?

Initially, a similar term was used in the Fintech industry. Ron Shevlin defined it as a plug and play business model that allows multiple participants to connect to it, interact with each other and exchange value.

Now, this model aligns with the needs of organizations in terms of having a cyber security platform that can offer the most comprehensive protection, with a consolidated operation and easy enablement of collaboration between different security controls in a plug and play model.

In summary, platformization can be defined as the moving from a product-based approach to a platform-based approach in cyber security.

How does platformization differ from the traditional way in which tech companies develop and sell products and services?

In 2001, in a Defense in Depth SANS whitepaper, Todd McGuiness said, “No single security measure can adequately protect a network; there are simply too many methods available to an attacker for this to work.”

This is still true and demonstrates the need to have multiple security solutions for proper protection of different attack vectors.

The problem with this approach is that companies ended up with several technologies from different vendors, all of which work in silos. Although it might seem that these protections are aligned with the security strategy of the company, it generates a very complex environment. It’s very difficult to operate and monitor when lacking collaboration and automation between the different controls.

SIEM and similar products arrived to try to solve the problem of centralized visibility, but in most cases, added a new operative burden because they needed a lot of configurations and lacked automation and intelligence.

The solution to this is a unified platform, where users can add different capabilities, controls and even services, according to their specific needs, making it easy to implement, operate and monitor in a consolidated and collaborative way and in a way that leverages intelligence and automation.

My prediction is that organizations will start to change from a best-of-breed approach to a platform approach, where the selection factors will be more focused on the consolidation, collaboration, and automation aspects of security controls, rather than the specific characteristics of each of the individual controls.

From a B2B consumer perspective, what are the potential benefits of platformization (ex. Easier integration, access to a wider range of services…)?

For consumers, the main benefits of a cyber security platform will be a higher security posture and reduced TCO for cyber security. By reducing complexity and adding automation and collaboration, organizations will increase their abilities to prevent, detect, contain, and respond to cyber security incidents.

The platform also gives flexibility by allowing admins to easily add new security protections that are automatically integrated in the environment.

Are there any potential drawbacks for B2B consumers when companies move towards platform models?

I have heard concerns from some CISOs about putting all or most of their trust in a single security vendor. They have in-mind the recent critical vulnerabilities that affected some of the important players in the industry.

This is why platforms should also be capable of integration through open APIs, permitting organizations to be flexible in their journey to consolidation.

How might platformization change the way that B2B consumers interact with tech companies and their products (ex. Self-service options, subscription models)? What will the impact be like?

Organizations are also looking for new consumption models that are simple and predictable and that will deliver cost-savings. They are looking to be able to pay for what they use and for flexibility if they need to include or change products/services according to specific needs.

What are some of main features of a cyber security platform?

Some of the main features are consolidation, being able to integrate security monitoring and management into a single central solution; automation based on APIs, playbooks and scripts according to best practices; threat prevention, being able to identify and block or automatically contain attacks before they pose a significant risk for an organization…

A key component of consolidation is the use of AI and machine learning, which can process the data, identify the threats and generate the appropriate responses.

In terms of collaboration, the platform should facilitate collaboration between different elements; for example sharing threat intelligence or triggering automatic responses in the different regions of the platform.

In looking at platformization from a cyber security perspective, how can Check Point’s Infinity Platform benefit B2B consumers through platformization principles (ex. Easier integration with existing tools, all tools under one umbrella…etc)?

The Check Point Infinity platform is a comprehensive, consolidated, and collaborative cyber security platform that provides enterprise-grade security across several vectors as data centers, networks, clouds, branch offices, and remote users with unified management.

It is AI-powered, offering a 99.8% catch rate for zero day attacks. It offers consolidated security operations; this means lowering the TCO and increasing security operational efficiency. It offers collaborative security that automatically responds to threats using AI-powered engines, real-time threat intelligence, anomaly detection, automated response and orchestration, and API-based third-party integration. Further, it permits organizations to scale cyber security according to their needs anywhere across hybrid networks, workforces, and clouds.

Consolidation will also improve the security posture through a consistent policy that’s aligned with zero trust principles. Finally, there is also a flexible and predictable ELA model that can simplify the procurement process.

How does the Check Point Infinity Platform integrate with existing security tools and platforms that CISOs might already be using?

Check Point offers a variety of APIs that make it easy to integrate in any orchestration and automation ecosystem. There are also several native integrations with different security products. For example, the XDR/XPR component can integrate with different products, such as firewalls or endpoint solutions from other vendors.

To what extent can CISOs customize and configure the Check Point Infinity Platform to meet their organization’s specific security posture and compliance requirements?

Given the modular plug and play model, CISOs can define what products and services make sense for their specific requirements. If these requirements change over time, then different products can easily be included. The ELA consumption model gives even more flexibility to CISOs, as they can add or remove products and services as needed.

How can platformization (whether through Infinity or other platforms) help businesses achieve long-term goals? Does it provide a competitive advantage in terms of agility, innovation and cost-efficiency?

A proper cyber security platform will improve the security posture of the business, increasing the ability to prevent, detect, contain and respond to cyber security incidents in an effective manner. This means lower TCO with increased protection. It will also allow businesses to quickly adapt to new needs, giving them agility to develop and release new products and services.

Is there anything else that you would like to share with Check Point’s thought leadership audience?

Collaboration between security products and proper intelligence sharing and analysis are fundamental in responding to cyber threats. We’ve seen several security integration projects through platforms, such as SIEMs or SOARs, fail because of the added complexity of generating and configuring the different use cases.

A security platform should solve this complexity problem. It is also important to note that a security platform does not mean buying all products from a single vendor. If it is not solving the consolidation, collaboration problem, it will generate the same siloed effect as previously described.

How AI turbocharges your threat hunting game – CyberTalk

EXECUTIVE SUMMARY:

Over 90 percent of organizations consider threat hunting a challenge. More specifically, seventy-one percent say that both prioritizing alerts to investigate and gathering enough data to evaluate a signal’s maliciousness can be quite difficult.

Threat hunting is necessary simply because no cyber security protections are always 100% effective. An active defense is needed, as opposed to dependence on ‘set it and forget it’ types of security tools.

But, despite active threat hunting, many persistent threats often remain undiscovered — until it’s too late. Or at least, that used to be the case.

Artificial intelligence is changing the game. Threat hunting is a task “…that could be accelerated, or in some cases replaced, by AI,” says Check Point’s CTO, Dr. Dorit Dor.

Evolve your threat hunting

Many threat hunters contend with visibility blind-spots, non-interoperable tools and growing complexity due to the nature of hybrid environments. But the right tools can empower threat hunters to contain threats quickly, minimizing the potential impact and expenses associated with an attack.

1. Self-learning. AI-powered cyber security solutions that assist with threat hunting can learn from new threats and update their internal knowledge bases. In our high-risk digital environments, this level of auto-adaptability is indispensable, as it keeps security staff ahead of attacks.

2. Speed and scale. AI-driven threat hunting engines can also process extensive quantities of data in real-time. This allows for pattern and indicator of compromise identification at speed and scale – as never seen before.

3. Predictive analytics. As AI-powered engines parse through your organization’s historical data, the AI can then predict potential threat vectors and vulnerabilities. In turn, security staff can proactively implement means of mitigating associated issues.

4. Collaborative threat hunting. AI-based tools can facilitate collaboration between security analysts by correlating data from different sources. They can then suggest potential threat connections that neither party would have observed independently. This can be huge.

5. Automated response. AI security solutions can automate responses to certain types of threats after they’re identified. For instance, AI can block certain IP addresses or isolate compromised systems, reducing friction and response times.

Implicit challenges

Although AI-based tools can serve as dependable allies for threat hunters, AI cannot yet replace human analysts. Human staff members ensure a nuanced understanding and contextualization of cyber threats.

The right solution

What should you look for when it comes to AI-powered threat hunting tools? Prioritize tools that deliver rich, contextualized insights. Ensure cross-correlation across endpoints, network, mobile, email and cloud in order to identify the most deceptive and sophisticated of cyber attacks. Make sure that your entire security estate is protected.

Are you ready to leverage the power of AI for threat hunting? Get ready to hunt smarter, faster and more efficiently while leveraging the power of AI. The future of threat hunting has arrived. Get more information here.

Lastly, to receive more timely cyber security news, insights and cutting-edge analyses, please sign up for the cybertalk.org newsletter.

SugarGh0st RAT variant, targeted AI attacks – CyberTalk

EXECUTIVE SUMMARY:

Cyber security experts have recently uncovered a sophisticated cyber attack campaign targeting U.S-based organizations that are involved in artificial intelligence (AI) projects. Targets have included organizations in academia, private industry and government service.

Known as UNK_SweetSpecter, this campaign utilizes the SugarGh0st remote access trojan (RAT) to infiltrate networks. In the past, SugarGh0st RAT has been used to target individuals in Central and East Asia and prior to this point, it has not been widely deployed elsewhere.

The specifics of the attack remain under investigation. However, it appears that attackers deployed phishing emails in order to send AI-themed lures to targets; with the objective of persuading them to open an attached ZIP archive.

Risks to AI sector

Although the attack methodology is not particularly sophisticated, telemetry data supports the notion that the campaign primarily targeted a select group of individuals, all of whom had the commonality of maintaining direct connections to a single, leading U.S.-based AI-oriented organization.

Cyber security professionals believe that the attackers are geo-politically motivated, and interested in either espionage or intellectual property theft. The campaign’s timing coincides with a Reuters report noting that the U.S. government intends to restrict foreign access to generative artificial intelligence.

Proactive takeaways for CxOs

The attacks highlight the growing risk to the U.S. AI sector. They emphasize the need for continued cyber security vigilance. Organizations that own or are developing proprietary AI tools or resources are advised to pursue a multi-layered approach to cyber security.

Cyber security leaders may wish to reevaluate security measures for AI-related projects. CISOs should prioritize use of comprehensive, advanced threat prevention systems. Such systems can analyze patterns and user behavior within AI environments, isolating anomalies that are indicative of malicious activity.

Leaders may also want to upgrade organizational email security. Consider the implementation of advanced email filtering solutions that can identify and quarantine emails containing malicious links and attachments.

Beyond that, cyber security leaders can elevate threat prevention by connecting and collaborating with the larger cyber security community. Consider participating in information-sharing forums and leveraging threat intelligence feeds.

AI-powered cyber security tools, like Check Point’s Infinity Platform, can effectively mitigate AI-based threats. AI-powered cyber security technologies can detect novel attacks, analyze attachments in real-time and can flag phishing emails, among numerous other advanced capabilities.

Get more information about AI-powered cyber security solutions here. To receive robust cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Lost in translation | Abbreviations and acronyms in cyber security – CyberTalk

By Antoinette Hodes, a Check Point Global Solutions Architect and Evangelist with the Check Point Office of the CTO.

Cyber security professionals commonly throw around industry-specific acronyms in a bid to simplify communication and to save time. But linguistic shortcuts have their disadvantages, especially when it comes to communicating across teams…

In the way that a poorly executed baseball pitch can result in a weak hit or near-miss, sloppy linguistic use can also result in near cyber security misses or flagrant failures. The impact on an organization can be tremendous, leading to millions of dollars in damages.

Don’t believe it? Keep reading. In this article, we’ll explore best practices to mitigate the surprisingly extensive risk associated with cyber security linguistic shortcuts.

Miscommunication as cyber threat

More than half of top-tier managers (62%) admit that a miscommunication with the IT department or IT security team has resulted in at least one cyber security incident in their organization.

Deliberately using abbreviations and acronyms can become a sort of “security through obscurity”. No one has the exact formula to deduce the cost of miscommunication, but it’s known that miscommunications can heavily impact your bottom line, recovery time and reputation in a negative way.

The loss of context and meaning challenge

A real threat is the business language barrier between cyber security and other teams. If communications are unclear between the security and network teams, for example, the result could be a critical delay in reaction time, which could lead to outsized cyber security consequences.

Miscommunication cyber lingo example

Consider this line: While the ZTA and ZTNA models ensure secure network access, but leave applications defenseless, the ZTAA model prioritizes secure application access.

Meaning: While the Zero Trust Access and Zero Trust Network Access models ensure secure network access, but leave applications defenseless, the Zero Trust Application Access model prioritizes secure application access (Stakeholders mistakenly interchanged the terms ZTNA and ZTAA, leading to confusion about the specific security controls being discussed).

More acronym-based cyber lingo examples

IoMT can mean Internet of Medical Things or Internet of Military Things.
BIoT can mean Battlespace Internet of Things or Blockchain Internet of Things
CIoT can mean Consumer IoT or Cognitive Internet of Things

Prioritize communication clarity

In preparation for a cyber security incident, it’s especially important to maintain a jargon and acronym free communication plan. For acronyms and abbreviations that are used in such plans, it is recommended to have a high-level technical fact sheet ready. It should describe all abbreviations and acronyms.

Basically, unclear communication, usage of acronyms and abbreviations, represent hidden costs. The financial implications tied to inefficient communication haven’t been quantified — nor the savings efficient communication might bring. However, these are crucial concepts to consider when trying to elevate how your teams work together and the business implications of communication failures.

A good CISO would translate technical jargon to financial examples, maybe even accompanied with infographics and flowcharts (a picture paints a 1,000 words), to simplify complex concepts.

For more cyber security insights from Antoinette Hodes, click here. Lastly, subscribe to the CyberTalk.org newsletter for timely insights, cutting-edge analyses and more, delivered straight to your inbox each week.

5 key takeaways for CISOs, RSA Conference 2024 – CyberTalk

EXECUTIVE SUMMARY:

Last week, over 40,000 business and cyber security leaders converged at the Moscone Center in San Francisco to attend the RSA Conference, one of the leading annual cyber security conferences and expositions worldwide, now in its 33^rd year.

Across four days, presenters, exhibitors and attendees discussed a wide spectrum of topics, including groundbreaking cyber security innovation, new perspectives, and transformative cyber security solutions.

The theme of this year’s conference was “The Art of Possible,” reminding attendees that challenges can be overcome, especially as a collaborative community. If you missed the event, discover key takeaways below:

5 CISO takeaways: RSAC 2024

1. Artificial intelligence. More than 100 conference sessions grappled with the topic of AI. There was much discussion surrounding the use of AI within cyber security, both on the part of the ‘good guys’ and that of the ‘bad guys’. A number of CISOs expressed concerns pertaining to the risks around shadow AI, comparing it to shadow IT.

Experts also emphasized the need to distinguish generative AI from other types of AI. Panel discussions expanded on AI-focused conversations through discourse on large language models and the predictive benefits that such technologies bring to cyber security tooling.

2. Data governance. Alongside discussions on AI, data governance emerged as a prominent conference topic. While some conversations explored AI’s specific role in data governance, others zeroed in on the need to really know a given organization’s data and the need to develop data governance policies that align with frequently revised and updated compliance standards.

One cyber security executive deftly highlighted the data-oriented challenges that stem from biases associated with three different areas in a given company – the engineers who create data, the C-suite team, which uses the data, and the CISO, who controls data security.

Given biases in perspectives, true data governance continues to be trying. And such biases arguably degrade overall cyber security efforts.

3. Zero-Trust losing the spotlight. In 2023, Zero-Trust dominated RSA Conference discussions. However, this year, while still a general conversation topic, the buzz around Zero-Trust appeared to have diminished. According to a handful of CISOs, many organizations are already well into their Zero-Trust journeys, which may explain the waning interest.

4. CISA announces Secure by Design program. The top cyber security agency in the U.S. reported that 68 of the world’s leading software manufacturers have signed a voluntary pledge to design products with security built in from the start.

CISA Director Jen Easterly expressed the necessity of Security by Design in the wake of widespread hacking campaigns operated by nation-state actors. “We can together achieve long-term security through fundamentally more secure software,” she stated.

The pledge says that within a year, all involved companies will increase the use of multi-factor authentication across products, reduce the use of default passwords, reduce the prevalence of entire classes of vulnerabilities, make efforts to increase the installation of patches by customers, and be more transparent and timely about common vulnerabilities, among other things.

5. Resilience building. Discussions emphasized that resilience isn’t achieved solely through technology, but rather by fostering collaboration across stakeholder groups. CISA’s Secure by Design program exemplifies the collaborative approach.

Further information

Other topics addressed during the conference included inheriting cyber security from past CISOs, how ransomware prevention has evolved, balancing innovation and security in the cloud, and of course, as noted previously, no one ran out of things to say about artificial intelligence.

For deep-dive insights into cloud-delivered, AI-powered security solutions, click here. To receive compelling cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

AI is changing the shape of leadership – how can business leaders prepare? – CyberTalk

By Ana Paula Assis, Chairman, Europe, Middle East and Africa, IBM.

EXECUTIVE SUMMARY:

From the shop floor to the boardroom, artificial intelligence (AI) has emerged as a transformative force in the business landscape, granting organizations the power to revolutionize processes and ramp up productivity.

The scale and scope of this shift is fundamentally changing the parameters for business leaders in 2024, presenting new opportunities to increase competitiveness and growth.

Alongside these opportunities, the sophistication of AI – and, in particular, generative AI – has brought new threats and risks. Business leaders across all sectors are dealing with new concerns around data security, privacy, ethics and skills – bestowing additional responsibilities to consider.

To explore this in more detail, IBM commissioned a study, Leadership in the Age of AI. This surveyed over 1,600 senior European executives on how the AI revolution is transforming the role of company leaders as they seek to maximize its opportunities while also navigating its potential threats in an evolving regulatory and ethical landscape.

Powering AI growth in Europe

With seven out of ten of the world’s most innovative countries located in Europe, the region is well-positioned to capitalize on the soon-to-be-adopted EU AI Act, which offers the world’s first comprehensive regulatory framework. This regulatory confidence and clarity is expected to attract additional investments and new participants, further benefiting Europe’s AI ecosystem.

Against this promising backdrop, it is no surprise to see generative AI deployment at the top of CEOs’ priorities for 2024, with 82% of the business leaders surveyed having already deployed generative AI or intending to this year. This growing sense of urgency is driven by a desire to improve efficiency by automating routine processes and freeing employees to take on higher-value work, enhancing the customer experience and improving outcomes.

Despite this enthusiasm, concerns around security and privacy are tempering the rate of adoption – while 88% of business leaders were excited about the potential of AI within their business, 44% did not feel ready to deploy the technology yet, with privacy and security of data (43%), impact on workforce (32%) and ethical implications (30%) identified as the top three challenge facing business leaders. Instead of solely focusing on the financial benefits of AI, business leaders are now compelled to actively address the societal costs and risks associated with it.

A new era for leadership

Leadership in the age of AI requires executives to strike a balance between addressing the ethical and security implications of technology and harnessing its competitive advantages. This delicate balance lies at the core of the EU AI Act, endorsed by the European Parliament in March. It aims to promote innovation and competitiveness in Europe while ensuring transparency, accountability and human oversight in the development and implementation of AI.

The Act takes a risk-based approach, ascertaining the level of regulation required by the level of risk each use case poses. This spans from prohibitive, which includes practices such as social scoring; high-risk, which encompasses areas such as infrastructure and credit scoring; medium-risk, which includes chatbots and deep fakes; and low-risk, containing AI-enabled games and spam filters.

With these parameters in place, business leaders must realize regulatory compliance and prepare their operations and workforce for the upcoming shift. They must manage risk and reputation and future-proof their companies for further innovation and regulation, which will inevitably follow in the coming years.

There are two major priorities for business leaders in achieving this. The first is to create effective AI governance strategies built upon five pillars: explainability, fairness, robustness, transparency and privacy. These aim to promote transparency in data usage, equitable treatment, defence against attacks, system transparency and privacy protection.

Underpinned by human oversights, they will serve to mitigate risks and ensure AI systems are trustworthy. This comprehensive governance approach fosters responsible AI adoption, building trust among users and stakeholders while ensuring the ethical and responsible use of AI technologies.

The second, and equally important, action is to establish an AI ethics board. While the Act itself necessitates a certain level of ethical compliance, businesses should use this opportunity to establish their own ethical frameworks.

This will guide implementation now while laying out clear guardrails for future innovation. At IBM, for example, our ethical framework dictates what use cases we pursue, what clients we work with and our trusted approach to copyright. Establishing these foundations early serves to help prevent reputational risks or Act breaches further down the line.

The skills responsibility

There is also a clear responsibility for equipping workforces with the necessary skills to successfully navigate AI transformation. Another recent IBM study around AI in the workplace found that 87% of business leaders expect at least a quarter of their workforce will need to reskill in response to generative AI and automation.

Those who equip themselves with AI skills will have a significant advantage in the digital economy and job market over those who do not. Organizations are responsible for helping their employees upskill or reskill to adapt to this changing ecosystem.

Businesses take this duty seriously, with 95% of executives stating they are already taking steps to ensure they have the right AI skills in their organizations, and 44% actively upskilling themselves in the technology. The incentive comes from a competitive and a societal perspective, ensuring that large portions of the workforce are not excluded from participating in and benefiting from the thriving digital economy.

With legislative frameworks now in place, European CEOs and senior business leaders must navigate the evolving AI landscape with trust and openness, integrating good governance principles into its development and adoption, cementing ethical guardrails and building resilience across the workforce. This new era of leadership demands trust and transparency from the top down and will be a critical component for growth and return on investment.

This article was originally published via the World Economic Forum and has been reprinted with permission.

10 ways generative AI drives stronger security outcomes – CyberTalk

EXECUTIVE SUMMARY:

Eighty-seven percent of cyber security professionals recognize the potential inherent in leveraging AI for security purposes. The growing volume and sophistication of cyber attacks point to the critical need for new and innovative ways to protect businesses from cyber skullduggery.

However, despite widespread and rabid enthusiasm for generative AI, generative AI adoption in the security space has remained somewhat constricted and slow. Why? The reality is that running mature, enterprise-ready generative AI is not an easy feat.

Managing generative AI systems requires skilled professionals, comprehensive governance structures and powerful infrastructure, among other things. Nonetheless, if organizational maturity is accounted for and attended to, generative AI can present robust opportunities through which to drive stronger cyber security outcomes.

10 ways generative AI drives stronger cyber security outcomes

1. Customized threat scenarios. When presented with news articles detailing a never-seen-before threat scenario, generative AI can process the information in such a way as to create a customized tabletop exercise.

When also given organization-specific information, the technology can generate tabletop scenarios that closely align with an organization’s interests and general risk profile. Thus, the AI can strengthen organizational abilities to plan for and contend with emerging cyber threats.

2. Persona-based risk assessment. When joining a new organization, cyber security leaders commonly connect with stakeholders in order to understand department-specific cyber risks.

This has effort its benefits, but only to an extent. Cyber security personnel can only reach out to high-level stakeholders and departmental heads for input so many times, at least, before seriously detracting from their work.

To the advantage of cyber security professionals, when set up to do so, generative AI can emulate various personas. If this sounds absurd, just hang in there. As a result, the AI can simulate different perspectives and evaluate risk scenarios accordingly.

For example, an AI model that emulates a cautious CFO may be able to provide security staff with insights into financial data security risks that would have otherwise remained overlooked. While new and still somewhat eerie, persona emulation can prompt businesses to examine more elusive risk types and to consider corresponding red teaming activities.

3. Dynamic honeypots. Honeypots decoy systems are designed to strategically misdirect hackers who are looking for high-value data. In essence, they send the hackers hunting in the wrong direction (so that security pros can find them and send them packing).

Generative AI can enhance the effectiveness of honeypot traps by dynamically creating new and different fake environments. This can help protect a given organization’s resources, as it helps to continuously confound and redirect hackers.

4. Policy development and optimization. Generative AI has the ability to analyze historical security incidents, regulations and organizational goals. As a result, it can recommend (or even autonomously develop) cyber security policies. Said policies can be tailored to align with business objectives, compliance requirements and a cyber security strategy.

(However, despite the utility of generative AI in this area, regular policy validation and human oversight are still critical.)

5. Malware detection. When it comes to malware detection, generative AI algorithms excel. They can closely monitor patterns, understand behaviors and zero in on anomalies.

Generative AI can detect new malware strains, including those that deploy unique self-evolving techniques and polymorphic code.

6. Secure code generation. Generative AI can assist with writing secure code. Generative AI tools can review existing codebases, find vulnerabilities and recommend patches or improvements.

Refusing to use generative AI for secure code development would be like “asking an office worker to use a typewriter instead of a computer,” says Albert Ziegler, principle researcher and member of the GitHub Next research and development team.

In terms of examples of what generative AI can do here, it can automatically refactor code to eliminate common security flaws and issues, like SQL injections or buffer overflows.

7. Privacy-preserving data synthesis. According to ArXiv, owned by Cornell University, generative AI’s abilities to create task-specific, synthetic training data has positive implications for privacy and cyber security.

For instance, generative AI can anonymize medical data, enabling researchers to study the material without the risk of accidentally exposing real data through insecure tools (or in some other way, compromising patient privacy).

8. Vulnerability prediction and prioritization. Generative AI and machine learning tools can assist with vulnerability management by analyzing existing databases, software code patterns, network configurations and threat intelligence. Organizations can then predict potential vulnerabilities in software (or network configurations) ahead of when they would otherwise be discovered.

9. Fraud detection. One novel application of generative AI is in fraud detection, as the technology can sift through massive datasets (nearly instantly). Thus, generative AI can flag and block suspicious online transactions as they pop-up, preventing possible economic losses.

PayPal is known to have already applied generative AI and ML to enhance its fraud detection capabilities. Over a three year period, this application of generative AI has reduced the company’s loss rate by half.

10. Social engineering countermeasures. The success of social engineering tactics, like phishing emails, depend on the manipulation of human emotions and the exploitation of trust. To combat phishing, generative AI can be used to develop realistic phishing simulations for the purpose of employee training.

Generative AI can also be used to develop deepfakes of known persons — for internal ethical use and training purposes only. Exposing employees to deepfakes in a controlled setting can help them become more adept at spotting deepfakes in the real-world.

Explore how else generative AI can drive stronger cyber security outcomes for your organization. Read about how Check Point’s new generative AI-based technology can benefit your team. Click here.

To receive compelling cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.

Beware of cyber scams: How hackers tried to scam me – CyberTalk

Lari Luoma has over 20 years of experience working in the fields of security and networking. For the last 13 years, he has worked with Check Point Professional Services as a security consultant, helping customers worldwide implement the best-in-class cyber security. He is a subject matter expert in hyper-scalable security solutions.

EXECUTIVE SUMMARY:

Cyber crime is on the rise. People encounter scams in their everyday lives without really understanding they are being scammed. These vexing and vicious scams can arrive in various forms; phishing emails, fraudulent phone calls or text messages. All of them aim to exploit unsuspecting victims for financial gain. Recently, I found myself on the receiving end of one such scam. This led me to reflect on how important it is to actively anticipate the latest cyber threats and to maintain vigilance.

It began with an email notification purporting to be from PayPal. The notification claimed that my account had been charged $600 for McAfee Antivirus software. I was urged to take immediate action. The email instructed me to contact a provided customer service number to resolve the supposed issue. As I scrutinized the email further, alarm bells rang in my mind. The sender’s address raised suspicion— the address was connected to a generic Gmail account, a far cry from the official communication channels one would expect from PayPal.

Despite my skepticism, I decided to call the provided number to investigate. What ensued was a conversation with an individual who claimed to be a customer service representative. However, the person’s demeanor was far from professional. The individual immediately inquired about my location and whether or not I was on my laptop. When I requested a reason and asked why we couldn’t handle the issue over the phone, the person replied that it was because a laptop has a bigger screen, and it would be easier to fill out the form that he was going to send.

Sensing something amiss, I stated that I wasn’t home and didn’t have my laptop with me, to which the caller abruptly hung up. It was a clear indication of foul play; a phishing attempt to obtain sensitive information or compromise my device’s security.

Reflecting on this encounter, I realized just how easily people can be fooled if they think that they are going to lose money. These scammers were very unprofessional and didn’t sound authentic on the phone. Also, using a Gmail address was a big mistake for them. If they had executed on their activities with a bit more sophistication and polish, I might have fallen victim to the scam.

Here are crucial tips to help you and yours avoid falling victim to similar scams. Consider sharing these tips with employees:

1. Verify sender information: Always scrutinize the email sender’s address. Look for any red flags, such as suspicious domain names or generic email providers (like Gmail or Yahoo), especially if they’re being used for “official” communications from reputable organizations.

2. Exercise caution with unsolicited requests: Be wary of unsolicited emails or messages requesting urgent action, especially if the emails or messages involve financial transactions or account verification. Legitimate companies typically don’t request sensitive information via email.

3. Double-check website URLs: Before clicking on any links in emails, hover over them to preview the URL. Verify that they lead to legitimate websites. Make sure that they aren’t phony links to phishing sites that were designed to steal login credentials or personal data.

4. Use two-factor authentication (2FA): Enable 2FA wherever possible, especially for sensitive accounts, like bank accounts or email accounts. This adds an extra layer of security by requiring a secondary verification method, such as a code sent to your phone.

5. Stay informed and educated: Keep abreast of the latest cyber security threats and techniques used by scammers. Organizations like the Federal Trade Commission (FTC) and cyber security blogs, like CyberTalk.org, provide valuable resources and tips for protecting yourself online.

6. Report suspicious activity: If you encounter a potential scam or phishing attempt, report it to the appropriate authorities or the impersonated business. This helps raise awareness and can compel a business to act, thereby preventing others from falling victim to similar schemes.

7. Don’t engage in discussion with scammers: If the email includes a phone number, you shouldn’t call to resolve the alleged issue.

Maintain vigilance regarding any unsolicited messages that you receive. Don’t click on any links and don’t call numbers provided. If an email informs you that a large sum has been debited from your account, consider whether or not the story seems authentic. Check your credit card bills and contact the real customer support numbers for the company that the scammers are purportedly from.

For instance, in the case that I outlined above, I should have researched the real customer support number for McAfee or Paypal and called there, rather than calling the number that was included in the message. Stay savvy and secure.

For more insights from cyber security expert Lari Luoma, click here. To receive clear cyber insights, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.