• Search for:
    15Mar, 2023
    How AI can ease those data management woes

    Data is the new oil, but raw data is no good in and of itself. Like oil, data assets have to be gathered entirely and accurately and sent through different refining processes to create value for end users. This is the general data lifecycle — an area where artificial intelligence (AI) is going to play a major role for enterprises.

    Initially, managing the data lifecycle was a task small enough to be handled manually by a team of experts. The volume of information was not that much, the sources were just a handful and the possible applications were also limited. But with the transition to the cloud, and the introduction of new sources, both the volume and diversity of data have surged.

    “Data management is no longer wholly focused on relational data,” Adam Ronthal, research VP in Gartner’s ITL data and analytics group, told VentureBeat. “Document, graph, time-series, wide-column, key-value, ledger and other targeted data stores all provide specific optimizations for different types of data, and different use cases. Sometimes, these are combined in a single data management platform — a multimodel database; sometimes, they remain as best-fit, targeted point solutions.”

    This increase in volume and diversity of information has rendered traditional ways of data management ineffective. Today, a company that selects, manages and optimizes (cleaning and enhancing) each dataset component individually will end up wasting a lot of time — cleaning and transformation alone can take days or weeks — and capital.

    The situation is comparable to Yahoo having used human experts to manually evaluate and catalog a deluge of web pages. The company dedicated plenty of resources but could evaluate only a small portion of the internet and struggled to keep the evaluations up to date.

    Bringing AI into data management

    Just as Google with its automated algorithms took over internet domination from Yahoo, evaluating web pages more quickly and at vastly lower cost, today AI is set to revolutionize the data lifecycle.

    According to Ronthal, applications of AI in data management rely on metadata analysis and activation. This allows the model to detect deviations in data usage from system design and (ideally automatically) correct them. This is augmented data management: using AI/ML to automate and optimize data management, allowing organizations to spend less time managing and optimizing infrastructure and more time building core business value.

    Many organizations have already started using AI- and ML-driven techniques to touch various components of data management, bringing improvements in speed and cost-efficiency.

    For instance, in January 2023, Google and Aible, a company bringing an AI-first approach to the data journey, worked with a Fortune 500 enterprise and enabled it to analyze over 75 datasets with over 100 million rows of data across 150 million variable combinations. The total compute cost: $80, less than a thousandth of the cost of traditional methods.

    Aible also published 25 case studies with Intel highlighting how enterprises across geographies and verticals benefitted from AI in less than 30 days and drove value across functions.

    Overall, Ronthal notes, AI augmentation can have an impact on multiple disciplines of data management, including:

    • Metadata management: Here, AI and ML can be used to explore and define the data’s metadata, evaluating metadata faster and more accurately, with reduced redundancy. Similarly, augmented data management functions can automatically catalog data elements during data extraction, access and processing.
    • Data integration: AI can be used to automate the integration development process, by recommending or deploying repetitive integration flows, such as source-to-target mappings.
    • Data quality: AI and ML can be used to extend profiling, cleansing, linking, identifying and semantically reconciling master data in different data sources.
    • DBMS: In addition to enhancing performance and cost-based query optimization, AI and ML can automate many current manual management operations, including managing configurations, elastic scaling, storage, indexes and partitions, and database tuning.
    • FinOps: AI and ML can be applied to budget and cost optimization problems and make recommendations about resource usage, pricing models, and second- and third-order effects of making changes in highly interconnected environments.

    Priya Krishnan, head of product management for data and AI at IBM, highlighted similar applications.

    “AI is being used to ingest, identify and classify datasets from a variety of sources,” she said. “It continuously mines content to surface unseen patterns and trends, providing organizations with greater visibility and actionable insights to aid in decision-making. Businesses are using AI to automate otherwise manual tasks like data capture, de-duplication, anomaly detection and data validation. They are also training models to apply regulatory policies and ethical standards automatically, ensuring those principles are embedded from the beginning.”

    Resource : https://venturebeat.com/data-infrastructure/how-ai-can-ease-data-management-woes/

    14Mar, 2023
    NASA To Measure Forest Health from Above

    In places across the U.S., tree cover is shrinking – forests are burned by wildfires on the West Coast and drowned by rising sea levels along the East. From the ground, it’s hard to assess the scale of the losses and the effects disappearing trees have on atmospheric carbon dioxide levels and climate change.

    NASA research scientist Jon Ranson is working to improve new technologies for studying trees from above, so future Earth-observing missions can more accurately assess forest health.

    “Trees do a huge service for the planet, in terms of sequestering carbon dioxide, taking it out of the atmosphere and putting it into wood,” Ranson said, “but trees are very sensitive to our changing climate. We’re trying to see the changes going on in forest ecosystems. If you detect things early enough, you might be able to do something about it.”

    When measured from aircraft and satellites, the wavelengths of light reflected by plants tell scientists about the amount of photosynthesis occurring, and therefore how much atmospheric carbon dioxide trees take up and store. The current standard for studying vegetation is called NDVI, or Normalized Differential Vegetation Index, which is the average of two broad portions of the infrared spectrum. NASA’s NDVI record goes back 40 years, providing a low-resolution but accurate picture of forest health.

    While NDVI is good at assessing vegetation quantity and vigor broadly, Ranson said, breaking down infrared and visible light into many more wavelengths, a technology called hyperspectral imaging, can provide insight on plants’ water content, chlorophyll and even changes in health. 

    “Vegetation has these broad spectral properties,” said Ian Adams, Earth Sciences Division Technologist at NASA’s Goddard Space Flight Center. “With hyperspectral imaging, you get lots of different measurements at smaller, closer together frequencies. There is a lot more information we can pull out if we can get better spectral resolution.”

    By dramatically increasing the number of frequencies available for researchers to study, Ranson’s work serves the priorities of the National Academies of Science’s most recent Earth Science decadal survey, which determines the field’s long-term priorities. The survey lists “surface topography and vegetation,” including forests, as a key area of study in need of more advanced technology.

     “Strategically for NASA, and more broadly for the remote sensing community, hyperspectral is one of the areas we see as the future,” Adams said.

    To make use of hyperspectral imaging by future orbital missions, data analysis techniques are first proven closer to the ground.

    Ranson’s team fitted a Skyfish drone (UAV) from partner institution Virginia Tech with a visible and infrared (VIS/IR) hyperspectral camera and lidar equipment. They flew the imaging equipment over forests near Blacksburg, VA, in a region called Mountain Lake. Comparing their UAV observations with actual CO2 levels recorded by sensors on a nearby National Ecological Observatory Network tower, Ranson’s team was able to refine calculations about how much carbon the forest removed from the atmosphere.

    These comparisons allowed them to further refine techniques for interpreting the hyperspectral data. For instance, Plants stressed by too much sunlight may release pigments to shield their chloroplasts, a condition his sensors can detect. If plants get too much shade, they may grow leaves with larger surface-areas, which can cause the sensor to overestimate plant productivity. Ranson wants to add short-wave infrared sensors to better distinguish reflections from leaves and other parts of plants, eliminating another possible source of error.

    The view from space: Seeing the forest for the trees

    Ranson’s goal is to study forests on a global scale from space.

    “We’re trying to get the complete picture,” Ranson said. “So that when we go to space, we know how to find the answer to the question, ‘Are our forests healthy? And if not, why not?’”

    Scientists and engineers at Goddard have been developing a mission concept called Concurrent Artificially intelligent Spectrometry and Adaptive Lidar System, or CASALS. If selected, CASALS would send a satellite with lidar and hyperspectral cameras into space. A constellation of such satellites could take the frequent measurements necessary to assess changes in forest productivity over time, using models perfected by Ranson’s UAV flights.“Forests take up as much carbon as the ocean does, yet forests cover only 9 percent of Earth’s surface,” said Ranson. “So, if something goes wrong with our forests, it’s a dramatic issue. We’ve got this great, great resource in forests, and we need to care for them so they’ll care for us.”

    Resource : https://www.nasa.gov/feature/nasa-to-measure-forest-health-from-above

    14Mar, 2023
    Advancing Women in Cybersecurity – One CMO’s Journey

    The number of women in cybersecurity is on the rise. Recent research finds women hold 25% of cybersecurity jobs globally in 2022, up from 20% in 2019, and projected to reach 30% by 2025 and 35% by 2031. While the trend is moving in the right direction, women are still underrepresented. As an industry, we are leaving untapped talent on the table which we can ill-afford to do given the ongoing cybersecurity workforce gap.

    March is Women in Cybersecurity month and March 8 is International Women’s Day. So, I thought I’d take the opportunity to speak with a woman who has grown up in cybersecurity, Anna Tutt, CMO of Oort, to share her experiences and get her perspective on how we can help accelerate this growth.

    How did you get into cybersecurity? I started my career in the technology consulting space. But I quickly moved into cybersecurity when I was recruited by Sourcefire to do revenue operations rollout which was my background. In that role, I worked with all parts of the organization—sales, marketing, executive management—and got to grow quickly into a global programs role before the company was acquired by Cisco. Sourcefire was a great experience as a beginner in cybersecurity. I was surrounded by great mentors and industry leaders who I learned a tremendous amount from. I got hooked on the high growth environment and have used that to drive me in my career going forward. Every company I’ve joined since has been in a different area of cybersecurity. From the network to threat intelligence and OSINT, and most recently identity security. Each time, I’ve jumped into a whole new world I’ve had to learn.

    What do you see as the greatest challenges the industry faces right now? The environment we operate in is super noisy. I feel this as a marketing professional – with all the vendors out there it’s hard to know where to start – and security practitioners feel this too. The outcome of that is that you have security teams spinning their wheels, responding to red flags across all their systems and not working efficiently. And organizations are missing the basics. Last year 80% of hacking-related breaches used stolen and/or weak passwords, according to the Verizon 2022 Data Breach Investigations Report. We’re leaving the front door open. That’s why I joined Oort. I believe that identities are the easiest way in, and the most often ignored attack surface. Helping companies get a complete view of their identities is critical in order to stop account takeover and eventually moving towards zero trust.

    What uniquely valuable insights or perspectives do you think women bring to cybersecurity? Women often have an innate ability to multi-task and organize so we can get our arms around a lot, which is important in this profession. We also bring additional perspective and creativity which can help drive different solutions. Criminals are coming up with creative ways to attack us and we need creative ways to prevent them. Finally, empathy is very important. Being able to keep the customer in mind and humanize challenges changes discussions and helps us connect to our audiences better, which creates a win-win for vendors and users.

    There’s a lot of FUD out there. What makes you optimistic about the war on cybercrime?
    Despite all the economic uncertainty this year, cybersecurity is proving to still be a priority. Companies are still planning to invest in additional security technologies and services. And vendors are getting funding to come up with creative ways to solve problems. I think that’s a testament to how much innovation and need there is in this space. At the end of the day there are more good guys than bad guys, and as long as the good guys keep investing and getting funding to fight against it, the bad guys are going to be on their back foot.

    What advice can you share with women thinking about getting into cybersecurity or still early in their careers? First, even if you’re not in a technical role, invest in building up your cyber acumen. The more you understand how security teams operate, the better you can do your job. Second, trust your gut when joining a company and know your worth. Women tend to go in with imposter syndrome. Do your homework and go in prepared and confident. And third, find a trusted resource – a mentor or two you can turn to for advice navigating opportunities and challenges and setting boundaries. I’ve been lucky to have great mentors in my career who have really helped me. Hold onto these people. 

    The theme for International Women’s Day is #EmbraceEquity. Do you have any advice for employers on recruiting and retaining women? Here again, I have gotten lucky and have found that the most successful employers are those that understand their values, define their policies and then live those values. Make diversity integral to your culture, talk about your policies in the interview process so candidates don’t have to ask and, starting at the top, walk the walk. If you don’t do these things, you risk ignoring a huge population that is wondering if you are looking at them differently. When you can leave those questions at the door, you can talk about what is important.

    Resource : https://www.securityweek.com/advancing-women-in-cybersecurity-one-cmos-journey/

    13Mar, 2023
    Girl With ‘AI Earrings’ in Dutch Museum Sparks Fierce Art Controversy Over Use of Artificial Intelligence

    At first glance it seems to be just a modern take on Johannes Vermeer’s masterpiece “Girl with a Pearl Earring”. But look more closely and things get a little strange.

    Firstly, there are two glowing earrings in the image hanging in the Mauritshuis museum in the Dutch city of The Hague. And aren’t those freckles on her face actually… a slightly inhuman shade of red?

    That’s because the work — one of several fan recreations replacing 1665 original while it’s on loan for a huge Vermeer show at Amsterdam’s Rijksmuseum — was made using artificial intelligence (AI).

    Its presence has sparked a fierce debate, with questions over whether it belongs in the hallowed halls of the Mauritshuis — and whether it should be classed as art at all.

    “It’s controversial, so people are for it or against it,” Mauritshuis press officer Boris de Munnick told AFP.

    “The people who selected this, they liked it, they knew that it was AI, but we liked the creation. So we chose it, and we hung it.”

    – ‘Incredible insult’ –

    Berlin-based digital creator Julian van Dieken submitted the image after Mauritshuis asked people to send in their versions of the famous painting for an installation called “My Girl with a Pearl”.

    Van Dieken said he had used the AI tool Midjourney — which can generate complex pictures on the basis of a prompt, using millions of images from the internet — and Photoshop.

    The Mauritshuis then chose it as one of five images out of 3,482 submitted by fans that would be printed and physically hung in the room where “Girl with a Pearl Earring” is normally housed.

    “It’s surreal to see it in a museum,” van Dieken wrote on Instagram.

    The budding artists ranged in age from three to 94, depicting the “Girl” in diverse styles ranging from a puppet to a dinosaur and a piece of fruit. 

    But the decision to choose an AI-generated image sparked a backlash.

    One artist said on the Instagram feed for the Mauritshuis exhibition that it was a “shame and an incredible insult”, and dozens of others piled in.

    A common complaint was that AI tools can breach the copyright of other artists by using their works as the base for artificially generated images.

    Artist Eva Toorenent, of the European Guild for Artificial Intelligence Regulation, criticised what she called “unethical technology”.

    “Without the work of human artists, this program could not generate works at all,” she was quoted as saying by the Dutch newspaper De Volkskrant.

    – ‘What is art?’ –

    “It’s such a difficult question — what is art, and what is not art?” said the Mauritshuis’s de Munnick.

    But he insisted that the museum, whose collection boasts three Vermeers and nearly a dozen Rembrandts, had not deliberately set out to make an artistic statement on AI.

    “Our opinion is, we think it’s a nice picture, we think it’s a creative process,” he said. “We’re not the museum to discuss if AI belongs in an art museum.”

    He admitted though that “up close, you see that the freckles are a little spooky.”

    Visitors to the Mauritshuis were equally divided, he added.

    “Younger people tend to say, it’s artificial intelligence, what’s new. Elderly people sometimes say we like the more traditional paintings.”

    The Mauritshuis were looking forward to the return of the real “Girl” in April, he added. The painting’s fame has increased in recent years due to a 1999 novel by US author Tracy Chevalier and an ensuing Hollywood film.

    “Well, she is beautiful in the (Rijksmuseum) exhibition… But we will be very happy when she is at home.”

    Resource : https://www.gadgets360.com/internet/news/girl-with-a-pearl-earring-ai-recreation-julian-van-dieken-criticism-mauritshuis-exhibit-johannes-vermeer-3850111

    13Mar, 2023
    AI is taking phishing attacks to a whole new level of sophistication

    92% of organizations have fallen victim to successful phishing attacks in the last 12 months, while 91% of organizations have admitted to experiencing email data loss, according to Egress

    Not surprisingly, 99% of cybersecurity leaders confess to being stressed about email security. Specifically, 98% are frustrated with their Secure Email Gateway (SEG), with 53% conceding that too many phishing attacks bypass it.

    “The growing sophistication of phishing emails is a major threat to organizations and needs to be urgently addressed,” said Jack Chapman, VP of Threat Intelligence, Egress. “The signature-based detection used by Microsoft 365 and secure email gateways (SEGs) can filter out many phishing emails with known malicious attachments and links, but cybercriminals want to stay one step ahead. They are evolving their payloads and increasingly turning to text-based attacks that utilize social engineering tactics and attacks from a known or trusted source, such as a compromised supply chain email address.”

    “Unfortunately, phishing attacks will only become more advanced in the future, as cybercriminals use AI-powered technologies, such as chatbots, to automate and improve their attacks, such as adding video and voice capabilities to text-based phishing,” Chapman concluded.

    Inbound and outbound email security

    The report investigates both inbound phishing attacks and outbound data loss and exfiltration, highlighting the importance of a holistic approach to email security.

    Interestingly, 71% of surveyed cybersecurity leaders view inbound and outbound email security as a unified issue to tackle, recognizing their interconnected nature. The survey goes on to examine the technical controls and security awareness and training (SA&T) programs in place to reduce email security risk.

    Sophistication of phishing emails cause major financial losses

    86% of surveyed organizations reported that they were negatively impacted by sophistication of phishing emails, and 54% suffered financial losses due to customer churn following a successful phishing attack.

    Additionally, 40% of incidents resulted in employees leaving the organization. Cybersecurity leaders found that 85% of successful account takeover (ATO) attacks began with a phishing email.

    Risky behavior lead to costly data loss

    The survey found that people making mistakes or taking risks to accomplish their tasks are more common than malicious insiders. In fact, 91% of cybersecurity leaders surveyed reported that data had been leaked externally by email.

    The top three causes for these incidents include reckless or risky employee behavior, such as transferring data to personal accounts for remote work, human error, including employees emailing confidential information to incorrect recipients, and malicious or self-serving data exfiltration, such as taking data to a new job.

    Furthermore, 49% of organizations surveyed experienced financial losses from customer churn following a data loss incident, and 48% of incidents resulted in employees leaving the organization.

    Too many phishing emails bypassing employee inboxes

    58% of cybersecurity leaders believed their SEG was not effective in preventing employees from accidentally emailing the wrong person or with the wrong attachment.

    Additionally, 53% of respondents reported too many phishing emails still made it to employees’ inboxes, while 50% of organizations found it takes a lot of administrative time to manage their SEG.

    Security awareness and training

    Although 98% of the surveyed organizations conducted some form of Security Awareness and Training (SA&T), 96% of them expressed concerns or limitations with their SA&T programs.

    59% of organizations reported that SA&T is necessary for compliance with regulations or cyber insurance, and 46% of organizations reported that employees tend to skip through SA&T as fast as possible.

    Additionally, 37% of organizations admitted they lack confidence that employees remember what they have been taught during SA&T, and 29% of organizations reported that employees find SA&T to be annoying.

    Email security is a necessity for stoping phishing attacks

    The report highlights that people need real-time teachable moments that alert them to threats and engage them at the point of risk to tangibly reduce the number of security incidents that occur.

    Data throughout the report highlights that advanced email security is a necessity for everyday business. Despite investments in traditional email security and SA&T, surveyed organizations remain highly vulnerable to phishing attacks, human error, and data exfiltration.

    The only way to change the situation is to use intelligent email security solutions that augment traditional SEGs and Microsoft 365, offering the defense-in-depth required with a layered security approach.

    Resource : https://www.helpnetsecurity.com/2023/03/08/sophistication-of-phishing-emails/?web_view=true

    7Mar, 2023
    AI is making a long-running scam even more effective

    You’ve no doubt heard of the scam where the perpetrator calls up an elderly person and pretends to be their grandchild or some other close relative. The usual routine is to act in a distressed state, pretend they’re in a sticky situation, and ask for an urgent cash transfer to resolve the situation. While many grandparents will realize the voice isn’t that of their grandchild and hang up, others won’t notice and, only too keen to help their anxious relative, go ahead and send money to the caller’s account.

    A Washington Post report on Sunday reveals that some scammers have taken the con to a whole new level by deploying AI technology capable of cloning voices, making it even more likely that the target will fall for the ruse.

    To launch this more sophisticated version of the scam, criminals require “an audio sample with just a few sentences,” according to the Post. The sample is then run through one of many widely available online tools that use the original voice to create a replica that can be instructed to say whatever you want simply by typing in phrases.

    Data from the Federal Trade Commission suggests that in 2022 alone, there were more than 36,000 reports of so-called impostor scams, with more than 5,o00 of these happening over the phone. Reported losses reached $11 million.

    The fear is that with AI tools becoming more effective and more widely available, even more people will fall for the scam in the coming months and years.

    The scam still takes some planning, however, with a determined perpetrator needing to find an audio sample of a voice, as well as the phone number of the related victim. Audio samples, for example, could be located online via popular sites like TikTok and YouTube, while phone numbers could also be located on the web.

    The scam can take many forms, too. The Post cites an example where someone pretending to be a lawyer contacted an elderly couple, telling them their grandson was in custody for an alleged crime and that they needed more than $15,000 for legal costs. The bogus lawyer then pretended to hand the phone to their grandson, whose cloned voice pleaded for help to pay the fees, which they duly did.

    They only realized they’d been scammed when their grandson called them later that day for a chat. It’s thought the scammer may have cloned his voice from YouTube videos that the grandson posted, though it’s hard to be sure.

    Some are calling for the companies who make the AI technology that clones voices to be held responsible for such crimes. But before this happens, it seems certain that many others will lose money via this nefarious scam.

    To listen to an example of a cloned voice to see just how close to the original it can get, check out this Digital Trends article.

    Resource : https://www.digitaltrends.com/computing/ai-making-long-running-scam-more-effective/

    7Mar, 2023
    LastPass Says Hackers Targeted Employee’s Home PC to Access Secure Servers

    LastPass has been in the news a lot lately, and not because it’s the internet’s number one password manager, as it still proudly proclaims. The company is still reeling from a series of hacks last year that resulted in a trove of user data being stolen. This week, LastPass released new details of the attacks, explaining that the attacker targeted a senior LastPass engineer to gain access to the sensitive internal information that made the data theft possible.

    Problems started for LastPass in August 2022 when it notified users of a “security incident” involving proprietary company information. It said at the time that no user data was accessed, but in November, it announced a second attack that did target the passwords and other sensitive data people had stored on LastPass’ servers. The threat actor leveraged data stolen in the first phase of the attack in August, but how did they get that data in the first place? Well, it’s not pretty.

    LastPass explains in the latest investigation update that the attackers targeted a senior engineer at the company; one of only four people with access to the LastPass corporate vault. The employee in question was working from home, and their employer did not enforce any access restrictions. The DevOps engineer was accessing sensitive company data using a personal computer, which also ran a “media software package.” Other sources claim the media software in question is Plex, which reported a data breach around the same time. Using an undocumented vulnerability in the media software, the attacker installed a keylogger and waited for the engineer to enter the master password and two-factor code.

    That operation gave the threat actor the keys to the kingdom; they obtained decryption keys for the company’s AWS-hosted backups, including critical databases and other resources. Because of the way LastPass had implemented access auditing, nothing seemed amiss at first. The company didn’t know about the second attack until Amazon alerted it to unusual activity on the account. The attacker made off with user vaults that are only partially encrypted. The password data is secure, but the vaults include plain text URLs, emails, and IP addresses. Worse still, the passwords are only protected by the user’s master password, which could be weak on older accounts.

    In addition to the updated blog post, LastPass has published a rundown of all the data lost in the attacks. The company also provides a list of changes made to its security setup, but this is far from the first security issue for LastPass. It suffers a data breach of some sort almost every year, and it always says it has improved its security afterward. Perhaps LastPass, with millions of user passwords, is just too tempting a target. If you’ve got a LastPass account, it might be time to reevaluate.

    Resource : https://www.extremetech.com/internet/343423-lastpass-says-hackers-targeted-employees-home-pc-to-access-secure-servers

    4Mar, 2023
    Cybersecurity trends for 2023 and what to expect

    The rapid proliferation of new attack surfaces means more opportunities for threat actors than ever before, and this will only continue as new technologies are introduced, according to Vulcan Cyber’s Cyber Risk in 2022: A 360° View report.

    The report, developed by the Vulcan Cyber in-house research team, Voyager18, highlights the biggest developments and underlying narratives to cyber risk in 2022 and suggests ways to improve and maintain security posture as we enter 2023. According to the report, organizations need to be aware of the following seven trends in 2023:

    1. More attacks in the cloud

    Security in the cloud remains immature, with default cloud services often providing inadequate essential security functions. Threat actors are keenly aware of this, and security teams must keep up with their organizations’ appetite for cloud adoption.

    2. Mobile security attack surface

    With around two-thirds of the world’s population using smart devices as of 2021, it is no surprise that mobile is fast emerging as a major target for threat actors. Attackers leverage easy opportunities in e-commerce, banking and online booking applications. With mobile devices not going anywhere soon, this attack surface will only continue to grow.

    3. Threat actors turn to iot

    Expect to see more sophisticated and targeted attacks on Internet of Things (IoT) devices and a greater range of malicious actors targeting this technology in their attacks.

    4. Healthcare sector at risk

    The healthcare sector is increasingly vulnerable with more patient data being stored online and in the cloud, and the residual impact of the COVID-19 pandemic on healthcare services.

    5. AI in security efforts

    A welcome development for 2023 will be the increased implementation of advanced machine learning and other artificial intelligence (AI) techniques in identifying and responding to threats.

    6. Users as an attack surface

    An organization’s user base will remain a primary target, with threat actors leveraging phishing, social engineering, and other techniques to try to compromise the organization’s employees and their customers.

    7. Diversified cyber risk requires a better solution

    With the avenues of attack growing in number, IT security teams cannot rely on outdated methods to stay secure.

    The report explores a number of ways organizations can meet the increased demands of the cyber risk landscape, including:

    • Making employees part of the company’s security defense
    • Keep patches up to date
    • Restrict unnecessary access
    • Implement multi-factor authentication
    • Follow industry best practices

    Resource : https://www.securitymagazine.com/articles/98916-cybersecurity-trends-for-2023-and-what-to-expect#:~:text=AI%20in%20security%20efforts,identifying%20and%20responding%20to%20threats.

    4Mar, 2023
    Password manager security: Which is the right option for me?

    The first guide of our two-part series helps consumers choose the best way to manage their login credentials

    While we continue to wait for the long-awaited password-less future to arrive, individuals and enterprises are still stuck with the problem of how to manage their countless, proliferating login credentials.

    Whether they allow browsers to save passwords, rely on Apple’s Keychain or another operating system utility, or trust a dedicated app, most people and organizations now use some form of password management utility.

    A password manager creates an encrypted vault that securely stores credentials. These are protected by a master password.

    Most consumer-focused apps can also create unique, random passwords and support safe credential sharing between friends and family members.

    Some also contain extra perks such as detecting reused passwords and monitoring your accounts for possible data breaches.

    Given the differences in functionality and pricing tiers, The Daily Swig is offering a comparative, two-part guide to some of the most popular password management utilities available for consumers and businesses.

    This article, part one of our series, looks at consumer password manager options, while part two will showcase some of the best choices for enterprises. Stay tuned for the forthcoming second guide.

    1Password

    1Password offers an easy sign-up process and printable digital key for recovering your account in case you forget your master password.

    The application has apps for macOS, Windows, Linux, Android, and iOS as well as a Chrome extension that enables a user to auto-fill login information on websites and store new credentials in their vault.

    The tool allows you to create multiple vaults to organize your data for various purposes (personal, work, etc). In addition to login information, you can use 1Password to store credit card information, API tokens, crypto wallet recovery seeds, and other sensitive documents or data.

    The password manager also allows you share to passwords with other users. You can tweak the sharing feature by setting expiry dates, maximum number of views, and specific email addresses that can access a password.

    1Password’s Watchtower feature monitors your account for reused passwords, vulnerable passwords, and potentially compromised accounts.

    The application also has a Travel Mode for special circumstances where your devices might fall into unwanted hands. Vaults that you mark as not safe for travel will disappear from your devices when you turn on Travel Mode and reappear when you turn the feature and re-connecvt to the internet.

    The password manager offers no free-of-charge plan and instead offers personal ($2.99 per month) and family ($4.99 per month) subscriptions. With the family subscription, you get five premium accounts and the ability to create shared vaults that you can use together.

    Bitwarden

    Bitwarden offers a full range of standard features including the ability to import data from other password managers, creating multiple vaults, sharing passwords with other users, and syncing vaults across multiple devices. It has apps for all major operating systems, extensions for nine different browsers, and a command-line interface for writing scripts.

    One feature that sets Bitwarden apart is its strong free-tier option, which provides features that most users typically need. The premium subscription ($10 per year) also adds security reports, stronger 2FA (two-factor authentication) options, 1GB of encrypted storage, a OTP (one-time password) generator, and emergency access to your vault by other (nominated) Bitwarden users.

    Bitwarden also has a family plan ($40 per year) with six accounts, shared password collections, and shared encrypted storage.

    Bitwarden is an open source program, which means you can host it on your own servers if company or industry regulations prevent you from storing your credentials in the public cloud. However, to get the full range of features, you’ll need to purchase a premium license.

    Dashlane

    Dashlane is another online password manager that provides basic features to store and secure your passwords, including creating vaults, generating passwords, filling online forms, and importing data from other managers.

    The tool provides a very limited free plan that only works on one device. The advanced tier ($2.75 per month) removes the device limit and adds a service that monitors the dark web for breached passwords and compromised accounts.

    The premium plan ($4.99 per month) adds VPN support, and the family plan ($7.49 per month) provides 10 premium accounts plus a dashboard to manage accounts and shared resources.

    Unlike other password managers, Dashlane doesn’t have a desktop application – PC users must do everything through the web portal and browser extensions. But it does have mobile apps for Android and iOS.

    Dashlane allows you to share passwords with other Dashlane users and set limits to what kind of access they will have to your credentials.

    Dashlane’s emergency access feature also allows you to specify a contact who can assume ownership of your account in case you lose access, and you can specify a waiting period to accept or reject the user’s request to access your vault.

    KeePass

    For users who don’t trust online services with their passwords – a legitimate concern after the LastPass debacle – KeePass is a convenient alternative.

    KeePass is a standalone application that provides many of the functions you would expect from a professional password manager, but with some notable exceptions. Absent features include the ability to auto-capture new passwords, syncing across multiple devices, password sharing, and scanning the web for breached accounts.

    KeePass also fails to offer a web interface, browser extensions, or support for multiple platforms. The package comes as a Windows application, although being an open-source project means developers have ported it to other platforms. You’ll find links to these software packages on the KeePass website.

    In KeePass, you can create password databases to store passwords, notes, and documents. These password databases can be copied to other devices, but you’ll have to sync them manually.

    KeePass lacks support for many types of data, such as credit card info and API tokens, by default, but you can customize the utility to support different data types. Instead of autofill, KeePass has an auto-type feature that emulates typing your credentials on the keyboard, a feature than can require a bit of getting used to.

    While this is not the most convenient password manager, it is a decent option for advanced users who want full control of their data and the ability to tinker with the software.

    Operating system password managers

    Alternatively, you can use a tool that comes bundled with your operating system. Most popular among them is Apple’s Keychain, which encrypts and stores your passwords in a secure vault on your device.

    The main advantage of Keychain is its deep integration with the Apple ecosystem. It automatically detects and fills passwords for websites, applications, WiFi networks, and more. It can also be synced to your iCloud account and made available across all your Apple devices, including Mac, iPhone, iPad, and Apple Watch.

    So Keychain is convenient if you only use Apple devices. But if you have other operating systems in the mix (Android, Windows, Linux), then you’ll need a separate password manager. You also won’t be able to use it if you want to log into one of your accounts from a friend’s device or a public computer.

    Resource : https://portswigger.net/daily-swig/password-manager-security-which-is-the-right-option-for-me

    3Mar, 2023
    AMD Ryzen Master has a bug that can let someone take full control of your PC

    AMD has just revealed that it spotted a new vulnerability in its Ryzen Master software. The bug sounds pretty dangerous — it could potentially allow an attacker to take full control of your PC.

    Here’s everything we know about the vulnerability and the steps you need to take to secure your computer.

    AMD Ryzen Master is a useful piece of software if you’re using an AMD processor. It lets you monitor your CPU in real time as well as alter the clock speeds and the voltage. While it’s definitely handy, if it falls into the wrong hands, you could be in trouble — and it seems that the tool has been hit with a pretty severe vulnerability.

    The vulnerability was spotted by Conor McNamara and later disclosed by AMD itself. Its severity was ranked high, and AMD described the potential impact as “privilege escalation.”

    “Failure to validate privileges during installation of AMD Ryzen Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user,” said AMD.

    According to what AMD said, this means that users with low privilege levels could use Ryzen Master to gain control of the system. It’s unclear if this would be possible without administrator access, though, and it does sound like the user would need to be able to access the computer in person in order to carry out an attack.

    This is one of those vulnerabilities that are unlikely to affect a whole lot of users, but once someone is affected, the impact could be severe. Another example of this type of vulnerability in the last year is Hertzbleed, which is thought to affect most of the best processors on the market.

    Even if you feel like you’re not at risk, it’s best to update Ryzen Master to the latest version of the software (2.10.1.2287). You’ll be protected from the vulnerability and also get a few new features, such as the ability to set a maximum temperature for your CPU. You can also set the voltage of the processor above 5.2V, but you shouldn’t do this unless you’re an expert at overclocking your CPU.

    Resource : https://www.digitaltrends.com/computing/amd-ryzen-master-vulnerability-patch/