Author: bacohido

Could we be on the verge of Privacy Destruction 2.0, thanks to GenAI?

Related: Next-level browser security

That’s a question that spilled out of a thought-provoking conversation I had with Pedro Fortuna, co-founder and CTO of Jscrambler, at RSAC 2024.

Jscrambler provides granular visibility and monitoring of JavaScript coding thus enabling companies to set and enforce security rules and privacy policies. For instance, it helps online tax services prevent leakage of taxpayers’ personal information via pixels, those imperceptible JavaScripts embedded in a web page to collect information about the user’s interactions.

It turns out, Fortuna observed, that GenAI/LLM is perfectly suited to the deeper mining of personal data collected by pixels as well as other JavaScript mechanisms currently in wide use.

This brought to mind 2010, the year I wrote news stories for USA TODAY about Mark Zuckerberg declaring privacy was “no longer a social norm” and Google CEO Eric Schmidt admitting that Google’s privacy policy was to “get right up to the creepy line and not cross it.”

Today, the temptation for companies to leverage GenAI/LLM just to get ahead of the competition is intense; and the stage is set for them to trample what remains of privacy protection in the post Zuckerberg/Schmidt era.

Jscrambler can at least provide technology to monitor and control how third-party JavaScript components handle private data. But at the end of the day, company leaders must be compelled to avail themselves of such tools and make privacy protection a priority.

For his part, Fortuna told me he is concerned that his two young children might become accustomed to relinquishing their privacy to unscrupulous data collectors; but he’s also optimistic that guardrails will emerge. For a full drill down, please give the  a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Jscrambler levels-up JavaScript security, slows GenAI-fueled privacy loss first appeared on The Last Watchdog.

Identity and Access Management (IAM) is at a crossroads.

Related: Can IAM be a growth engine?

A new Forrester Trends Report dissects ten IAM trends now in play, notably how AI is  influencing IAM technologies to meet evolving identity threats.

IAM is a concept that arose in the 1970s when usernames and passwords first got set up to control access mainframe computers.

By the 1990s, single sign-on (SSO) solutions had caught, and with the explosion of web apps that followed came more sophisticated IAM solutions. Federated identity management emerged, allowing users to use the same identity across different domains and organizations, and standards like SAML (Security Assertion Markup Language) were developed to support this.

The emergence of cloud computing further pushed the need for robust IAM systems. Identity as a Service (IDaaS) began to gain traction, offering IAM capabilities through cloud providers.

Last Watchdog engaged Forrester Principal Analyst Geoff Cairns, the report’s lead author, in a discussion about the next phase of IAM’s. Here’s that exchange, edited for clarity and length.

A new Forrester Trends Report dissects ten IAM trends now in play, notably how AI is  influencing IAM technologies to meet evolving identity threats.

IAM is a concept that arose in the 1970s when usernames and passwords first got set up to control access mainframe computers.

By the 1990s, single sign-on (SSO) solutions had caught, and with the explosion of web apps that followed came more sophisticated IAM solutions. Federated identity management emerged, allowing users to

LW: In the grand scheme, how urgent has it become for companies to focus on identity threats?

Cairns: The urgency for companies to focus on identity threats has significantly increased over the past few years due to several factors. First, the rapid advancement of technology has created a more complex and interconnected digital landscape, making it easier for attackers to exploit vulnerabilities. Second, the growing adoption of cloud and SaaS services, as well as remote work arrangements and the extended workforce, has expanded the identity threat surface. Third, high-profile data breaches, such as the recent Change Healthcare cyberattack, have underscored the importance of effective identity security controls in protecting sensitive information.

LW: What’s the vital lesson stemming from IAM-related breaches like those seen with MGM and Okta?

Cairns

Cairns: One of the most vital lessons for CISOs and IAM leaders to take away from the MGM and Okta breaches is that your IAM vendors’ servicing and operations is intrinsic to your own organization’s security posture and, ultimately, end-customer trust.  The ongoing consolidation of IAM vendors and technology stacks will lead to greater concentration of supplier risk, as well. We expect IAM platform vendors will face increased scrutiny from their prospects and customers as it relates to underlying platform security and incident response practices.

LW: Can you share an anecdote that illustrates exactly how generative AI is being used to improve threat detection and remediation in IAM systems?

Cairns: Given the ability to input natural language queries (e.g., “show me the last 5 privileged account access attempts”), IAM administrators are conducting conversational interrogations of the IAM system to more swiftly identify and isolate identity threats. With IAM administrators also able to use AI to generate immediate, actionable steps for remediation, incident response time is significantly reduced. In the future, we expect to see genAI advances that will proactively generate and optimize IAM policies to pre-empt future threats.

LW: What should CISOs clearly understand about integrations between IAM and non-IAM cybersecurity vendors?

Cairns: CISOs should understand that to effectively respond to identity-centric threats, integration is necessary between IAM and non-IAM cybersecurity tool sets. Support for these integrations is quickly maturing.  Across your existing security vendor portfolios, review roadmaps and integration points for identity threat detection, signal sharing, and response automation. Most importantly, leverage the opportunity to drive tighter operational process alignment and a stronger working relationship between IAM and SecOps teams.

LW: Are legacy IAM solutions obsolete; will they  — or be replaced?

Cairns: Even as environments get more complex and attacks get more sophisticated, companies should remain rooted in solid IAM fundamentals and core principles – strong authentication, least privilege access, robust monitoring – applying a defense in depth approach.  However, organizations must systematically evolve and upgrade their underlying IAM technology platforms to match their IT environment and the current threat landscape.  In some cases, like phishing-resistant passwordless MFA, it capitalizes on technical advances (biometrics, compute power) layered on top of well-established practices (multifactor authentication).  In other instances, it may require re-engineering of processes and systems to adopt a different technology or approach, such as verifiable credentials or zero standing privileges.  To be effective, IAM implementations must be dynamic and constantly evolving.

LW: Anything else?

Cairns: While staying updated on IAM technology trends is certainly important, perhaps the most critical thing that CISOs and IAM leaders can do is to nurture and maintain the right culture. Many security leaders that Forrester has spoken with stress the importance of establishing cross-functional relationships and collaboration to ensure a business-led approach to IAM. Prioritizing user-centric design thinking and a growth mindset are paramount for building a high-performing IAM team and applying the right set of IAM technologies to both protect and enable the business.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

The post SHARED INTEL Q&A: Forrester report shows Identity and Access Management (IAM) in flux first appeared on The Last Watchdog.

Digital rights management (DRM) has come a long way since Hollywood first recognized in the 1990s that it needed to rigorously protect digital music and movies.

By the mid-2000s a branch called enterprise digital rights management (EDRM) cropped up to similarly protect sensitive business information. Today, businesses amass vast  amounts of business-critical data – at a pace that’s quickening as GenAI takes hold.

At RSAC 2024 I sat down with Isaac Roybal, chief marketing officer at Seclore, to discuss how the challenge of securing business data has moved beyond even where the EDRM space has been evolving. For a drill down, please give the accompanying podcast a listen.

Seclore takes a data-centric approach to securing data by aligning granular controls with the sensitive data itself. This allows for security teams to dynamically manage permissions, rescind access, alter editing capabilities,  and even perform real-time compliance checks, he noted.

“We can ensure that only authorized users have access and can perform specific actions such as reading, editing, or printing,” he says.

Seclore facilitates data protection in a global productivity ecosystem that’s constantly shifting between on-premises, hybrid and cloud architectures. Its ability to integrate seamlessly with existing security tools and policies is a key differentiator, Roybal says.

By partnering with DLP, CASB, and classification vendors, Seclore ensures that organizations can leverage their current investments while enhancing their overall security posture.

“We’re not asking organizations to start from scratch,” he emphasized. “Our solutions integrate with the tools [users] already use, allowing for a more cohesive and effective security framework.”

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Seclore advances ‘EDRM’ by aligning granular controls onto sensitive data first appeared on The Last Watchdog.

Business data today gets scattered far and wide across distributed infrastructure.

Just knowing where to look – or even how to look – much less enforcing security policies, has become next to impossible for many organizations.

At RSAC 2024, I visited with Pranava Adduri, co-founder and CEO of Bedrock Security which has just rolled out its AI Reasoning (AIR) Engine to help solve this problem in a bold new way.

The start-up leverages serverless architectures to discover patterns in large datasets and then maps out data boundaries without having to examine every single data point.

This “commoditization” of data discovery, as Adduri puts it, slashes the cost of data discovery at scale. For instance, Amazon’s AWS Macie service charges around $1,000 per terabyte for data discovery, or $1 million per petabyte, Adduri told me.

By contrast, he says, Bedrock’s patented “adaptive sampling” technology can scan 16 petabytes of data for just $2,000. Their system then superimposes a dynamic heat map to categorize the data “neighborhoods” based on sensitivity at any given moment.

“We come at it from big data background,” Adduri says. “Step one is you have to keep track of all the stuff that’s happening; step two is you have to make sense of it; and step three is you have to constantly remediate.”

Bedrock secured a $10 million seed investment led by Greylock Partners and it has a growing portfolio of customers reporting strong results, Adduri says.

For a full a drill down please give the accompanying podcast a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

 

The post RSAC Fireside Chat: Bedrock Security introduces advanced approach to “commoditize” data discovery first appeared on The Last Watchdog.

When Log4J came to light in 2021, Kinnaird McQuade, then a security engineer at Square, drew the assignment of testing endpoints at some 5,000 users of the popular mobile payments service.

Related: The big lesson from Log4J

“It took us eight hours to run the scan and I was sweating it because these were all small family businesses that depended on Square, and if any of them got popped, it would be real people that were affected,” McQuade told me.

That ordeal proved to be a catalyst for McQuade, a renowned ethical hacker and creator of popular open-source security tools, to launch NightVision and succeed where static application security testing (SAST) and dynamic application security testing (DAST) have failed.

The focus is on providing a software testing solution that does not impede innovation, provides clear guidance to developers and identifies software vulnerabilities long before public release. Last week, NightVision announced the commercial availability of its first application security testing solution.

I visited with McQuade, who’s now NightVision’s CTO, and George Prince, CEO, at RSAC 2024 a couple weeks prior to their launch. For a full drill down, please give the accompanying podcast a listen.

NightVision recently announced $5.4 million seed backing of its hybrid approach to enable software developers to detect vulnerabilities quickly and accurately, tracing them back to the source code for immediate action. This capability is crucial as businesses increasingly rely on APIs, the vast majority of which remain undocumented and vulnerable to attacks, Prince observes.

“We’re solving a fundamental problem at its root,” Prince says. “Our tools make it possible to perform security scans in seconds, not hours, and offer actionable insights that help developers fix issues before they reach production. This not only saves time but also significantly reduces the risk of security breaches.”??

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: NightVision shines a light on software vulnerabilities, speeds up remediation first appeared on The Last Watchdog.

AI has the potential to revolutionize industries and improve lives, but only if we can trust it to operate securely and ethically.

Related: The key to the GenAI revolution

By prioritizing security and responsibility in AI development, we can harness its power for good and create a safer, more unbiased future.

Developing a secured AI system is essential because artificial intelligence is a transformative technology, expanding its capabilities and societal influence. Initiatives focused on trustworthy AI understand the profound impacts this technology can have on individuals and society. They are committed to steering its development and application towards responsible and positive outcomes.

Security considerations

Securing artificial intelligence (AI) models is essential due to their increasing prevalence and criticality across various industries. They are used in healthcare, finance, transportation, and education, significantly impacting society. Consequently, ensuring the security of these models has become a top priority to prevent potential risks and threats.

•Data security. Securing training data is crucial for protecting AI models. Encrypting data during transmissionwill prevent unauthorized access. Storing training data in encrypted containers or secure databases adds a further layer of security.

Data masking can safeguard sensitive data, even during breaches. Regular backups and a disaster recovery plan are essential to minimize data loss and ensure the security and integrity of training data, safeguarding AI models from potential risks and threats.

•Model Security. Model encryption should be employed to protect against unauthorized access, tampering, or reverse engineering. Watermarking or digital fingerprints can help track AI models and detect unauthorized use.

Digital signatures ensure the integrity and authenticity of models, confirming they have not been altered. Implementing model versioning is crucial for tracking updates and preventing unauthorized changes.

Mandadi

Additionally, regular testing and validation are necessary to ensure models function correctly and are free of security vulnerabilities. These measures collectively enhance the security of AI models, protecting them from potential risks. Attention to detail in these areas is vital:

•Infrastructure Security. Protecting hardware components like GPUs and TPUs used in training and deploying AI models is crucial. Updating software with the latest security patches and adhering to secure coding practices.

Implementing robust network security protocols, including firewalls and intrusion detection systems, is necessary to block unauthorized access. Cloud security is critical since many AI models are trained and deployed on cloud-based platforms.

Additionally, an effective incident response plan is essential for quickly addressing security incidents and mitigating the impact of breaches. Together, these measures ensure the infrastructure’s security and protect against potential risks and threats.

•Access controls. It is crucial to tightly control access to AI models, data, and infrastructure to prevent security incidents. Role-based access controls should limit access based on user roles and privileges, alongside robust authentication and authorization mechanisms.

Following the principle of least privilege access is vital, granting users only necessary access. Monitoring user activity helps detect and respond to potential security incidents.

•Secure development lifecycle. Building secure AI systems requires a systematic approach. By integrating security into every stage of AI development, organizations can ensure the confidentiality, integrity, and availability of their AI systems and data. You can build a secure AI system by following the steps below.

•Secure design. The secure design stage is foundational to the secure AI development lifecycle. It involves defining security requirements and threat models, conducting security risk assessments and architecture reviews, and implementing secure data management and privacy controls.

This stage ensures security is integrated into the AI system from the beginning, minimizing the risk of security breaches and vulnerabilities.

•Development. During the development stage, developers apply secure coding practices, conduct regular security testing and vulnerability assessments, utilize secure libraries and dependencies, and establish authentication, authorization, and access controls. This stage prioritizes security in the development of the AI system and addresses potential vulnerabilities early on.

•Deployment. Ensuring secure deployment configurations and settings is crucial during the deployment stage. Thorough security testing and vulnerability assessments are conducted beforehand. Utilizing secure deployment mechanisms and infrastructure is essential for securely deploying the AI system. Implementing robust monitoring and logging controls also mitigates potential security risks.

•Operation and maintenance. Once your AI system is operational, it should undergo continuous security monitoring. This includes regular updates, security assessments, and risk evaluations. Incident response and disaster recovery plans are also in place to maintain security and address potential incidents.

Developing secure AI systems requires a systematic approach that integrates security into every stage of AI development. Implementing robust security measures and ethical considerations builds trust in AI solutions, ensuring they are secure, reliable, and resilient. This approach enables AI to be a powerful tool for positive change.

About the essayist: Harish Mandadi, is the founder and CEO of AiFA Labs as CEO and Founder. AiFA Labs, which supplies comprehensive enterprise GenAI platforms for text, imagery and data patterns.

The post GUEST ESSAY: Taking a systematic approach to achieving secured, ethical AI model development first appeared on The Last Watchdog.

From MFA to biometrics, a lot has been done to reinforce user ID and password authentication — for human users.

Related: How weak service accounts factored into SolarWinds hack

By comparison, almost nothing has been done to strengthen service accounts – the user IDs and passwords set up to authenticate all the backend, machine-to-machine connections of our digital world.

Service accounts have multiplied exponentially in recent years and become a prime target of threat actors, since little has been done to beef up protection.

A just-out-of-stealth start-up, Anetac, has secured $16 million in funding to address this gaping blind spot. At RSAC 2024, I sat down with Baber Amin, Head of Product at Anetac, Diana Nicholas, co-founder of Anetac, to learn more.

Identity vulnerability is a dynamic problem, and Anetac’s platform dynamically provides real-time streaming visibility and monitoring of human and non-human accounts, service accounts, APIs, tokens and access keys. This approach contrasts with static scanning tools that have come along from the big name IAM solution providers, like Okta and CyberArk, Amin and Nicholas told me.

The idea for Anetac derived from asking companies about their pain points. “We spoke to major banks, insurance companies, and even small businesses,” Nicholas says. “The overwhelming response was that service account management is one of the biggest problems they face.”

Anetac’s platform can identify dormant accounts, map out weak protocol usage and even stop identity attacks in progress, Amin noted. For a full drill down on how Anetac aims to raise the bar, please give the accompanying podcast a listen. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

 

The post RSAC Fireside Chat: Start-up Anetac rolls out a solution to rising ‘service accounts’ exposures first appeared on The Last Watchdog.

Washington D.C., May 29, 2024, PRNewswire — DNSFilter announced today that it has joined the WeProtect Global Alliance to help prevent the spread of child sex abuse material (CSAM) online.

This partnership will help further WeProtect’s mission and work toward creating a safer online environment for children.

The WeProtect Global Alliance was founded to create a cohesive, comprehensive response to the widespread issue of online child sexual abuse and exploitation. It brings together partners from governments, non-profit organizations and the private sector to develop policies and solutions. Research by the Alliance has found that the volume of reported abuse material cases increased by 87% between 2019 and 2023.

As a cybersecurity company, DNSFilter’s role encompasses more than just defending against malware and phishing; it extends to protecting the physical and emotional safety of individuals. DNSFilter permanently blocks the CSAM category with no exceptions, underscoring the company’s commitment to protecting the safety of the individuals affected by this content.

In the first quarter of 2024 alone, DNSFilter has already blocked nearly 1 million requests for CSAM and is on track to block five times as much CSAM content this year as it did in 2023.

Membership of the Alliance will enable DNSFilter to help address this challenge on a wider-scale as well as for its own customers, including larger-scale organizations looking to lock down this section of the internet even more.

Iain Drennan, executive director, WeProtect Global Alliance, said: “The growth of child sexual abuse and exploitation online is not an inevitable consequence of technological advances, it is a preventable problem.

Drennan

“Technology has a significant role in providing solutions to the problem and we are delighted DNSFilter has joined the Alliance to share knowledge, collaborate and empower others. DNSFilter joins over 300 other member organizations worldwide from government, civil society and the private sector – together we are a real force for change in keeping children safe online worldwide.”

Ken Carnesi, CEO and co-founder, DNSFilter, said: “Blocking CSAM is inherent to what we do at DNSFilter, because online security goes beyond phishing and malware—it includes physical and emotional safety. Our goal is to protect people, not just the machines that they use.

Carnesi

“We take great pride in our firm stance against CSAM and feel fortunate to ally with such an impactful and passionate organization. We’re looking forward to learning from their educational resources and meetings and translating that knowledge into more effective strategies to protect children.”

 

The post News Alert: DNSFilter joins the WeProtect Global Alliance to help protect children online first appeared on The Last Watchdog.

The capacity to withstand network breaches, and minimize damage, is a key characteristic of digital resiliency.

Related: Selecting a Protective DNS

One smart way to do this is by keeping an eagle eye out for rogue command and control (C2) server communications. Inevitably, compromised devices will try to connect with a C2 server for instructions. And this beaconing must intersect with the Domain Name System (DNS.)

At RSAC 2024, I had an evocative discussion with David Ratner, CEO of HYAS, about advances being made in DNS security. For a full drill down, please give the accompanying podcast a listen.

HYAS gathers rich intelligence from multiple sources and then feeds it into a specialized graph database focused on a variety of infrastructure data including DNS traffic. This allow HYAS to isolate — and even predict — the formation of malicious infrastructure – before the attackers can fully weaponize the breached system.

“Our goal is to understand what’s going to be used as a command-and-control server in the future so that you can be blocking it now,” he told me.

DNS security and the overall Protective DNS space is rising in importance. The NSA’s Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems and subsequent CISA Shields Up initiative highlighted the necessity of such solutions. Additionally, cyber insurance carriers and the Department of Defense’s CMMC standard now recommend or require advanced protective DNS solutions.

Looking ahead, Ratner foresees protective DNS steadily advancing — to keep pace with C2 innovation sure to come from adversaries. As new attack patterns emerge, HYAS aims to adapt and expand its solutions to cut-off all types of C2 communications, he says.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Rich threat intel, specialized graph database fuel HYAS’ Protective DNS first appeared on The Last Watchdog.

Spread spectrum technology helped prevent the jamming of WWII radio-controlled torpedoes and subsequently became a cornerstone of modern-day telecom infrastructure.

For its next act, could spread spectrum undergird digital resiliency? I had an evocative discussion about this at RSAC 2024 with Dispersive CEO Rajiv Plimplaskar. For a full drill down, please give the accompanying podcast a listen.

For historical context, the U.S. military scattered radio-signals and added noise to radio transmissions — to prevent the jamming of torpedo controls. Decades later, the telecom industry figured out how to spread WiFi, GPS, BlueTooth and 5G signals over a wide bandwidth and then also added pseudo-random codes — to prevent tampering.

Dispersive launched in 2021 to adapt these same concepts to protecting sensitive network transmissions in a highly dynamic environment. Here what Plimplaskar told me:

“We’re leveraging spread spectrum concepts in terms of how conventional TCP/IP and UDP type of traffic is communicated between users and sites, cloud estates and sites and amongst each other. We take the information of value and split it across multiple streams. These streams travel across randomized pathways, across whatever infrastructure is available to them, and when they get to the destination, they are reassembled and reordered for consumption.”

Encryption gets applied across multiple planes and gets dynamically rotated, based on a predefined or policy-driven interval, he noted. The streams traverse a “situationally- aware” network that can “react in real time to a degraded network situation or even a cyber event.”

A step forward for resiliency. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Dispersive adapts WWII radio-signal masking tool to obfuscating network traffic first appeared on The Last Watchdog.