• Search for:
    31May, 2023
    IBM Delivers Roadmap for Transition to Quantum-safe Cryptography

    IBM has introduced a quantum-safe roadmap to help the complex organizational transition to post-quantum cryptography at this year’s annual Think conference.

    There are deadlines by which federal agencies must complete the transition to quantum-safe cryptography. Business is expected to follow the same path, but it is a long and difficult route. IBM has developed a three-stage solution it calls the IBM Quantum Safe Roadmap.

    “This roadmap serves as a commitment to transparency, predictability, and confidence as we guide industries along their journey to post-quantum cryptography. There’s a lot happening at once — new algorithms, standards, best practices, and guidance from federal agencies. We hope that this roadmap will serve as a navigational tool through this complex landscape,” it announced.

    The background is the assumption that much of our current cryptography will be easily cracked with the arrival of cryptographically relevant quantum computers, which are expected earlier than general-purpose quantum computers. Even though this may be several or even many years in the future, encrypted confidential data stolen by nation-state or criminal gangs now will become readable at that time. Quantum safety is a pressing concern.

    NIST has been running a competition to develop new algorithms capable of withstanding decryption by quantum computers. In July 2022, it announced that it had selected four algorithms for standardization (three of which were developed with IBM involvement). These standards will be published and become official in 2024.

    In November 2022, the OMB issued a Memorandum on Migrating to Post-Quantum Cryptography, including details with timelines on the steps required of federal agencies. “This memorandum describes preparatory steps for agencies to undertake as they begin their transition to PQC by conducting a prioritized inventory of cryptographic systems,” it announced.

    The IBM Quantum Safe Roadmap is designed to help both federal agencies and business enterprises meet both the requirements and the deadlines for quantum safe cryptography.

    The roadmap comprises three separate products – two of which are available now, with the third currently in its first generation but timed to be fully available at the time it is needed. The three products are Quantum Safe Explorer, Quantum Safe Advisor, and Quantum Safe Remediator. These three products correspond to the discover, observe, and transform stages of the roadmap.

    The Explorer enables organizations to scan source and object code to locate cryptographic assets, dependencies, and vulnerabilities. The result is what IBM calls a cryptography bill of materials (CBOM), aggregating all relevant details into a single location.

    The Advisor creates a dynamic view of the cryptographic inventory to guide remediation, and analyzes cryptographic posture and compliance to prioritize risks.

    The Remediator enables organizations to deploy and test best practice-based quantum-safe remediation patterns to understand the potential impacts on systems and assets as they prepare to deploy quantum-safe solutions. “It allows you to work with different quantum-safe algorithms, certificates and key management services,” says IBM. “It also helps you achieve crypto agility so that you can quickly adapt to changing policies and threats without significant operational or budgetary implications.”

    In 2025, the NSA will require national security systems to prefer quantum-safe algorithms while configuring their systems. Use of such algorithms will become mandatory for commercial products used in these systems, meaning that within two years, organizations working with the federal government will need to begin their quantum-safe transition. “By then,” says IBM, “Remediator will offer a hybrid approach, enabling traditional as well quantum-safe cryptography.”

    The complexity of transitioning to quantum-safe cryptography within prescribed timelines means the urgency is already here. 

    “As the era of quantum computing quickly approaches reality, it is imperative that quantum-safe technologies are also deployed to protect today’s classical systems and data,” comments Patrick Moorhead, CEO and founder of Moor Insights and Strategy. “What the world needs to secure data for the quantum age is expertise in world-class quantum technology and advanced cryptography, alongside decades of product development experience for critical infrastructure. These pillars are where I believe IBM excels, and now with a quantum-safe roadmap to lead the industry and new technologies to simplify migration, I look forward to seeing the advancement of quantum-safe journeys globally.” 

    Resource : https://www.securityweek.com/ibm-delivers-roadmap-for-transition-to-quantum-safe-cryptography/

    7Jan, 2023
    Cybersecurity Trends: IBM’s Predictions for 2023

    As with many other aspects of life and business, 2022 held fewer overall surprises in cybersecurity than in recent years — thank goodness. Instead, many trends brewing over the past few years began to take clearer form. Some were unexpected, and many were predictable, but all are important to consider when making plans for security in 2023.

    What Overall Trends Did We See in 2022?

    Ransomware continued to stay in the headlines in 2022. The share of breaches caused by ransomware grew 41% in the last year and took 49 days longer than the average breach to identify and contain. Ransomware gangs continued reemerging as new groups with the same key players after an arrest or major attack. And ransomware gangs are growing even more lucrative and powerful by selling ransomware as a service.

    On a positive note, zero trust evolved from being a new concept to a best practice. As hybrid work became a way of life, more organizations have started adopting zero trust frameworks– meaning all users, apps and devices that request access are assumed to be unauthorized until proven otherwise. Organizations with a zero trust approach deployed saved nearly $1 million in average breach costs compared to organizations without zero trust deployed.

    To get more insight into how 2022 trends are impacting the future of the industry, we talked to leading experts. Here’s what they have to say.

    Ransomware Attacks are Rebounding — But Not for All

    Cyber criminals look for organizations or industries teetering at the edge and then make their move to tip them over. Last year, we saw that with manufacturing — a strained industry viewed as the backbone of supply chains. With the distinct possibility of a global recession on the horizon, we expect to see ransomware attacks spike in 2023. However, larger organizations in regions heavily impacted during the ransomware boom are the most prepared for this wave after investing time and money in fighting back.

    Opportunities for Hackers-for-Hire Skyrocket Amid a Global Recession

    As operators offer new tools that dramatically lower the barrier of entry for less experienced and less technical cyber criminals, the cyber crime-as-a-service ecosystem may balloon in the year ahead. If the global economy faces a downturn, hackers-for-hire may emerge in search of quick and easy pay. We expect the biggest rise to be across Europe, considering geopolitical tensions and a challenging winter ahead.

    Zero Trust Got 99 (Implementation) Problems

    Now that it’s finally more than just a buzzword, security teams will accelerate zero trust adoption plans in 2023 — and make several missteps along the way. Without a deep understanding of trust relationships, implementations will fail. We already see security teams building “less trust” rather than “no trust” architectures, which opens the door to security gaps that adversaries may take advantage of in 2023.

    Social Engineers are Setting Their Sights on ICS Systems

    ICS/SCADA systems are essential to the daily operations of industrial manufacturers. Due to their importance, these systems are a top target for attackers. Yet while the tactics and techniques required to social engineer ICS systems differ from IT, the impact can be even more detrimental — going so far as the possible loss of life. Social engineers are already beginning to advance their techniques and tactics to more successfully gain access to these vulnerable systems. We anticipate social engineering to accelerate — with even more success — in the year ahead.

    Adversaries Sidestep New Security Technologies

    Almost as fast as the cybersecurity industry releases new security tools, adversaries evolve their techniques to circumvent them. This year will be no different. We expect to see cyber criminals set their sights more specifically on MFA and EDR technologies. With some attackers having succeeded at circumventing non-phishing-resistant MFA this past year — and more organizations relying on it than ever before — this technology will grow as a top target next year. Similarly, adversaries have been honing EDR evasion techniques. We expect to see a massive spike in the number of EDR evasion tools for sale on the dark web.

    Specialists Will Double-Back to Generalists to Secure the Cloud in 2023

    Hiring the talent required to secure the cloud will be a challenge for security leaders in 2023. One of the greatest hurdles stems from the large number of people needed in very niche, specialized roles. With so many companies increasingly going all-in on the cloud — and a skills crisis that’s worsening year by year — the solution to the skills gap lies in cybersecurity generalists. Organizations will recruit more generalists with successful track records, and build internal teams by reskilling specialists back to generalists.

    Automation Will Help Defenders Protect the “Moat”

    With data being more dispersed than ever the concept of protecting the “moat” is no longer a successful strategy — we now have too much surface area to cover. We’ll see more automated protection of the “moat”, so defenders can focus more time on detecting adversaries earlier and responding more effectively.

    Credential-Stealing Will Continue to Rise

    Cyber criminals will continue to leverage large caches of leaked/stolen credentials to devastating effect. Many consumers and businesses are gradually migrating to password managers, passwordless and hardware identity tokens. However, the vast majority of the population continues to reuse credentials or variations of credentials between environments, systems or sites. Next year, we’ll see attacks against legacy second-factor authentication, such as SMS, continue, as will attacks against push-based multi-factor authentication solutions. Phishing and other attacks designed to capture authentication tokens will also rise.

    What Else Will 2023 Bring?

    Though the 2023 cyber forecast has become clearer, the current wild card is a potential looming recession and how the uncertain economy will affect cybersecurity spending – and attackers’ motivations. The early months of 2023 should provide insight into the direction the economy is likely to take. But no matter what the economy does, organizations that continue to prioritize cybersecurity will continue to reduce their risk of business disruption and reputational loss from major breaches.

    Resource : https://securityintelligence.com/articles/cybersecurity-trends-ibm-predictions-2023/

    28Dec, 2022
    Modern technology and cyber recovery will intersect in the next generation of attacks

    As technology continues to evolve for business and personal use, cybercriminals are also leveraging innovation in the next generation of attacks, according to Experian.

    Additional frontiers are a focus for 2023

    In addition to the metaverse, hackers will increasingly explore more frontiers, including space and innovative technology like artificial intelligence, come 2023. A new Experian report outlines several predictions to help companies understand where cybercriminals will lurk and how they will attack. These predictions include the following:

    Wild, wild west of the metaverse

    While embarking on a virtual life journey is appealing to many, it has vulnerabilities. As the metaverse continues to gain momentum, phishing attempts, NFT-related scams and malware attacks have already begun, with potentially more looming in the year ahead. AR and VR devices increase the impact of data breaches as these devices collect large amounts of personal information and user data. This may increase their potential to be hacked and lead to more sophisticated attacks.

    Houston, we have a problem

    Thinking about the scale of damage that could result from space satellites being hacked is disconcerting, but it’s also a reality we must prepare for in 2023. The combination of a disjointed regulatory environment and more satellites in orbit than ever opens the door for bad actors to exploit the satellites in orbit, or with a big enough satellite, even launch cyberattacks from space.

    Imitation that’s not a form of flattery

    While influencers of all types may chase exposure, this isn’t the kind they want. Use of deepfake technology by bad actors could be leveraged for more than just funny videos and elevated to create a new level of strategic mischief. Global leaders, business titans and influential industry experts around the world will need to stay vigilant of the misuse of their image and likeness as deepfake technology may be an increasingly popular tool in warfare and in cybercrime.

    Resiliency is the key to winning long-term

    Among Experian’s predictions is a long-term outlook that the amount of time to detect and defend against a security intrusion will probably not improve significantly over the next 10 years. Organizations still grapple to prevent data breaches with more than 1,200 breaches this year so fari. Unfortunately, according to IBM, it still takes organizations a lengthy 212 days to identify a cyber intrusion and another 75 days to contain it. Strategies to improve detection and containment need to be shored up.

    “In assessing the cyber landscape, we pinpointed a preparedness weakness that needs attention,” said Michael Bruemmer, VP, Global Data Breach Resolution at Experian. “The reality is that cyberattacks can’t be prevented 100 percent of the time, but organizations that can discover and thwart cyberattacks quickly will suffer less damage financially and reputationally. We believe there is a shift in mindset needed to focus on resiliency to complement the pursuit for absolute prevention.”

    Resource : https://www.helpnetsecurity.com/2022/12/27/modern-technology-cyber-recovery-next-generation-attacks/?web_view=true