The Paris Olympic games will likely present a high cyber risk

As the Paris Olympic games draw closer, security leaders warn that the event faces a high risk of targeted cyber incidents. Cyber threat activity may include disruptive and destructive operations, espionage, financial threats, information operations, hacktivism and more. These cyber incidents could impact Paris infrastructure, event sponsors, ticketing systems, athletes and spectators. 

Thomas Richards, Principal Consultant at Synopsys Inc, says, “With the Olympics being a major international event, it becomes a lightning rod of attention. It is not without controversy and attracts attention from activists, criminal organizations, and nation states. Attackers could be looking to disrupt the events or alter results. The Olympics will certainly face DDoS attacks that can be mitigated by preventing common DDoS attack patterns and building a distributed and resilient network to distribute and handle excess network traffic. Attackers will also try to infiltrate the Olympic networks through any means they can, including phishing and physically trying to access network interfaces and connection closets. Olympic employees should be trained and regularly tested to identify and prevent phishing attacks. All central networking closets should be locked and protected with additional security, like biometrics, if possible.”

Due to security incidents are previous Olympic games, many believe that the security community is better prepared and equipped to manage and mitigate cyber risks. Nevertheless, those involved with the games are advised to remain vigilant against potential cyber threats, especially app-related threats. 

“The Olympic Games App is expected to be downloaded and installed by millions of people across the world. This makes it a high-value target for malicious actors seeking to exploit vulnerabilities in the app for financial, political, or other harmful purposes,” says Kelvin Lim, Senior Director at Synopsys Inc. “The 2021 Tokyo Olympic Games had 450 million cyber threats, which is two and a half times greater than the recorded number of cyberattacks during the London Olympics in 2012. A successful attack on the Olympic Games App will tarnish the image of the Olympic Games organizers. It is critical for Olympic Games App developers to follow good application security practices when developing the App and to use AppSec tools to help discover and address any vulnerabilities in the App before it is released to the public.” 

https://www.securitymagazine.com/articles/100776-the-paris-olympic-games-will-likely-present-a-high-cyber-risk




Sistemi di Intelligenza Artificiale e Machine Learning: rischi, vulnerabilità e strategie di difesa – Tavola Rotonda

Alla Tavola Rotonda tenutasi durante la 12a edizione della Cyber Crime Conference, cha ha chiuso la prima giornata di evento, sono intervenuti:

  • Stefano Bistarelli, Professor of Computer Science at the Department of Mathematics and Computer Science at the University of Perugia
  • Gian Luca Foresti, Professore di Cybersecurity e Computer Vision, Direttore del Master in Intelligence and Emerging Technologies, Università di Udine
  • Marco Mellia, Professore presso il Dipartimento di Automatica e Informatica, Politecnico di Torino (DAUIN)
  • Angelo Spognardi, Professore associato presso il Dipartimento di Informatica dell’Università Sapienza di Roma
  • Gianni Amato, Senior Security reasearch at the CERT for the Digital Italy Agency (CERT-AgID), in veste di moderatore del panel.

La seconda Tavola Rotonda della Cyber Crime Conference 2024 ha discusso il ruolo centrale dell’Intelligenza Artificiale nel contesto della sicurezza informatica.

I partecipanti hanno analizzato vari aspetti legati all’impiego dell’IA per identificare e contrastare le minacce informatiche, affrontando temi di grande attualità: dalle tipologie di attacco più comuni all’importanza dell’addestramento dei modelli, fino alle differenze rispetto ad altri campi di applicazione dell’IA o alla persistente necessità di individuare il giusto equilibrio tra privacy e sicurezza.

Guarda il video completo della Tavola Rotonda:

[embedded content]

Attacchi più comuni all’intelligenza artificiale

Il prof. Bistarelli ha illustrato alcune tecniche frequentemente usate dai cyber criminali contro gli strumenti IA, citando un recente report del NIST e menzionando quattro tipi di attacchi: data poisoning, evasion, model inversion, membership inference.

Questi attacchi avvengono durante la fase di addestramento o di utilizzo dei sistemi di IA, con l’obiettivo di comprometterne le prestazioni o di violare la privacy degli utenti.

Importanza dell’addestramento dei modelli di intelligenza artificiale

Il prof. Foresti ha sottolineato l’importanza cruciale dell’addestramento dei modelli di IA, distinguendo tra approcci supervisionati e non supervisionati.

Se infatti l’addestramento supervisionato, che richiede grandi quantità di dati “etichettati”, può essere limitato nella capacità di identificare nuove minacce, l’approccio non supervisionato permette invece di rilevare anche eventuali anomalie future; ma d’altro canto presenta numerose sfide in termini di complessità, nonché di bilanciamento dei set di dati utilizzati.

Strategie innovative per l’addestramento dei modelli di IA

Il prof. Mellia ha illustrato alcune strategie innovative per l’addestramento dei modelli di IA, tra cui l’anticipazione di comportamenti malevoli attraverso sistemi generativi e l’utilizzo di pochi esempi per aiutare i modelli a “specializzarsi” in settori specifici (few-shot learning).

Nel corso dell’intervento sono state sottolineate anche le differenze rispetto ad altri campi di applicazione dell’IA: come ad esempio la disponibilità limitata di dati malevoli o, inevitabilmente, la natura non collaborativa degli avversari.

Sicurezza, privacy e consapevolezza nell’utilizzo dell’IA

Il prof. Spognardi ha messo in guardia la platea rispetto all’illusione di avere già risolto tutti gli aspetti problematici: ribadendo come ci sia ancora molto da fare in termini di comprensione dei modelli IA, ha quindi sottolineato l’importanza di essere consapevoli dei limiti e dei potenziali rischi di questi strumenti.

I partecipanti hanno poi affrontato il tema del giusto equilibrio tra sicurezza e privacy da perseguire nell’impiego dell’Intelligenza Artificiale, soffermandosi sulla necessità di garantire trasparenza e adeguata tutela ai dati personali coinvolti.

Collaborazione internazionale e interdisciplinare

I professori hanno concordato sull’importanza della collaborazione internazionale e interdisciplinare per mitigare i rischi legati agli attacchi all’IA, citando esempi di ricerche condotte a livello globale ed evidenziando la necessità di condividere idee, strumenti e risultati per migliorare la robustezza dei sistemi IA.

È emersa, tuttavia, anche la consapevolezza delle rilevanti differenze che esistono tra diverse regioni del mondo in termini di avanzamento tecnologico e di investimenti finanziari dedicati.

Ottimismo e sfide future nell’utilizzo dell’IA per la sicurezza informatica

Il dibattito finale ha espresso un cauto ottimismo riguardo ai progressi dell’IA nella sicurezza informatica, pur riconoscendo le numerose sfide e le aree di ricerca ancora aperte.

In particolare è stata citata l’utilità dell’IA per migliorare gli strumenti di difesa, oltre all’opportunità di promuovere forme di collaborazione internazionale e interdisciplinare tese a condividere risultati e best practice.

Di contro si è evidenziata l’urgenza di affrontare questioni ancora irrisolte, come l’anticipazione di comportamenti malevoli o il necessario bilanciamento tra privacy e sicurezza.

In conclusione, tutti i relatori hanno condiviso alcune riflessioni sui prossimi passi da compiere: rafforzare la comprensione dei modelli IA, favorire un utilizzo più responsabile dei relativi strumenti e portare avanti la ricerca su aspetti cruciali ma troppo poco noti, come la disponibilità di dati adeguati o la robustezza dei sistemi basati sull’Intelligenza Artificiale.

Il programma completo della Cyber Crime Conference 2024 è disponibile al seguente link: https://www.ictsecuritymagazine.com/eventi/cybercrimeconference2024#programma

Iscriviti alla nostra newsletter per rimanere aggiornate sulle nostre iniziative: https://www.ictsecuritymagazine.com/newsletter/

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/cybersecurity-video/sistemi-di-intelligenza-artificiale-e-machine-learning-rischi-vulnerabilita-e-strategie-di-difesa-tavola-rotonda/




Spesso i CEO non possiedono le conoscenze base della cybersecurity


Secondo l’ultimo report di Kaspersky, quasi la metà dei CEO, C-suite executive e responsabili IT non sa come proteggere gli asset più importanti della loro azienda dagli attacchi informatici ed è confusa da termini base di cybersecurity come malware, phishing e ransomware.

La ricerca “Enterprise cybersecurity and increasing threats in the era of AI: Do business leaders know what they are doing?“ evidenzia che, nonostante i costanti avvisi di minacce alla sicurezza aziendale e gli investimenti nella protezione, i dirigenti aziendali si sentono sopraffatti dalla complessità di proteggere le proprie organizzazioni dagli attacchi.

La maggior parte dei dirigenti sottovaluta l’abilità e la costanza degli attaccanti e il 48% degli specialisti di sicurezza C-suite rivela che il linguaggio è il principale ostacolo alla comprensione della cybersecurity da parte del management; a questo si aggiungono le difficoltà legate alle limitazioni di budget (47%) e alla formazione insufficiente (43%).

La mancanza di competenze è considerato un problema grave e con effetti a lungo termine dal 75% delle imprese. I dati confermano l’importanza di formare tutto il personale: oggi più del 10% degli incidenti informatici è causato da errori commessi dai dipendenti, dei quali il 16% è provocato dal personale, il 15% dai dipendenti IT e il 14% dai dirigenti. Le violazioni intenzionali delle policy di sicurezza rappresentano invece più di un quarto (26%) di tutti gli incidenti informatici degli ultimi due anni.

“È fondamentale che i dirigenti riconoscano la difficile realtà della sicurezza informatica nell’era digitale di oggi, in cui i dati hanno un ruolo fondamentale” ha dichiarato Cesare D’Angelo, General Manager Italy & Mediterranean di Kaspersky. “Investendo nella formazione, implementando servizi di threat intelligence, promuovendo una cultura della resilienza informatica e dotando ogni dipendente delle conoscenze e degli strumenti necessari per contrastare le minacce informatiche, possiamo ribaltare la situazione a nostro favore nei confronti dei cyber criminali“.

Per affrontare il problema è essenziale investire su corsi di formazione e iniziative di cybersecurity per sensibilizzare tutti i livelli di personale, dal CEO ai dipendenti, uniti all’uso di simulatori interattivi per valutare le competenze e le capacità decisionali negli scenari critici. Infine, è opportuno promuovere una cultura della resilienza della cybersecurity. 

Condividi l’articolo



Articoli correlati

Altro in questa categoria


https://www.securityinfo.it/2024/06/11/spesso-i-ceo-non-possiedono-le-conoscenze-base-della-cybersecurity/?utm_source=rss&utm_medium=rss&utm_campaign=spesso-i-ceo-non-possiedono-le-conoscenze-base-della-cybersecurity




Weapons detection in healthcare: A snapshot and guide

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } .sidebar { Nunito Sans’, Arial, sans-serif; font-size: 18px; font-weight: 600; text-align: left; padding: 10px; background-color: #f0f0f5; border: 4px #58526F; border-style: dashed; border-radius: 10px; } .w3-panel:after,.w3-panel:before { content: “”; display: table; clear: both } .w3-panel { padding: 16px; margin-top: 16px; margin-bottom: 16px } .w3-leftbar { border-left: 6px solid #386994!important } .w3-color,.w3-hover-color:hover { color: #386994!important; background-color: #eaf1f7!important } .w3-large { font-size: 20px!important } .w3-sans-serif { Nunito Sans’,Arial,sans-serif } .w3-opacity,.w3-hover-opacity:hover { opacity: 0.60 }

A woman carrying a Louis Vuitton purse and Macy’s shopping bag hurries through the front doors of a hospital in Washington, DC, and immediately eyes a recently installed weapons detection system (WDS) portal. Perhaps experienced with such fixtures at airports, she steps aside to allow others passage, then begins the ritual unburdening of bags, phones, keys, rings, pocket change, and other items that could possibly trigger an alert. A hospital security officer quickly intervenes and directs her to walk through. “But I have all these keys in my hand and other things,” the visitor objects. The officer assures her that she can pass with all those items, and she breezes through without a beep, partially amazed and partially relieved.

The hospital’s system uses advanced technologies and precise sensitivity settings to detect only weapons and not ubiquitous harmless items such as phones, keys, notebook computers, and umbrellas. While the officer’s principal role is to provide security, close behind are facilitating swift pedestrian traffic flow and offering excellent customer service. As this healthcare facility performs a trial of the system, the vast majority of visitor encounters are similar to this one: appreciation that hospital management prioritizes security, helpful and positive interaction with staff, and minimal delay.

The D.C. hospital soon realized that it could further improve throughput and the visitor experience by posting clear and hard-to-miss signage to set expectations for people arriving at the hospital. Hospital management planned to do so shortly after my visit.

That’s a tiny snapshot in the world of weapons-detection screening at healthcare facilities, where management must balance safety, convenience, and throughput. The author spent hours at entryways of healthcare facilities this winter observing examples of this intricate dance between security screeners, hospital entrants, and technology.

Perhaps no day was as busy as Valentine’s Day at a large hospital center in New York City, where hundreds of visitors, eager to see their loved ones, poured through the system carrying every possible type of bag and gift: Briefcases and balloons, valises and vases, truffles and totes. Similar to the Washington, DC, facility, visitors passed through the twin pillars with whatever they were holding or carrying. Secondary screening — bag checks or wand sweeps — occurred for the occasional person carrying a bag or other large item.

The exceptions were patients and visitors in wheelchairs, on walkers, or pushing strollers, where they are wanded in a separate area.

This article is the result of observing many such scenes and speaking to both security screeners and management. It assembles issues, challenges, and effective practices in deploying WDSs in healthcare environments.

Types of technology/system capabilities

WDSs range from basic metal detectors to elaborate affairs that combine metal detection, LiDAR, artificial intelligence to distinguish harmless items from dangerous ones, visual cameras with onboard analytics, radar, millimeter wave technology, and so on.

Layering various technologies is an effective way to maximize weapon detection, but that doesn’t mean healthcare institutions are best served by loading every available technology onto their solution. Selecting a WDS requires a balance of needs — determining exactly what types of items are you trying to detect, and to not detect — budget, staffing, location, logistics, throughput, false-alarm tolerance, and other factors.

Generally speaking, however, the more effective systems go beyond mere metal detection. Though a small number of hospitals I reviewed rely on that technology only, the more modern and sophisticated systems incorporate features such as LiDAR, AI, and visual detection — even catching people who try to circumvent the system. These latter systems also allow people to carry keys, phones, and other harmless metal objects through the system without triggering an alarm.

The more advanced systems that I witnessed were cloud based and integrated with multiple security and facilities interfaces, including access control, visitor management, mass notification and video surveillance. These facilities leverage the combination of security components to establish an enhanced security stance. For instance, security can quickly pinpoint the location of an individual, capture and collate various sources of threat data, and reduce response time. Moreover, the cloud-based platforms facilitate incident reporting, compliance documentation, guard check-in, data analysis, and mobile monitoring.

In fact, failing to integrate a WDS with other security technology is a missed opportunity, says Josh Phillips, a security practitioner and founder of the online community Physical Security Today. “Any output from the WDS is just as powerful a data point as a read at a door,” he emphasizes. “It just makes sense to integrate these systems with access control and video.”

Sites and locations

WDSs are obviously not practical or cost-effective for every type or size of medical facility. They are most frequently deployed in hospitals or healthcare centers with adequate funding that are located in higher-risk areas. Healthcare systems with multiple locations face the issue of allocating limited resources to multiple facilities, notes Phillips.

“There are so many outpatient facilities now,” Phillips says. “Hospital systems are very distributed. How do you decide where to install them?” The answer can be a combination of risk assessment, resources, community input, potential liability, and other factors.

Once you decide which facilities will receive them, the next questions are how many systems and where.

Some hospitals place WDSs at the entrance to the ER. Some situate them inside the main doors. Others cover both areas.

Chris Ciabarra, Chief Technology Officer and Co-Founder at Athena Security, who has overseen installation and maintenance of dozens of systems in healthcare environments, says that ERs are logical places for WDSs, considering that they have 24-hour operations, often deal with victims of firearms, and are the site of 40% of violent incidents in hospitals. But he adds that if other entrances don’t have WDSs, visitors can elude screening. (In fact, I was able to do just that at some sites.)

Ernie van der Leest, who has overseen healthcare security operations in Texas and Colorado, has witnessed that exact phenomenon. “Many hospitals use weapons detection systems at their ERs, but not at any other entrance,” he observes. “Anyone can get right around it.” His strong recommendation: use a WDS at every entrance.

Sometimes people can evade a WDS by entering the hospital through an adjoining medical office or facility. In those cases, if the hospital doesn’t want to add another WDS, connection points should either have electronic access control for staff use, an officer assigned to the entry, or a way to direct entrants back to a screening station.

What about limiting entrances, as schools do, to funnel patients, staff, and visitors to one or two entryways — which would improve security, reduce staffing costs, and minimize the number of WDSs to purchase?

Be careful with that approach, warns van der Leest. “If you shut down entrances that don’t have WDSs, you hurt the patient experience. People in wheelchairs, on crutches, the sick, the elderly might have to walk a long way to the only entrance.”

❝

All staff should be trained on the specific system in use, as well as procedures that involve issues such as secondary screening, dealing with irate people, discovering a weapon, and requesting assistance.”

Staffing

All staff should be trained on the specific system in use, as well as procedures that involve issues such as secondary screening, dealing with irate people, discovering a weapon, and requesting assistance.

Then the institution should determine how many staff members are appropriate to operate a WDS.

According to a draft guideline issued for public comment on November 13, 2023, by The International Association of Healthcare Safety and Security, “The number of personnel assigned to the weapons detection process should be based upon the volume of people being screened, the type of monitoring equipment, search processes, secondary inspections, storage of belongings, etc.”

Athena’s Ciabarra says Department of Homeland Security (DHS) best practices specify two officers for normal conditions for high-volume entrances. DHS has even published a patron flow-rate formula for WDSs (see sidebar). Ciabara adds that the officer overseeing the screening should be able to both see the visual alert and hear the audio alert if an entrant triggers the system. The secondary screener conducts follow-up wanding and bag searches. One of those two officers also screens anyone who can’t pass through the portals or would definitely set off the WDS, such as the wheelchair bound.

A third screener can be considered at high-volume times, when risk is greater, when low wait time is critical, or as otherwise deemed viable by hospital management, Ciabarra adds.

Rarely did I witness three officers on duty at any facility, even urban hospitals at busy times. Often I only saw a single person do everything. Van der Leest confirms that my experience isn’t rare. In one hospital, I asked how long it would take to get backup if she found a weapon and someone threatening to use it. She didn’t know because it hadn’t happened yet.

https://www.securitymagazine.com/articles/100759-weapons-detection-in-healthcare-a-snapshot-and-guide




It Takes a Village to Keep Organizations Secure

Feeling overwhelmed by the monumental task of staying on top of not only the physical but the cyber side of your organization’s security stance? You likely aren’t alone. Then on top of knowing what is going on in your own organization, the fast-shifting regulatory world of both cyber and AI can be another headache.

A recent report from Swimlane found that more than 90 percent of organizations have re-evaluated their cybersecurity strategies in the past year as a result of new regulations, with more than half of them completely reconsidering their strategies as a result. While just over a third did realize budget increases, only 40 percent felt confident that their organization possessed the necessary resources, personnel and tools to fully comply with regulations.

Beyond regulatory compliance concerns, another study by Deep Instinct found that a whopping 97 percent of security experts worry about AI-related security attacks and related cybersecurity strategies emerging to face those attacks. The report also found that the increase in AI-powered threats prompted three-quarters of respondents to adjust their security strategies in the past year.

There is some positive news related to some of the latest technology and the threats they can pose.

On the cybersecurity front, however. CISA recently announced that its Secure by Design pledge has amassed buy-in from 68 leading software manufacturers, who have voluntarily pledged to deliver measurable progress towards seven key goals with the intent of securing critical infrastructure. According to a CISA release, those goals are:

  1. Exhibit actions taken to increase the application of multi-factor authentication throughout the manufacturer’s products.
  2. Reduce default passwords throughout the manufacturer’s products.
  3. Demonstrate a measurable reduction in one or more vulnerability classes throughout the manufacturer’s products.
  4. Increase the security patches installed by customers.
  5. Release a vulnerability disclosure policy (VDP) that allows for public testing, commits to not take legal action against those who follow the VDP in good faith, presents a clear process for reporting vulnerabilities, and allows for public discussion of vulnerabilities.
  6. Demonstrate transparency in reporting vulnerabilities by ensuring every Common Vulnerabilities and Exposures (CVE) record includes accurate Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields. Furthermore, issue CVE reports in a timely manner.
  7. Increase the customer’s ability to collect evidence of cybersecurity intrusions that impact the manufacturer’s products.

Meanwhile, on the AI front, the OpenAI Board has formed a Safety and Security committee to provide suggestions on decisions for all Open AI projects. The first task will be to develop processes and safeguards for review within 90 days (by end of July) for full review by the board.

Nicole Carignan, Vice President of Strategic Cyber AI at Darktrace, told Security Magazine, “As AI innovation continues to unfold at a rapid pace, we hope to see similar commitments for data science and data integrity. Data integrity, testing, evaluation and verification, as well as accuracy benchmarks, are key components in the accurate and effective use of AI. Encouraging diversity of thought in AI teams is also crucial to help combat bias and harmful training and/or output. Most importantly, AI should be used responsibly, safely and securely. The risk AI poses is often in the way it is adopted.”

Finally, when it comes to cloud-based systems — an increasingly popular option for many companies — a recent Veeam Software report found the desire to integrate cyber technologies with data protection and backup, along with improved protection of cloud-hosed workloads are top drivers for organizations to consider cloud-hosted or cloud-managed services.

That report also highlighted the many roles that are involved in data protection, including IT operations, managed BaaS or DRaaS teams, backup teams, workload administrators, and trusted resellers/integrators. On average, organizations have 2.3 roles dedicated to ensuring backups and 1.8 roles responsible for restoration. This demonstrates the importance of having expertise and judgment in data recovery processes.

In other words, it truly does take a village.

https://www.securitymagazine.com/articles/100783-it-takes-a-village-to-keep-organizations-secure




Product spotlight on risk and threat monitoring

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { border: 2px #abacac solid; background-color: #F1F1F1; padding: 4px; }

With rapidly-evolving threats and staffing shortages, it’s becoming harder for security leaders to monitor their organizations for potential threats. Security magazine highlights a few products that help keep critical systems safe from attack.

Falcon Adversary OverWatch

CROWDSTRIKE

Proactively Searches for Threats

Falcon Adversary OverWatch is a 24/7 threat hunting service that spans endpoint, identity and cloud to disrupt adversaries. The software is powered by threat intelligence and artificial intelligence (AI). The software is designed to help analysts locate threats and respond accordingly. The program includes additional information on the common threat actors to an industry or region, helping an organization prepare for an incident before it occurs. Image courtesy of Crowdstrike

FIND OUT MORE AT CROWDSTRIKE.COM

AutoPatrol

IMMIX

Detect Threats Via Video

AutoPatrol works by enabling scheduled video patrols to be automatically performed via the embedded AI technology. If the AutoPatrol detects an anomaly, such as a change in scene, tamper, presence of an unauthorized person/vehicle/object, as well as a number of additional conditions that can be selected, it will raise the event to be manually confirmed and processed by a human operator to determine the next step.  Once raised into the patrol queue, AutoPatrols resemble regular scheduled patrols. Image courtesy of Immix

FIND OUT MORE AT IMMIXPROTECT.COM

Kaspersky Next EDR Foundations

KASPERSKY

Automatically Neutralizes Threats

Kaspersky Next EDR Foundations provides endpoint protection that identifies and neutralizes threats before they can harm business processes. Flexible, straightforward security controls and built-in IT scenarios allow hands-off operation and let companies customize their security policies. Image courtesy of Kaspersky

FIND OUT MORE AT USA.KASPERSKY.COM

Rapid7 detection and response

RAPID7

Using Radio For Threat Detection

Rapid7 detection and response includes through plug-and-play integrations with existing technologies for SIEM, SOAR, EDR, firewall, etc. The software includes investigation and mapping capabilities to provide contextualized alerts with low signal-to-noise ratio. Unlimited 24x7x365 access to analysts shortens investigation times as well as accelerates alert triage and response. Image courtesy of Rapid7

FIND OUT MORE AT RAPID7.COM

Red Canary

RED CANARY

Track Threat Actors’ Habits

Red Canary detects threats by applying analytics to security telemetry in the places where adversaries operate. The software investigates threats and alerts detected by Red Canary and existing security investments 24/7/365. Playbooks allow security leaders to notify the right people, contain threats and begin remediation. Image courtesy of Red Canary

FIND OUT MORE AT REDCANARY.COM

SolarWinds Security Event Manager (SEM)

SOLARWINDS

Detect On-Premise Threats

SolarWinds Security Event Manager (SEM) is a security tool designed to simplify threat management for lean IT operations and security teams. It’s built to deploy quickly via virtual appliance and can start detecting threats from across on-premises infrastructure fast using the correlation rules and filters. Image courtesy of SolarWinds

FIND OUT MORE AT SOLARWINDS.COM

ThreatMon

THREATMON

Using Intelligence to Detect Threats

ThreatMon helps organizations prepare against security threats by leveraging a large security database with centralized vulnerability intelligence. The software calculates an organization’s security risk score by taking into account all security issues detected in the external attack surface. In addition, the software aggregates, displays and tracks all activities, findings and security statuses related to its customers’ digital assets in real-time dashboards. Image courtesy of ThreatMon

FIND OUT MORE AT THREATMON.IO

<!–

https://www.securitymagazine.com/articles/100767-product-spotlight-on-risk-and-threat-monitoring




Hackers steal “significant volume” of data from hundreds of Snowflake customers

Hackers steal “significant volume” of data from hundreds of Snowflake customers
Getty Images

As many as 165 customers of cloud storage provider Snowflake have been compromised by a group that obtained login credentials through information-stealing malware, researchers said Monday.

On Friday, Lending Tree subsidiary QuoteWizard confirmed it was among the customers notified by Snowflake that it was affected in the incident. Lending Tree spokesperson Megan Greuling said the company is in the process of determining whether data stored on Snowflake has been stolen.

“That investigation is ongoing,” she wrote in an email. “As of this time, it does not appear that consumer financial account information was impacted, nor information of the parent entity, Lending Tree.”

Researchers from Mandiant, a Google-owned security firm Snowflake retained to investigate the mass compromise, said Monday that the companies have so far identified 165 customers whose data may have been stolen in the spree. Live Nation confirmed 10 days ago that data its TicketMaster group stored on Snowflake had been stolen following a posting offering the sale of the full names, addresses, phone numbers, and partial credit card numbers for 560 million Ticketmaster customers.

Santander, Spain’s biggest bank, said recently that data belonging to some of its customers has also been stolen. The same group advertising the Ticketmaster data offered the sale of Santander data. Researchers from security firm Hudson Rock said that stolen data was also stored on Snowflake. Santander has neither confirmed nor denied the claim.

Mandiant’s Monday post said that all the compromises it has tracked so far were the result of login credentials for Snowflake accounts being stolen by infostealer malware and stored in vast logs, sometimes for years at a time. None of the affected accounts made use of multifactor authentication, which requires users to provide a one-time password or additional means of authentication besides a password.

The group carrying out the attacks is financially motivated, with members principally located in North America. Mandiant is tracking it as UNC5537. Company researchers wrote:

Based on our investigations to date, UNC5537 obtained access to multiple organizations’ Snowflake customer instances via stolen customer credentials. These credentials were primarily obtained from multiple infostealer malware campaigns that infected non-Snowflake owned systems. This allowed the threat actor to gain access to the affected customer accounts and led to the export of a significant volume of customer data from the respective Snowflake customer instances. The threat actor has subsequently begun to extort many of the victims directly and is actively attempting to sell the stolen customer data on recognized cybercriminal forums.

Mandiant identified that the majority of the credentials used by UNC5537 were available from historical infostealer infections, some of which dated as far back as 2020.

The threat campaign conducted by UNC5537 has resulted in numerous successful compromises due to three primary factors:

  1. The impacted accounts were not configured with multi-factor authentication enabled, meaning successful authentication only required a valid username and password.
  2. Credentials identified in infostealer malware output were still valid, in some cases years after they were stolen, and had not been rotated or updated.
  3. The impacted Snowflake customer instances did not have network allow lists in place to only allow access from trusted locations.
Attack Path UNC5537 has used in attacks against as many as 165 Snowflake customers.
Enlarge / Attack Path UNC5537 has used in attacks against as many as 165 Snowflake customers.

Initial access to affected Snowflake accounts often occurred with the use of the company’s native SnowSight or SnowSQL, which are a web-based user interface and a command-line interface respectively. The threat actors also used a custom utility that shows up as “rapeflake” in logs and that Mandiant tracks as FrostBite.

https://arstechnica.com/?p=2030619




Apple’s AI promise: “Your data is never stored or made accessible to Apple”

Apple Senior VP of Software Engineering Craig Federighi announces "Private Cloud Compute" at WWDC 2024.
Enlarge / Apple Senior VP of Software Engineering Craig Federighi announces “Private Cloud Compute” at WWDC 2024.

With most large language models being run on remote, cloud-based server farms, some users have been reluctant to share personally identifiable and/or private data with AI companies. In its WWDC keynote today, Apple stressed that the new “Apple Intelligence” system it’s integrating into its products will use a new “Private Cloud Compute” to ensure any data processed on its cloud servers is protected in a transparent and verifiable way.

“You should not have to hand over all the details of your life to be warehoused and analyzed in someone’s AI cloud,” Apple Senior VP of Software Engineering Craig Federighi said.

Trust, but verify

Part of what Apple calls “a brand new standard for privacy and AI” is achieved through on-device processing. Federighi said “many” of Apple’s generative AI models can run entirely on a device powered by an A17+ or M-series chips, eliminating the risk of sending your personal data to a remote server.

When a bigger, cloud-based model is needed to fulfill a generative AI request, though, Federighi stressed that it will “run on servers we’ve created especially using Apple silicon,” which allows for the use of security tools built into the Swift programming language. The Apple Intelligence system “sends only the data that’s relevant to completing your task” to those servers, Federighi said, rather than giving blanket access to the entirety of the contextual information the device has access to.

And Apple says that minimized data is not going to be saved for future server access or used to further train Apple’s server-based models, either. “Your data is never stored or made accessible to Apple,” Federighi said. “It’s used exclusively to fill your request.”

But you don’t just have to trust Apple on this score, Federighi claimed. That’s because the server code used by Private Cloud Compute will be publicly accessible, meaning that “independent experts can inspect the code that runs on these servers to verify this privacy promise.” The entire system has been set up cryptographically so that Apple devices “will refuse to talk to a server unless its software has been publicly logged for inspection.”

While the keynote speech was light on details for the moment, the focus on privacy during the presentation shows that Apple is at least prioritizing security concerns in its messaging as it wades into the generative AI space for the first time. We’ll see what security experts have to say when these servers and their code are made publicly available in the near future.

https://arstechnica.com/?p=2030487




The cybersecurity industry needs an estimated 225,200 workers

New data from CyberSeek reveals that the cybersecurity industry is missing an estimated 225,200 security professionals in order to close the talent gap. Currently, only 85% of the economy’s available cybersecurity jobs are filled, with more than 1.2 million workers employed.  

The data from CyberSeek also uncovered that cybersecurity jobs were influenced by the pullback in tech hiring during 2023. Job postings for tech occupations decreased by 37% from May 2023 to April 2024. Furthermore, cyber job postings declined by 29%, suggesting that the cybersecurity industry is somewhat less impacted by hiring pullbacks when compared to the overall IT sector.

Cybersecurity job postings totaled 469,930 between May 2023 and April 2024. The positions with the highest demand included: 

  • Network engineers 
  • System administrators 
  • Cybersecurity engineers 
  • Security engineers 
  • System engineers 
  • Information systems security officers
  • Network administrators
  • Information security analysts
  • Software engineers

https://www.securitymagazine.com/articles/100766-the-cybersecurity-industry-needs-an-estimated-225-200-workers




58% of organizations found it harder to detect vulnerability

The scalability of penetration testing was analyzed in a recent survey by Synack. Half of the survey respondents reported it was more difficult to manage their attack surface today than it was a year ago, whether because of third-party risk, data complexity or increasing attacker sophistication.

Fifty-eight percent of enterprises said detecting vulnerabilities is getting more difficult as their attack surface increases in complexity, size and rate of change. Organizations reported pentesting currently covers 47% of business-critical apps.

Sixty-percent of respondents reported finding it difficult to test frequently enough to keep up with the pace of application development, with three in four saying it’s likely they will consider platform-based testing  solutions like Penetration Testing as a Service (PTaaS).

Thirty-two percent of respondents said they use pentesting to improve overall security strategies and posture. Most either reported using pentesting for compliance or to achieve tactical objectives like finding and fixing vulnerabilities.

Download the report

https://www.securitymagazine.com/articles/100774-58-of-organizations-found-it-harder-to-detect-vulnerability