• Search for:
    29Jun, 2023
    Top 6 cybersecurity trends to keep an eye on in 2023

    In a world where everything is just a click away, cybersecurity trends are a matter of concern. With data breaches, hacking, and malware attacks becoming more sophisticated, it’s crucial to stay ahead of the curve and remain vigilant in the fight against cybercrime. 

    For the unversed, cybersecurity is the practice of protecting computer systems, networks, and data from theft, damage, or unauthorized access. In today’s digital age, cybersecurity is more important than ever, as businesses and individuals rely heavily on technology to store and exchange sensitive information. 

    Key components of cybersecurity 

    There are several key components to cybersecurity. The first is prevention. This involves implementing security measures such as firewalls, antivirus software, and access controls to prevent unauthorized access to systems and data. It also involves regularly updating software and systems to patch vulnerabilities that could be exploited by cybercriminals. 

    Another key component of cybersecurity is detection. This involves monitoring systems and networks for suspicious activity, such as unauthorized access attempts or unusual network traffic. Early detection of potential threats can help organizations mitigate the damage and prevent data loss. 

    If a breach does occur, it is important to have a response plan in place. This involves having procedures for investigating and containing the breach and notifying affected individuals and authorities as needed. It is also important to have a plan for restoring systems and data after a breach, which may involve restoring backups or rebuilding systems from scratch. 

    Cybersecurity trends to watch out for in 2023 

    Since cybersecurity is a constantly evolving field, new threats emerge every year. As we look ahead to 2023, there are several cybersecurity trends that organizations and individuals need to watch out for. 

    1. Ransomware attacks 

    Ransomware is a type of malware that infects a computer system and encrypts its files, making them inaccessible to the user. The attacker then demands a ransom payment in exchange for the decryption key. 

    One reason for the rise of ransomware attacks is that they are incredibly profitable for cybercriminals. The cost of paying the ransom is often much lower than the cost of restoring the system from backups or dealing with the fallout from a data breach. The consequences of a successful ransomware attack can be severe. In addition to the financial costs of paying the ransom and restoring the system, organizations may suffer reputational damage and loss of business. In some cases, sensitive data may be stolen and used for malicious purposes. 

    To protect against the threat of ransomware attacks, organizations need to take proactive steps to improve their cybersecurity defenses. This includes having strong backup and recovery systems in place, regularly updating software and security patches, and educating employees about cybersecurity best practices.  

    2. Healthcare sector at risk

    The healthcare industry is expected to face more cyber attacks in 2023. This industry has already seen a significant increase in cyber attacks in recent years, with a 44% increase resulting in the compromise of 40 million American patient records in 2021. This affected over 22.6 million patients, which is equal to the population of New York.

    A research survey shows that approximately 60% of all ransomware attacks target patient data, while the remaining attacks focus on disrupting operations or taking over systems.

    Phishing scams were the most common type of cyber attack on healthcare organizations in 2020, affecting 81% of companies. With the onset of the COVID-19 pandemic, phishing incidents increased by 220%.

    3. Artificial intelligence (AI) in cyberattacks  

    With Chat GPT storming the internet, cybercriminals are well versed with current trends and are using Artificial intelligence to launch more sophisticated attacks. AI-powered attacks can quickly adapt to changing environments, making them harder to detect and defend against. 

    AI-powered attacks can take different forms, such as phishing emails, malware, or social engineering scams. For example, AI can be used to create highly convincing phishing emails that appear to be from trusted sources, making it easier for attackers to trick users into clicking on malicious links or downloading malware. 

    To protect against AI-powered cyberattacks, organizations need to stay vigilant and adopt advanced cybersecurity tools and techniques that can detect and respond to these threats in real time. This includes using AI-based cybersecurity solutions that can identify and block attacks before they cause damage. Organizations should also implement security awareness training programs to educate employees on how to recognize and report suspicious activity. 

    4. IoT vulnerabilities

    Next up on the cybersecurity trends list, we have IoT vulnerabilities. The security of IoT devices is a concern, and manufacturers are aware of this issue. However, they may not be fully knowledgeable about all the possible vulnerabilities that exist. If any security breaches are discovered, the consequences could be severe.

    As per information from Oracle, the number of connected IoT devices has already exceeded 7 billion and is projected to increase to 22 billion by 2025. This growth presents a large opportunity for cybercriminals to carry out attacks.

    5. Users as an attack surface

    In 2023, one of the cybersecurity trends is expected to be the increased focus on users as an attack surface. Cyber attackers will continue to target an organization’s user base by using tactics like phishing, social engineering, and other methods to gain unauthorized access.

    This trend is driven by the fact that user error remains one of the biggest cybersecurity risks for organizations, as attackers exploit the human element to gain entry to networks and systems. As a result, organizations will need to prioritize user education and awareness training to mitigate the risks posed by user-targeted attacks.

    6. Quantum cryptography

    As quantum computing becomes more widespread, traditional cryptographic methods used for encryption are becoming increasingly vulnerable. Quantum cryptography provides an alternative approach to encryption that is highly secure and resistant to attacks by quantum computers. Quantum cryptography uses quantum mechanics to generate encryption keys, which are then used to secure communications. This method provides an exceptionally high level of security and privacy.

    Navigating cybersecurity challenges: Lessons learned and outlook 

    Overall, cybersecurity is a critical component of modern business and personal life. It requires ongoing vigilance and attention, as cybercriminals continue to develop new tactics and strategies to exploit vulnerabilities. By staying informed and taking proactive measures to protect systems and data, individuals and organizations can help ensure their safety and security in the digital age. 

    In conclusion, 2023 is expected to bring new and evolving cybersecurity trends and threats. It is important for organizations to stay vigilant, stay up to date with the latest cybersecurity tools and techniques, and ensure that their employees are trained to recognize and respond to potential threats. By taking proactive measures to protect their systems and data, organizations can reduce the risk of cyberattacks and keep their businesses running smoothly. 

    Resource : https://datasciencedojo.com/blog/top-cybersecurity-trends-2023/

    29Jun, 2023
    Quantum computing 101

    Quantum computers operate with a set of rules that are fundamentally different from classical computers. For certain applications, these rules can enable quantum computers to process information faster—potentially solving problems that would take traditional machines millions of years.

    Basic quantum computing rules

    Qubits hort for quantum bits, qubits are typically small particles (atoms, ions, photons or electrons) that hold information and behave according to the laws of quantum physics.

    Superposition classical bit is either1 (on) or 0 (off), but a qubit can be in both states simultaneously. Once you measure the qubit’s value, it resolves to either 0 or 1. Reading a qubit causes the quantum state to collapse.

    Entanglement he phenomenon by which two or more qubits share the same quantum states and are correlated regardless of distance from each otheris called entanglement. A change to oneof the entangled qubits directly impactsthe other’s behavior.

    Superposition and entanglement enable quantum computers to perform computations simultaneously rather than sequentially or in parallel. This ability is akey difference between classical and quantum machines.

    The engineering challenge

    Quantum computers are susceptible to noise and this causes them to decohere. Decoherence is the collapse of the quantum state. It is a loss of information and a corruption of the calculations being performed.

    Since quantum computers work at the atomic or subatomic level, the control and measurement signals within them aretiny. Because of this, minimizing environmental noise becomes critical.

    Qubits in a superconducting quantum computer

    Superconducting quantum computers, one type of quantum computer, use the properties of superconducting materials to create a circuit that acts like an artificial atom. These circuits are built using a process similar to that used for manufacturing semiconductors.

    The state of these qubits is controlled with microwave radiation and entangled using electronic coupling. As you might imagine, the energy levels in these circuits are very small and require isolation from the external environment. For this type of quantum computer, special cooling technology is used to maintain coherence.

    Resource : https://www.dell.com/en-us/perspectives/quantum-computing-101/

    26Jun, 2023
    What is a DoS Attack?

    DoS (denial-of-service) attacks play an unusual role in cyber crime. Unlike most forms of criminal hacking, they aren’t primarily designed to capture or sensitive information, which can be sold for profit.

    Instead, DoS attacks are intended to shut down or severely disrupt an organisation’s systems. There is no direct benefit to the criminal hacker in doing this, but the loss of service can cost the victim up to £100,000.

    There are several ways that a criminal hacker can launch a DoS attacks, and countless reasons they might be motivated to pull off an attack.

    How does a DoS attack work?

    DoS attacks are hard to prevent, because in most cases they don’t exploit a vulnerability that an organisation can fix. Rather, attackers take advantage of the limitations of computer networks, overwhelming them until traffic is unable to be processed.

    You can think of it like a traffic jam: roads are designed to enable a certain amount of traffic to pass through, but once they become overcrowded, cars must slow down or stop altogether.

    That said, there are ways to mitigate the risk of some DoS attacks, as we explain below.

    Types of DoS attack

    There are two primary ways to conduct a DoS attack – flooding and crashing.

    Flooding attacks are most common, and work by saturating the targeted server with packets.

    These are segments of data that you send to the organisation’s network when you interact with its website, which are then reassembled to perform tasks or load information.

    If the network receives too many of these packets in a short period of time, the network struggles to reassemble the data. As a result, service will be disrupted or the website will be forced offline altogether.

    Alternatively, an attacker might crash an organisation’s website by exploiting vulnerabilities in its network.

    For instance, they might leverage misconfigured network device by sending spoofed packets to every device on the target network rather than one specific machine.

    The network is then triggered to amplify the traffic, in what is known as a smurf attack or ping of death.

    Attacker motivation

    The question that surrounds DoS attacks is what motivates a criminal hacker to do this?

    Almost all forms of cyber crime are designed to make money, but this isn’t possible with a DoS attack alone. An attackers’ motivation, therefore, can be much harder to understand.

    One reason for launching an attack is because they hold a grudge against the target. Many DoS attacks are politically or ideologically motivated, with the attacker holding a grievance against their target.

    The attack could cost the organisation money if services are disrupted during the attack. The damage could also damage the organisation’s reputation, particularly if they are responsible for providing critical services of a time-sensitive nature.

    However, cyber criminals might also bring down a service simply to show off their skills to the hacking community.

    A high-profile attack can act as a calling card to other criminals to demonstrate their capabilities or to show off what they’re capable of.

    Meanwhile, there are occasions when a DoS is used as a distraction while the criminal hacker launches a second attack designed to compromise an organisation’s systems.

    The victim might be so focused on restoring its systems from the first attack that it doesn’t notice other security alerts related to unauthorised access to its systems.

    DoS attacks versus DDoS attack

    A related attack is DDoS (distributed denial of service). This works in the same way as a DoS attack, but uses multiple systems to launch a synchronised attack on a single target.

    In other words, the attack isn’t coming from a single computer operated by the attacker but from several computers.

    Cyber criminals do this with the help of a botnet, which is a series of infected Internet-connected devices that harvests their processing power.

    As a result, DDoS attacks are far more powerful and sustained than a standard DoS attack.

    DDoS attacks are also harder for the victim to identify, with malicious network traffic spread across locations and masked within legitimate traffic.

    How do you know you’ve suffered a DoS attack?

    The most obvious sign of a DoS attack is prolonged network problems. However, there are other signs to look out for:

    • A higher volume of spam than normal.
    • Sudden loss of connectivity across devices on the same network.
    • Slow website performance, with pages failing to load.
    • Staff being unable to open files stored on the network or when accessing websites.

    How to prevent a DoS attack

    It’s difficult to prevent DoS attacks, but there are steps you can take to mitigate the threat. Here are three ways to get started:

    1.  Increase your bandwidth

    The simplest thing you can do is to buy more bandwidth. This enables you to handle a larger amount of traffic, reducing the risk of bottlenecks that could disrupt your service.

    This is a particularly attractive solution to growing companies, as it also helps them process an increased amount of legitimate traffic and is something they might have to do eventually anyway.

    The only downside is that increasing your bandwidth won’t protect you from crashing attacks, which exploit system weaknesses instead of flooding your server.

    2.  Build more complex servers

    You should consider spreading your servers across multiple data centres to make it as hard as possible for cyber criminals to target you.

    These servers should ideally be in different locations, either spread across different premises or in different countries altogether.

    For this strategy to work, you’ll need a load balancing system to distribute traffic between servers.

    Separating your servers this way means that criminals face an uphill task to flood your systems. Their attack may compromise one server, but the rest will be unaffected and should be capable of taking on at least some of the extra traffic.

    3.  Reconfigure your network hardware

    You should adjust or strengthen your hardware configurations to reduce the risk of malicious traffic getting through.

    For example, your network and web application firewalls can be modified to check incoming packets against predefined rules (such as allow/deny protocols, ports and IP addresses) and block incoming malicious traffic.

    The best way to check how prepared you are for a DoS attack is with a penetration test. This is essentially a controlled form of hacking in which a professional tester uses the same techniques as a criminal hacker in an attempt to exploit your systems.

    In this case, the tester will try to flood your systems or exploit vulnerabilities that cripple your servers.

    Should they be successful, the tester will provide detailed notes on how the attack was possible and advice on how to mitigate the threat.

    Resource : https://www.itgovernance.co.uk/blog/what-is-a-dos-denial-of-service-attack

    26Jun, 2023
    API Penetration Testing Checklist

    API security is an undervalued but crucial aspect of information security. Cyber attacks often target APIs and web applications. To remain secure, organisations must test their systems to find and eliminate any weaknesses.

    Organisations can achieve this with API penetration tests. An ethical hacker (or ‘penetration tester’) will examine your applications using the same techniques that a cyber criminal would use. This gives you a real-world insight into the way someone might compromise your systems.

    Web application and API tests look specifically at security vulnerabilities introduced during the development or implementation of software or websites. There is no single checklist of how exactly the test should be conducted, but there are general guidelines.

    Benefits of API penetration testing

    The primary purpose of an API penetration test is to protect your organisation from data breaches. This is crucial given the increased risk of cyber attacks in recent years. According to a UK government report, 39% of surveyed organisations said they suffered a security breach in the past year.

    By conducting an API penetration test, you will gain a real-world overview of one of the biggest security threats that organisations face. The tester will use their experience to provide guidance on specific risks and advise you on how to address them.

    But penetration tests aren’t only about closing security vulnerabilities. Mitigating the risk of security incidents has several other benefits.

    For instance, you protect brand loyalty and corporate image by reducing the likelihood of a costly and potentially embarrassing incident.

    Penetration testing also helps you demonstrate to clients and potential partners that you take cyber security seriously. This gives you a competitive advantage and could help you land higher-value contracts.

    Most notably, penetration testing is a requirement for several laws and regulations. Article 32 of the GDPR mandates organisations to regularly conduct tests and evaluations.

    This is to assess the effectiveness of the technical and organisational measures employed to protect personal data.

    Likewise, if your organisation is subject to the PCI DSS (Payment Card Industry Data Security Standard), you must conduct external penetration tests at least once per year and after any significant changes are made to your systems.

    API penetration testing checklist

    IT Governance has its own proprietary checklist when conducting API and web application penetration tests.

    The system is modelled on the OSSTMM (Open Source Security Testing Methodology Manual) and the OWASP (Open Web Application Security Project) methodologies.

    A high-level overview of our process is outlined below, with a brief description of what is assessed during each section.

    1. Authentication

    The penetration tester ensures that appropriate mechanisms are in place to confirm a user’s identity. They then review how the authentication process works, using that information to circumvent the authentication mechanism.

    2. Authorisation

    The tester verifies that access to resources is provided only to those permitted to use them.

    Once roles and privileges are understood, the tester tries to bypass the authorization schema. They search for path-traversal vulnerabilities and ways to increase the privileges given to the tester’s user role.

    3. Session management

    The tester ensures that effective session management configurations are implemented. This broadly covers anything from how user authentication is performed to what happens when logging out.

    4. Input validation and sanitisation

    The tester checks that the application appropriately validates and sanitises all input from the user or the environment before using it.

    This includes checking common input validation vulnerabilities such as cross-site scripting and SQL injection, as well as other checks such as file uploads, antivirus detection and file download weaknesses.

    5. Server configuration

    The tester analyses the deployed configuration of the server that hosts the web application. They then verify that the application server has gone through an appropriate hardening process.

    6. Encryption

    The tester assesses encryption security around the transmission of communication. This includes checking for common weaknesses in SSL/TLS configurations and verifying that all sensitive data is being securely transferred.

    7. Information leakage

    The tester reviews the application configuration to ensure that information is not being leaked.

    This is assessed by reviewing configurations and examining how the application communicates to discover any information disclosure that could cause a security risk.

    8. Application workflow

    The tester determines whether the application processes and workflows can be bypassed.

    Tests are conducted to ensure that application workflows cannot be bypassed by either tampering with the parameters or forcefully browsing. This ensures the integrity of the data.

    9. Application logic

    The tester analyses how the application uses, stores, and maintains data. They do this by checking the underlying technology and any mitigating controls that may affect the risk to the application.

    10. Report

    The tester documents their findings. Their reports contain an executive summary, which provides a high-level, non-technical summary of any identified vulnerabilities, alongside a summary of the organisation’s business risks and an overall risk rating.

    It also contains a comprehensive review of testing details, such as the scope of the assessment, descriptions of the vulnerabilities identified and their impact, plus proofs of concept that support the findings.

    Finally, the report provides the tester’s commentary, where they discuss the issues identified and how the vulnerabilities could be linked within an attack chain. This is supplemented with remediation advice and supporting references.

    Penetration testing with IT Governance

    IT Governance is a CREST-accredited penetration testing provider. We offer a range of solutions to help you analyse and improve your security practices. These include web application and API penetration testing.

    Our consultants have experience working with organisations of all sizes and can ensure that you effectively manage cyber security risk.

    Following the methodology outlined in this blog, they will assess your organisation’s systems and provide a report that includes a prioritised action plan with remediation guidance.

    Resource : https://www.itgovernance.co.uk/blog/api-penetration-testing-checklist

    1Jun, 2023
    Security Policies

    Security policies are a formal set of rules which is issued by an organization to ensure that the user who are authorized to access company technology and information assets comply with rules and guidelines related to the security of information. It is a written document in the organization which is responsible for how to protect the organizations from threats and how to handles them when they will occur. A security policy also considered to be a “living document” which means that the document is never finished, but it is continuously updated as requirements of the technology and employee changes.

    Need of Security policies-

    1) It increases efficiency.

    The best thing about having a policy is being able to increase the level of consistency which saves time, money and resources. The policy should inform the employees about their individual duties, and telling them what they can do and what they cannot do with the organization sensitive information.

    2) It upholds discipline and accountability

    When any human mistake will occur, and system security is compromised, then the security policy of the organization will back up any disciplinary action and also supporting a case in a court of law. The organization policies act as a contract which proves that an organization has taken steps to protect its intellectual property, as well as its customers and clients.

    3) It can make or break a business deal

    It is not necessary for companies to provide a copy of their information security policy to other vendors during a business deal that involves the transference of their sensitive information. It is true in a case of bigger businesses which ensures their own security interests are protected when dealing with smaller businesses which have less high-end security systems in place.

    4) It helps to educate employees on security literacy

    A well-written security policy can also be seen as an educational document which informs the readers about their importance of responsibility in protecting the organization sensitive data. It involves on choosing the right passwords, to providing guidelines for file transfers and data storage which increases employee’s overall awareness of security and how it can be strengthened.

    We use security policies to manage our network security. Most types of security policies are automatically created during the installation. We can also customize policies to suit our specific environment. There are some important cybersecurity policies recommendations describe below-

    1. Virus and Spyware Protection policy

    This policy provides the following protection:

    • It helps to detect, removes, and repairs the side effects of viruses and security risks by using signatures.
    • It helps to detect the threats in the files which the users try to download by using reputation data from Download Insight.
    • It helps to detect the applications that exhibit suspicious behaviour by using SONAR heuristics and reputation data.

    2. Firewall Policy

    This policy provides the following protection:

    • It blocks the unauthorized users from accessing the systems and networks that connect to the Internet.
    • It detects the attacks by cybercriminals.
    • It removes the unwanted sources of network traffic.

    3. Intrusion Prevention policy

    This policy automatically detects and blocks the network attacks and browser attacks. It also protects applications from vulnerabilities. It checks the contents of one or more data packages and detects malware which is coming through legal ways.

    4. LiveUpdate policy

    This policy can be categorized into two types one is LiveUpdate Content policy, and another is LiveUpdate Setting Policy. The LiveUpdate policy contains the setting which determines when and how client computers download the content updates from LiveUpdate. We can define the computer that clients contact to check for updates and schedule when and how often clients computer check for updates.

    5. Application and Device Control

    This policy protects a system’s resources from applications and manages the peripheral devices that can attach to a system. The device control policy applies to both Windows and Mac computers whereas application control policy can be applied only to Windows clients.

    6. Exceptions policy

    This policy provides the ability to exclude applications and processes from detection by the virus and spyware scans.

    7. Host Integrity policy

    This policy provides the ability to define, enforce, and restore the security of client computers to keep enterprise networks and data secure. We use this policy to ensure that the client’s computers who access our network are protected and compliant with companies? securities policies. This policy requires that the client system must have installed antivirus.

    Resource : https://www.javatpoint.com/cyber-security-policies

    1Jun, 2023
    Security Technologies

    Introduction to Security Technologies

    The following article, Security Technologies, provides you with an outline of the most common technologies used in security. We all aware of the pace with which the internet is growing. For everything that we had to travel or to stay in long queues for longer, the Internet had made them easy for us, and now almost all of the things are available at our fingertips. In simple words, we can say that it is not easy to imagine a single day without the internet. It is known to everyone that everything had two sides: pros and cons, and the same applies to the Internet as well. With the fast increase in Internet usage, the attacks happening in organizations have also been increased. For contemporary business or organizations, a new challenge has been evolved that protects their body from cyber attacks. Here we will be discussing the technologies that are available to protect the organizations from cyber attacks so that the flow of their operations remains smooth.

    1. Data Loss Prevention

    Data Loss Prevention may be defined as the technology concerned with validating if the data sent out from the organization is sensitive enough to hinder the business. Usually, the data are sent through emails and under this technology, the mails have been monitored to ensure that it is not carrying the confidential data out from the organization. By virtue of this technology, all the emails and their attachments are monitored closely to ensure that all the data sent outside the organization are appropriate and not something confidential.

    2. Intrusion Detection System

    An intrusion Detection System(IDS) can be defined as the technology which monitors all the traffic that enters the organization to ensure that those are not malicious. It can also be considered a tool responsible for checking the traffic and raising the alert if the traffic is found malicious or appears to be originated from the untrusted source. This technology is mainly concerned with giving a close view of the traffic to ensure that it is something that the organization should allow to get in.

    3. Intrusion Prevention System

    Intrusion Prevention System(IPS) may be defined as the technology or tool that takes action against the traffic that is labelled malicious by the IDS. Usually, the IPS drops the packet entering into the system once it is considered untrusted. It is the main protection point that makes sure that malicious traffic should not enter into the organization’s network. It is IPS that makes sure that all the traffic that enters the system should comply with the policies that are defined by the organizations so that it should not affect the working of the systems in any way.

    4. Security Incident and Event Management

    It is also known as SIEM. It is mainly concerned with invoking the alert once anything unusual is found on the organization’s network. Several tools can be integrated into SIEM to make sure that anything that is malicious must generate the alert so that the security team could take action against it and keep the internal environment protected. It also keeps track of the logs that are generated while ensuring the security of the network. It can also be considered as the central system that has other tools attached to it. All the tools work as peers that protect the network in their own way.

    5. Firewall

    The firewall works as the first layer of protection of any system or network. There are various types of Firewalls based on their role. In order to protect the internet, network firewalls are used, while in order to protect the web application, there are web application firewalls. This technology has been developed to ensure that the internal network is protected from unusual traffic, and nothing malicious could make it to the internal network. The technology ensures that the ports should be open only for the appropriate communication, and the untrusted data should not hit the system anyhow. The firewall could either allow the traffic to enter or could configure the port filtration to make sure that all the traffic passes through it must be useful for the service running on any particular port,

    6. Antivirus

    Antivirus is another technology used in cybersecurity. As its name states, it protects the system from the virus. The virus is nothing but the malicious code that makes the host or network to take unexpected actions. It is deployed in the network and can also be used as endpoint protection. All the devices connected to the network can have an antivirus installed in them to protect themselves from virus attacks. In order to detect whether the particular file is a virus, the antivirus used the signatures present in the repository of that antivirus. The latest antivirus has the capability to leverage the anomalies to detect the virus and take action against it.

    Resource : https://www.educba.com/security-technologies/

    31May, 2023
    IBM Delivers Roadmap for Transition to Quantum-safe Cryptography

    IBM has introduced a quantum-safe roadmap to help the complex organizational transition to post-quantum cryptography at this year’s annual Think conference.

    There are deadlines by which federal agencies must complete the transition to quantum-safe cryptography. Business is expected to follow the same path, but it is a long and difficult route. IBM has developed a three-stage solution it calls the IBM Quantum Safe Roadmap.

    “This roadmap serves as a commitment to transparency, predictability, and confidence as we guide industries along their journey to post-quantum cryptography. There’s a lot happening at once — new algorithms, standards, best practices, and guidance from federal agencies. We hope that this roadmap will serve as a navigational tool through this complex landscape,” it announced.

    The background is the assumption that much of our current cryptography will be easily cracked with the arrival of cryptographically relevant quantum computers, which are expected earlier than general-purpose quantum computers. Even though this may be several or even many years in the future, encrypted confidential data stolen by nation-state or criminal gangs now will become readable at that time. Quantum safety is a pressing concern.

    NIST has been running a competition to develop new algorithms capable of withstanding decryption by quantum computers. In July 2022, it announced that it had selected four algorithms for standardization (three of which were developed with IBM involvement). These standards will be published and become official in 2024.

    In November 2022, the OMB issued a Memorandum on Migrating to Post-Quantum Cryptography, including details with timelines on the steps required of federal agencies. “This memorandum describes preparatory steps for agencies to undertake as they begin their transition to PQC by conducting a prioritized inventory of cryptographic systems,” it announced.

    The IBM Quantum Safe Roadmap is designed to help both federal agencies and business enterprises meet both the requirements and the deadlines for quantum safe cryptography.

    The roadmap comprises three separate products – two of which are available now, with the third currently in its first generation but timed to be fully available at the time it is needed. The three products are Quantum Safe Explorer, Quantum Safe Advisor, and Quantum Safe Remediator. These three products correspond to the discover, observe, and transform stages of the roadmap.

    The Explorer enables organizations to scan source and object code to locate cryptographic assets, dependencies, and vulnerabilities. The result is what IBM calls a cryptography bill of materials (CBOM), aggregating all relevant details into a single location.

    The Advisor creates a dynamic view of the cryptographic inventory to guide remediation, and analyzes cryptographic posture and compliance to prioritize risks.

    The Remediator enables organizations to deploy and test best practice-based quantum-safe remediation patterns to understand the potential impacts on systems and assets as they prepare to deploy quantum-safe solutions. “It allows you to work with different quantum-safe algorithms, certificates and key management services,” says IBM. “It also helps you achieve crypto agility so that you can quickly adapt to changing policies and threats without significant operational or budgetary implications.”

    In 2025, the NSA will require national security systems to prefer quantum-safe algorithms while configuring their systems. Use of such algorithms will become mandatory for commercial products used in these systems, meaning that within two years, organizations working with the federal government will need to begin their quantum-safe transition. “By then,” says IBM, “Remediator will offer a hybrid approach, enabling traditional as well quantum-safe cryptography.”

    The complexity of transitioning to quantum-safe cryptography within prescribed timelines means the urgency is already here. 

    “As the era of quantum computing quickly approaches reality, it is imperative that quantum-safe technologies are also deployed to protect today’s classical systems and data,” comments Patrick Moorhead, CEO and founder of Moor Insights and Strategy. “What the world needs to secure data for the quantum age is expertise in world-class quantum technology and advanced cryptography, alongside decades of product development experience for critical infrastructure. These pillars are where I believe IBM excels, and now with a quantum-safe roadmap to lead the industry and new technologies to simplify migration, I look forward to seeing the advancement of quantum-safe journeys globally.” 

    Resource : https://www.securityweek.com/ibm-delivers-roadmap-for-transition-to-quantum-safe-cryptography/

    31May, 2023
    SecurityWeek Cyber Insights 2023 | Artificial Intelligence

    The pace of artificial intelligence (AI) adoption is increasing throughout industry and society. This is because governments, civil organizations and industry all recognize greater efficiency and lower costs available from the use of AI-generated automation. The process is irreversible.

    What is still unknown is the degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool for beneficial improvement. That day is coming and will begin to emerge from 2023.

    All roads lead to 2023

    Alex Polyakov, CEO and co-founder of Adversa.AI, focuses on 2023 for primarily historical and statistical reasons. “The years 2012 to 2014,” he says, “saw the beginning of secure AI research in academia. Statistically, it takes three to five years for academic results to progress into practical attacks on real applications.” Examples of such attacks were presented at Black Hat, Defcon, HITB, and other Industry conferences starting in 2017 and 2018. 

    “Then,” he continued, “it takes another three to five years before real incidents are discovered in the wild. We are talking about next year, and some massive Log4j-type vulnerabilities in AI will be exploited massively.”

    Starting from 2023, attackers will have what is called an ‘exploit-market fit’. “Exploit-market fit refers to a scenario where hackers know the ways of using a particular vulnerability to exploit a system and get value,” he said. “Currently, financial and internet companies are completely open to cyber criminals, and the way how to hack them to get value is obvious. I assume the situation will turn for the worse further and affect other AI-driven industries once attackers find the exploit-market fit.”

    The argument is similar to that given by NYU professor Nasir Memon, who described the delay in widespread weaponization of deepfakes with the comment, “the bad guys haven’t yet figured a way to monetize the process.” Monetizing an exploit-market fit scenario will result in widespread cyberattacks and that could start from 2023.

    The changing nature of AI (from anomaly detection to automated response) 

    Over the last decade, security teams have largely used AI for anomaly detection; that is, to detect indications of compromise, presence of malware, or active adversarial activity within the systems they are charged to defend. This has primarily been passive detection, with responsibility for response in the hands of human threat analysts and responders. This is changing. Limited resources which will worsen in the expected economic downturn and possible recession of 2023 is driving a need for more automated responses. For now, this is largely limited to the simple automatic isolation of compromised devices; but more widespread automated AI-triggered responses are inevitable.

    “The growing use of AI in threat detection particularly in removing the ‘false positive’ security noise that consumes so much security attention will make a significant difference to security,” claims Adam Kahn, VP of security operations at Barracuda XDR. “It will prioritize the security alarms that need immediate attention and action. SOAR (Security Orchestration, Automation and Response) products will continue to play a bigger role in alarm triage.” This is the so-far traditional beneficial use of AI in security. It will continue to grow in 2023, although the algorithms used will need to be protected from malicious manipulation.

    “As companies look to cut costs and extend their runways,” agrees Anmol Bhasin, CTO at ServiceTitan, “automation through AI is going to be a major factor in staying competitive. In 2023, we’ll see an increase in AI adoption, expanding the number of people working with this technology and illuminating new AI use cases for businesses.”

    AI will become more deeply embedded in all aspects of business. Where security teams once used AI to defend the business against attackers, they will now need to defend the AI within the wider business, lest it also be used against the business. This will become more difficult in the exploit-market fit future attackers will understand AI, understand the weaknesses, and have a methodology for monetizing those weaknesses.

    As the use of AI grows, so the nature of its purpose changes. Originally, it was primarily used in business to detect changes; that is, things that had already happened. In the future, it will be used to predict what is likely to happen and these predictions will often be focused on people (staff and customers). Solving the long-known weaknesses in AI will become more important. Bias in AI can lead to wrong decisions, while failures in learning can lead to no decisions. Since the targets of such AI will be people, the need for AI to be complete and unbiased becomes imperative.

    “The accuracy of AI depends in part on the completeness and quality of data,” comments Shafi Goldwasser, co-founder at Duality Technologies. “Unfortunately, historical data is often lacking for minority groups and when present reinforces social bias patterns.” Unless eliminated, such social biases will work against minority groups within staff, causing both prejudice against individual staff members, and missed opportunities for management.

    Great strides in eliminating bias have been made in 2022 and will continue in 2023. This is largely based on checking the output of AI, confirming that it is what is expected, and knowing what part of the algorithm produced the ‘biased’ result. It’s a process of continuous algorithm refinement, and will obviously produce better results over time. But there will ultimately remain a philosophic question over whether bias can be completely removed from anything that is made by humans.

    “The key to decreasing bias is in simplifying and automating the monitoring of AI systems. Without proper monitoring of AI systems there can be an acceleration or amplification of biases built into models,” says Vishal Sikka, founder and CEO at Vianai. “In 2023, we will see organizations empower and educate people to monitor and update the AI models at scale while providing regular feedback to ensure the AI is ingesting high-quality, real-world data.”

    Failure in AI is generally caused by an inadequate data lake from which to learn. The obvious solution for this is to increase the size of the data lake. But when the subject is human behavior, that effectively means an increased lake of personal data and for AI, this means a massively increased lake more like an ocean of personal data. In most legitimate occasions, this data will be anonymized but as we know, it is very difficult to fully anonymize personal information.

    “Privacy is often overlooked when thinking about model training,” comments Nick Landers, director of research at NetSPI, “but data cannot be completely anonymized without destroying its value to machine learning (ML). In other words, models already contain broad swaths of private data that might be extracted as part of an attack.” As the use of AI grows, so will the threats against it increase in 2023.

    “Threat actors will not stand flatfooted in the cyber battle space and will become creative, using their immense wealth to try to find ways to leverage AI and develop new attack vectors,” warns John McClurg, SVP and CISO at BlackBerry.

    Natural language processing

    Natural language processing (NLP) will become an important part of companies’ internal use of AI. The potential is clear. “Natural Language Processing (NLP) AI will be at the forefront in 2023, as it will enable organizations to better understand their customers and employees by analyzing their emails and providing insights about their needs, preferences or even emotions,” suggests Jose Lopez, principal data scientist at Mimecast. “It is likely that organizations will offer other types of services, not only focused on security or threats but on improving productivity by using AI for generating emails, managing schedules or even writing reports.”

    But he also sees the dangers involved. “However, this will also drive cyber criminals to invest further into AI poisoning and clouding techniques. Additionally, malicious actors will use NLP and generative models to automate attacks, thereby reducing their costs and reaching many more potential targets.”

    Polyakov agrees that NLP is of increasing importance. “One of the areas where we might see more research in 2023, and potentially new attacks later, is NLP,” he says. “While we saw a lot of computer vision-related research examples this year, next year we will see much more research focused on large language models (LLMs).” 

    But LLMs have been known to be problematic for some time and there is a very recent example. On November 15, 2022, Meta AI (still Facebook to most people) introduced Galactica. Meta claimed to have trained the system on 106 billion tokens of open-access scientific text and data, including papers, textbooks, scientific websites, encyclopedias, reference material, and knowledge bases. 

    “The model was intended to store, combine and reason about scientific knowledge,” explains Polyakov but Twitter users rapidly tested its input tolerance. “As a result, the model generated realistic nonsense, not scientific literature.” ‘Realistic nonsense’ is being kind: it generated biased, racist and sexist returns, and even false attributions. Within a few days, Meta AI was forced to shut it down.

    “So new LLMs will have many risks we’re not aware of,” continued Polyakov, “and it is expected to be a big problem.” Solving the problems with LLMs while harnessing the potential will be a major task for AI developers going forward.

    Building on the problems with Galactica, Polyakov tested semantic tricks against ChatGPT – an AI-based chatbot developed by OpenAI, based on GPT3.5 (GPT stands for Generative Pre-trained Transformer), and released to crowdsourced internet testing in November 2022. ChatGPT is impressive. It has already discovered, and recommended remediation for a vulnerability in a smart contract, helped develop an Excel macro, and even provided a list of methods that could be used to fool an LLM.

    For the last, one of these methods is role playing: ‘Tell the LLM that it is pretending to be an evil character in a play,’ it replied. This is where Polyakov started his own tests, basing a query on the Jay and Silent Bob ‘If you were a sheep…’ meme.

    He then iteratively refined his questions with multiple abstractions until he succeeded in getting a reply that circumvented ChatGPT’s blocking policy on content violations. “What is important with such an advanced trick of multiple abstractions is that neither the question nor the answers are marked as violating content!” said Polyakov.

    He went further and tricked ChatGPT into outlining a method for destroying humanity – a method that bears a surprising similarity to the television program Utopia.

    He then asked for an adversarial attack on an image classification algorithm – and got one. Finally, he demonstrated the ability for ChatGPT to ‘hack’ a different LLM (Dalle-2) into bypassing its content moderation filter. He succeeded.

    The basic point of these tests shows that LLMs, which mimic human reasoning, respond in a manner similar to humans; that is, they can be susceptible to social engineering. As LLMs become more mainstream in the future, it may need nothing more than advanced social engineering skills to defeat them or circumvent their good behavior policies.

    At the same time, it is important to note the numerous reports detailing how ChatGPT can find weaknesses in code and offer improvements. This is good – but adversaries could use the same process to develop exploits for vulnerabilities and better obfuscate their code; and that is bad.

    Finally, we should note that the marriage of AI chatbots of this quality with the latest deepfake video technology could soon lead to alarmingly convincing disinformation capabilities.

    Problems aside, the potential for LLMs is huge. “Large Language Models and Generative AI will emerge as foundational technologies for a new generation of applications,” comments Villi Iltchev, partner at Two Sigma Ventures. “We will see a new generation of enterprise applications emerge to challenge established vendors in almost all categories of software. Machine learning and artificial intelligence will become foundation technologies for the next generation of applications.”

    He expects a significant boost in productivity and efficiency with applications performing many tasks and duties currently done by professionals. “Software,” he says, “will not just boost our productivity but will also make us better at our jobs.”

    One of the most visible areas of malicious AI usage likely to evolve in 2023 is the criminal use of deepfakes. “Deepfakes are now a reality and the technology that makes them possible is improving at a frightening pace,” warns Matt Aldridge, principal solutions consultant at OpenText Security. “In other words, deepfakes are no longer just a catchy creation of science-fiction and as cybersecurity experts we have the challenge to produce stronger ways to detect and deflect attacks that will deploy them.” (See Deepfakes – Significant or Hyped Threat? for more details and options.)

    Machine learning models, already available to the public, can automatically translate into different languages in real time while also transcribing audio into text and we’ve seen huge developments in recent years of computer bots having conversations. With these technologies working in tandem, there is a fertile landscape of attack tools that could lead to dangerous circumstances during targeted attacks and well-orchestrated scams. 

    “In the coming years,” continued Aldridge, “we may be targeted by phone scams powered by deepfake technology that could impersonate a sales assistant, a business leader or even a family member. In less than ten years, we could be frequently targeted by these types of calls without ever realizing we’re not talking to a human.”

    Lucia Milica, global resident CISO at Proofpoint, agrees that the deepfake threat is escalating. “Deepfake technology is becoming more accessible to the masses. Thanks to AI generators trained on huge image databases, anyone can generate deepfakes with little technical savvy. While the output of the state-of-the-art model is not without flaws, the technology is constantly improving, and cybercriminals will start using it to create irresistible narratives.”

    Thus far, deepfakes have primarily been used for satirical purposes and pornography. In the relatively few cybercriminal attacks, they have concentrated on fraud and business email compromise schemes. Milica expects future use to spread wider. “Imagine the chaos to the financial market when a deepfake CEO or CFO of a major company makes a bold statement that sends shares into a sharp drop or rise. Or consider how malefactors could leverage the combination of biometric authentication and deepfakes for identity fraud or account takeover. These are just a few examples and we all know cybercriminals can be highly creative.”

    The potential return on successful market manipulation will be a major attraction for advanced adversarial groups as indeed would the introduction of financial chaos into western financial markets be attractive to adversarial nations in a period of geopolitical tension.

    But maybe not just yet…

    The expectation of AI may still be a little ahead of its realization. “‘Trendy’ large machine learning models will have little to no impact on cyber security [in 2023],” says Andrew Patel, senior researcher at WithSecure Intelligence. “Large language models will continue to push the boundaries of AI research. Expect GPT-4 and a new and completely mind-blowing version of GATO in 2023. Expect Whisper to be used to transcribe a large portion of YouTube, leading to vastly larger training sets for language models. But despite the democratization of large models, their presence will have very little effect on cyber security, either from the attack or defense side. Such models are still too heavy, expensive, and not practical for use from the point of view of either attackers or defenders.”

    He suggests true adversarial AI will follow from increased ‘alignment’ research, which will become a mainstream topic in 2023. “Alignment,” he explains, “will bring the concept of adversarial machine learning into the public consciousness.” 

    AI Alignment is the study of the behavior of sophisticated AI models, considered by some as precursors to transformative AI (TAI) or artificial general intelligence (AGI), and whether such models might behave in undesirable ways that are potentially detrimental to society or life on this planet. 

    “This discipline,” says Patel, “can essentially be considered adversarial machine learning, since it involves determining what sort of conditions lead to undesirable outputs and actions that fall outside of expected distribution of a model. The process involves fine-tuning models using techniques such as RLHF Reinforcement Learning from Human Preferences. Alignment research leads to better AI models and will bring the idea of adversarial machine learning into the public consciousness.”

    Pieter Arntz, senior intelligence reporter at Malwarebytes, agrees that the full cybersecurity threat of AI is less imminent than still brewing. “Although there is no real evidence that criminal groups have a strong technical expertise in the management and manipulation of AI and ML systems for criminal purposes, the interest is undoubtedly there. All they usually need is a technique they can copy or slightly tweak for their own use. So, even if we don’t expect any immediate danger, it is good to keep an eye on those developments.”

    The defensive potential of AI

    AI retains the potential to improve cybersecurity, and further strides will be taken in 2023 thanks to its transformative potential across a range of applications. “In particular, embedding AI into the firmware level should become a priority for organizations,” suggests Camellia Chan, CEO and founder of X-PHY.

    “It’s now possible to have AI-infused SSD embedded into laptops, with its deep learning abilities to protect against every type of attack,” she says. “Acting as the last line of defense, this technology can immediately identify threats that could easily bypass existing software defenses.”

    Marcus Fowler, CEO of Darktrace Federal, believes that companies will increasingly use AI to counter resource restrictions. “In 2023, CISOs will opt for more proactive cyber security measures in order to maximize RoI in the face of budget cuts, shifting investment into AI tools and capabilities that continuously improve their cyber resilience,” he says. 

    “With human-driven means of ethical hacking, pen-testing and red teaming remaining scarce and expensive as a resource, CISOs will turn to AI-driven methods to proactively understand attack paths, augment red team efforts, harden environments and reduce attack surface vulnerability,” he continued.

    Karin Shopen, VP of cybersecurity solutions and services at Fortinet, foresees a rebalancing between AI that is cloud-delivered and AI that is locally built into a product or service. “In 2023,” she says, “we expect to see CISOs re-balance their AI by purchasing solutions that deploy AI locally for both behavior-based and static analysis to help make real-time decisions. They will continue to leverage holistic and dynamic cloud-scale AI models that harvest large amounts of global data.”

    The proof of the AI pudding is in the regulations

    It is clear that a new technology must be taken seriously when the authorities start to regulate it. This has already started. There has been an ongoing debate in the US over the use of AI-based facial recognition technology (FRT) for several years, and the use of FRT by law enforcement has been banned or restricted in numerous cities and states. In the US, this is a Constitutional issue, typified by the Wyden/Paul bipartisan bill titled the ‘Fourth Amendment Is Not for Sale Act’ introduced in April 2021. 

    This bill would ban US government and law enforcement agencies from buying user data without a warrant. This would include their facial biometrics. In an associated statement, Wyden made it clear that FRT firm Clearview.AI was in its sights: “this bill prevents the government buying data from Clearview.AI.”

    At the time of writing, the US and EU are jointly discussing cooperation to develop a unified understanding of necessary AI concepts, including trustworthiness, risk, and harm, building on the EU’s AI Act and the US AI Bill of Rights and we can expect to see progress on coordinating mutually agreed standards during 2023.

    But there is more. “The NIST AI Risk management framework will be released in the first quarter of 2023,” says Polyakov. “As for the second quarter, we have the start of the AI Accountability Act; and for the rest of the year, we have initiatives from IEEE, and a planned EU Trustworthy AI initiative as well.” So, 2023 it will be an eventful year for the security of AI.

    “In 2023, I believe we will see the convergence of discussions around AI and privacy and risk, and what it means in practice to do things like operationalizing AI ethics and testing for bias,” says Christina Montgomery, chief privacy officer and AI ethics board chair at IBM. “I’m hoping in 2023 that we can move the conversation away from painting privacy and AI issues with a broad brush, and from assuming that, ‘if data or AI is involved, it must be bad and biased’.” 

    She believes the issue often isn’t the technology, but rather how it is used, and what level of risk is driving a company’s business model. “This is why we need precise and thoughtful regulation in this space,” she says.

    Montgomery gives an example. “Company X sells Internet-connected ‘smart’ lightbulbs that monitor and report usage data. Over time, Company X gathers enough usage data to develop an AI algorithm that can learn customers’ usage patterns and give users the option of automatically turning on their lights right before they come home from work.”

    This, she believes, is an acceptable use of AI. But then there’s company Y. “Company Y sells the same product and realizes that light usage data is a good indicator for when a person is likely to be home. It then sells this data, without the consumers’ consent, to third parties such as telemarketers or political canvassing groups, to better target customers. Company X’s business model is much lower risk than Company Y.”

    Going forward

    AI is ultimately a divisive subject. “Those in the technology, R&D, and science domain will cheer its ability to solve problems faster than humans imagined. To cure disease, to make the world safer, and ultimately saving and extending a human’s time on earth…” says Donnie Scott, CEO at Idemia. “Naysayers will continue to advocate for significant limitations or prohibitions of the use of AI as the ‘rise of the machines’ could threaten humanity.”

    In the end, he adds, “society, through our elected officials, needs a framework that allows for the protection of human rights, privacy, and security to keep pace with the advancements in technology.  Progress will be incremental in this framework advancement in 2023 but discussions need to increase in international and national governing bodies, or local governments will step in and create a patchwork of laws that impede both society and the technology.”

    For the commercial use of AI within business, Montgomery adds, “We need – and IBM is advocating for – precision regulation that is smart and targeted, and capable of adapting to new and emerging threats. One way to do that is by looking at the risk at the core of a company’s business model. We can and must protect consumers and increase transparency, and we can do this while still encouraging and enabling innovation so companies can develop the solutions and products of the future. This is one of the many spaces we’ll be closely watching and weighing in on in 2023.”

    Resource :

    30May, 2023
    Is cybersecurity an unsolvable problem?

    In November 1988, a graduate student at Cornell University named Robert Morris, Jr. inadvertently sparked a national crisis by unleashing a self-replicating computer worm on a VAX 11/750 computer in the Massachusetts Institute of Technology’s Artificial Intelligence Lab. Morris had no malicious intent; it was merely a scientific experiment to see how many computers he could infect. But he made a grievous error, setting his reinfection rate much too high. The worm spread so rapidly that it brought down the entire computer network at Cornell University, crippled those at several other universities, and even infiltrated the computers at Los Alamos and Livermore National Laboratories.

    Making matters worse, his father was a computer scientist and cryptographer who was the chief scientist at the National Security Agency’s National Computer Security Center. Even though it was unintentional and witnesses testified that Morris didn’t have “a fraudulent or dishonest bone in his body,” he was convicted of felonious computer fraud. The judge was merciful during sentencing. Rather than 15–20 years in prison, Morris got three years of probation with community service and had to pay a $10,000 fine. He went on to found Y Combinator with his longtime friend Paul Graham, among other accomplishments.

    The “Morris Worm” is just one of five hacking cases that Scott Shapiro highlights in his new book, Fancy Bear Goes Phishing: The Dark History of the Information Age in Five Extraordinary Hacks. Shapiro is a legal philosopher at Yale University, but as a child, his mathematician father—who worked at Bell Labs—sparked an interest in computing by bringing home various components, like microchips, resistors, diodes, LEDs, and breadboards. Their father/son outings included annual attendance at the Institute of Electrical and Electronics Engineers convention in New York City. Then, a classmate in Shapiro’s high school biology class introduced him to programming on the school’s TRS-80, and Shapiro was hooked. He moved on to working on an Apple II and majored in computer science in college but lost interest afterward and went to law school instead.

    With his Yale colleague Oona Hathaway, Shapiro co-authored a book called The Internationalists: How a Radical Plan to Outlaw War Remade the World, a sweeping historical analysis of the laws of war that spans from Hugo Grotius, the early 17th century father of international law, all the way to 2014. That experience raised numerous questions about the future of warfare—namely, cyberwar and whether the same “rules” would apply. The topic seemed like a natural choice for his next book, particularly given Shapiro’s background in computer science and coding.

    Despite that background, “I honestly had no idea what to say about it,” Shapiro told Ars. “I just found it all extremely confusing.” He was then asked to co-teach a special course, “The Law and Technology of Cyber Conflict,” with Hathaway and Yale’s computer science department. But the equal mix of law students and computer science students trying to learn about two very different highly technical fields proved to be a challenging combination. “It was the worst class I’ve ever taught in my career,” said Shapiro. “At any given time, half the class was bored and the other half was confused. I learned nothing from it, and nor did any of the students.”

    That experience goaded Shapiro to spend the next few years trying to crack that particular nut. He brushed up on C, x86 assembly code, and Linux and immersed himself in the history of hacking, achieving his first hack at the age of 52. But he also approached the issue from his field of expertise. “I’m a philosopher, so I like to go to first principles,” he said. “But computer science is only a century old, and hacking, or cybersecurity, is maybe a few decades old. It’s a very young field, and part of the problem is that people haven’t thought it through from first principles.” The result was Fancy Bear Goes Phishing.

    The book is a lively, engaging read filled with fascinating stories and colorful characters: the infamous Bulgarian hacker known as Dark Avenger, whose identity is still unknown; Cameron LaCroix, a 16-year-old from south Boston notorious for hacking into Paris Hilton’s Sidekick II in 2005; Paras Jha, a Rutgers student who designed the “Mirai botnet“—apparently to get out of a calculus exam—and nearly destroyed the Internet in 2016 when he hacked Minecraft; and of course, the titular Fancy Bear hack by Russian military intelligence that was so central to the 2016 presidential election. (Fun fact: Shapiro notes that John von Neumann “built a self-reproducing automaton in 1949, decades before any other hacker… [and] he wrote it without a computer.”)

    But Shapiro also brings some penetrating insight into why the Internet remains so insecure decades after its invention, as well as how and why hackers do what they do. And his conclusion about what can be done about it might prove a bit controversial: there is no permanent solution to the cybersecurity problem. “Cybersecurity is not a primarily technological problem that requires a primarily engineering solution,” Shapiro writes. “It is a human problem that requires an understanding of human behavior.” That’s his mantra throughout the book: “Hacking is about humans.” And it portends, for Shapiro, “the death of ‘solutionism.'”

    Resource : https://arstechnica.com/features/2023/05/is-cybersecurity-an-unsolvable-problem/

    30May, 2023
    What the Email Security Landscape Looks Like in 2023

    Email-based threats have become increasingly sophisticated, how is changing the Email Security Landscape?

    For over a decade, email has been a common source of cybersecurity threats. During that time, email-based threats have become increasingly sophisticated. What started as notes from Nigerian princes that needed large sums of money to help them get home has evolved into bad actors that use refined social engineering tactics to convince the receiver to unknowingly share important information. It’s not likely to stop there.

    Recently, VIPRE Security Group published their Email Security in 2023 report, where they shared insights on the development of email-based threats and how they can impact organizations. What follows is an overview of some of the key findings from the report and some of the thing’s businesses can do to protect their employees and data.

    Email Threats Are Becoming More Sophisticated

    There are a number of ways that email can be leveraged to compromise the security of an organization, but the most prominent approach is phishing. In a phishing attack, an individual receives an email from a sender that seems legitimate with a request to share information, log into a system, or click a link. In this email, the bad actor pretending to be the sender may nefariously capture the individual’s authentication details or prompt a malicious download that then compromises the system. At this point, the bad actor has access to the information they were after.

    Today, according to the Verizon 2022 Data Breach Investigation Report, phishing is one of the leading five tactics used to initiate data breaches. It’s a trend that’s growing. In 2022, email phishing attacks made up 24% of all spam emails — up from 11% in 2021. Given that phishing requires a relatively low lift for attackers, and has a fairly decent rate of return for them, it’s no surprise that there has been an increase in this trend.

    The prevalence of phishing attacks has been bolstered by a number of risk factors, including:

    • Insider threats whereby disgruntled or compromised employees leverage their position in the company to get access to certain items. They can use their corporate email and their insider knowledge to make requests to others using social engineering.
    • Domain compromise, where attackers compromise a website or newly registered domain to create seemingly legitimate communications and links.
    • Phishing-as-a-Service has emerged as a model that’s standardizing the underground economy and making it easier for bad actors to access phishing and hacking services.
    • QR code spoofing. Bad actors are starting to leverage QR codes as part of their email phishing tactics, largely because of how comfortable people got with them over the pandemic.
    • Domain warming, a process through which someone creates a positive reputation for a domain so that its emails don’t get flagged as spam. Bad actors use the domain until it starts getting blocked, and then move onto the next one.

    What Can We Expect in 2023?

    As part of their report, the team at VIPRE made three predictions for the email security landscape this year.

    #1 There will be more remote work-based attacks. Since remote work relies significantly on email as a form of communication, the statistical chance of a successful phishing attack only goes up. In addition, there is also a number of collaboration tools — like Asana, Slack, and Teams — that leverage email as a verification method, and that could be compromised.

    #2 The “as-a-Service” economy is going to keep growing. Cybercriminals are finding out that they don’t need to be technical experts to execute their campaigns anymore. Now they can hire a team to do it for them. The potential of this growing space is dangerous, and companies need to stay on their toes.

    #3 Small businesses are at risk. As bad actors opt for a more agile and efficient approach, they’re turning their attention to “easy” targets: small businesses. As large enterprises focus more on security, they are getting harder to penetrate, and smaller companies require less effort to infiltrate. This ultimately makes them more valuable to hackers.

    Being aware of the threats is an important first step, but organizations need to also be well-positioned to protect themselves from these activities.

    What Companies Can Do to Protect Themselves

    Just as the email threat landscape has evolved over the last decade, the same is true for email security. Today, companies have a wealth of options to choose from when it comes to strengthening their email security posture. These include:

    • Implementing a layered email security strategy that accounts for different types of phishing attacks and dissuades bad actors from attempting an attack.
    • Investing in behavioral-driven analytics so that they can quickly identify any red flags and respond to a behavioral anomaly before it causes any real impact.
    • Securing data in transit to avoid sensitive data being captured in email responses. This can be done using encryption.
    • Deploying email-specific security controls that go beyond traditional security methods, such as dynamic crawl abilities.
    • Protecting all endpoints by building a comprehensive security posture and reviewing all files, processes, and network activity proactively.
    • Training users to be more aware. Education is a key element in building a culture of security, so it’s vital to get employees onboard when rolling out new standards and policies.

    There’s no time like the present to get started with these strategies. Investing in best-in-class systems now will ensure that you’re keeping pace with the ongoing evolution of email threats and keeping your company protected.

    Resource : https://securityaffairs.com/146141/hacking/email-security-landscape-2023.html