With the rapid advancement and adoption of artificial intelligence (AI) in cybersecurity, the benefits of speed and accuracy are becoming clearer every day.

In their 1955 proposal for a summer research project on artificial intelligence (AI), researchers at Dartmouth Conference predicted "…every aspect of learning or any other feature of intelligence can in principle be so precisely described that a machine can be made to simulate it." In the decades that followed, AI research continued at what seemed a glacial pace, always promising a breakthrough in the near future — until language tools like ChatGPT finally exploded on the scene.

As we find our footing with AI today, it's clear that we're facing risks as well as benefits. A recent survey of 1,500 IT professionals showed that nearly half (49%) of decision-makers are concerned the new tools will help cybercriminals, but a full 82% said they plan to integrate AI into their security programs over the next two years.

**AI Is the Hero to Embrace, Not the Villain to Defeat**

Rapid advancements in AI since the 1950s set the stage for growth — with no signs of slowing. The global market for AI-based security tools is expected to reach $133 billion by 2030 with more integration and use in daily DevSecOps workflows. As the industry incorporates AI and machine learning (ML) into more processes, we're seeing more and more opportunities to engage AI as a force for good, including the following.

**Faster and More Accurate Configuration for Security Tools**

To be effective, most security technologies today require a lot of manual fine-tuning, often through sophisticated parameter tweaks. Depending on the tool, these can affect what incidents are reported, what vulnerabilities a tool finds, or how issue priorities are determined. All these manual tweaks are time-consuming and can leave you exposed to threats until the right configurations are in place.

That's where machine learning comes to the rescue. In this case, ML can continually optimize parameters, for instance by prioritizing items in a scanning queue to ensure operations run as efficiently as possible. Once they automate these configuration tasks, future cybersecurity teams will spend far less time on tedious manual work.

**Improved Risk Scoring and Threat Intelligence**

Modern scanning tools typically provide a risk assessment once a scan is complete. This shows the various levels of security protection and potential risk across your applications, websites, and networks for a better view of your threat exposure. Different tools will factor in different data, such as the technical severity of vulnerabilities, their potential exploitability, their impact on business if exploited, and their importance for your overall security posture.

While useful, these assessments don't always provide deeper context or guidance, which are necessary for security to keep up with fast-paced software development. In the coming years, security tools will extensively use machine learning for evaluating risk and managing threats. As machine-generated results continue to improve in scope and quality, they will support more accurate, data-based decision making by showing which issues are actionable and in what order they should be addressed to minimize risk.

**Putting a Sharper Edge on Security Testing**

As ChatGPT and similar tools powered by large language models (LLMs) are refined and continue to gain popularity, we can expect easier access to ever more accurate insights. By encouraging engineers and developers to safely use AI and ML in their work, these machine-driven solutions should also provide better and more useful insights over time — even more so when accurate security guidance is included in the mix.

When it comes to security testing, training AI/ML tools to become sharper will further help with fine-tuning static application security testing (SAST) and dynamic application security testing (DAST) tools. Ultimately that means increasing control and precision for scan results, providing reliable intelligence into current and future risks, and improving the efficacy of vulnerability hunting.

**Fewer False Positives for Less Manual Verification**

False positives are a persistent challenge for security and one that frequently translates into hours of manual work checking scan results. As teams spend valuable time verifying reports that should already be as accurate as possible, they can lose confidence in security tools and processes. Fortunately, a recent study by IBM showed that AI can reduce false positives by 65%, freeing resources for activities that add business value.

As the technology progresses, business and operational leaders will have the reliable data they need to confidently make decisions based on accurate AI/ML results. These outputs will harness the power of learning systems to deliver clear and actionable vulnerability reports, allowing DevSecOps teams to focus on what matters most: building and delivering innovative applications.

**Winning the Race to AI Supremacy in Security**

From threat identification to tool configuration, we're already seeing tangible impacts of AI in cybersecurity. Where researchers at the Dartmouth Conference nearly 70 years ago were only speculating, cybersecurity professionals today should look for far more tangible opportunities to incorporate AI and ML into their operations and strategies. If we can realize the potential of existing and emerging tools to continuously improve cybersecurity, AI can truly be one of the good guys.

**About the Author**

    

Frank Catucci is a global application security technical leader with over 20 years of experience designing scalable application security-specific architecture, partnering with cross-functional engineering and product teams. Frank is a past OWASP chapter president and contributor to the OWASP bug bounty initiative and most recently was the Head of Application & Product Security at Data Robot. Prior to that role, Frank was the Sr. Director of Application Security & DevSecOps and Security Researcher at Gartner, and was also the Director of Application Security for Qualys. Outside of work and hacking things, Frank and his wife maintain a family farm. He is an avid outdoors fan and loves all types of fishing, boating, watersports, hiking, camping, and especially dirt bikes and motorcycles.

Getting Smart With Cybersecurity: AI Can Help the Good Guys, Too

CISOs offer recommendations to help secure identities, data, code, and cloud infrastructure and protect against evolving threats and vulnerabilities.

The COVID-19 pandemic ignited an unprecedented wave of remote work adoption, forcing organizations to rapidly embrace remote collaboration tools. However, the transition to remote work came with its own set of challenges, especially in ensuring robust security measures for remote access. Today, CISOs face a new frontier — a borderless enterprise landscape — where they must forge a strong security posture to protect their organizations from evolving threats and vulnerabilities.

To better understand these demands, Cisco partnered with Forgepoint Capital, NightDragon, and Team8 to evaluate the evolving threat landscape and gather invaluable insights and takeaways that chief information security officers (CISOs) can leverage to prepare for the future. Together, we created the 2023 CISO Survival Guide, a simple framework for understanding how teams can secure modern enterprises by defining the security posture of identities, data, and code that are distributed across a hybrid infrastructure.

**Identity**

Identity management is a critical concern for CISOs, as the lack of a unified platform across identity access management (IAM), identity governance and administration (IGA), and privileged access management (PAM) leads to a fragmented identity topology within organizations. CISOs express the need for technology startups to address this pain point by offering solutions that are easier to deploy, provide comprehensive coverage, and offer rich integrations.

**Data**

CISOs are no longer tasked with security alone. They are also now responsible for securely enabling overall collaboration and business operations. This means they must balance data protection and use. To do this, CISOs are breaking data down into four key categories:

*   **Data collaboration:** Being able to locate and apply data governance controls on distributed data.
*   **Data reliability:** Making sure data is accurate and useable.
*   **Data privacy management:** Applying governance, risk, and compliance controls to adhere to data privacy regulations and enable analytics on sensitive data.
*   **Data protection:** Finding, categorizing, and remediating access so that all data serves its intended purpose.

**Code**

As agile DevOps creates a more rapid software development life cycle, enterprise security will only be as strong as its weakest link: the software supply chain. To give an idea of how big a deal this is, 70% of CISOs surveyed say they are prioritizing securing the software supply chain. To do this, CISOs will need full visibility into the development pipeline so that they can adopt a holistic strategy, which includes open source governance, delivery pipeline management, and an understanding of risk in third-party software.

Third-party software is its own issue. It supports quick innovation while operating a distributed workforce, but it can be a black box for CISOs looking to secure their enterprise. Third parties should be held to the same security standards as the rest of the enterprise.

**Infrastructure**

If it is connected, it needs to be secured, even if you can't see it. This is the cloud. By 2025 more than 85% of enterprises are expected to embrace a cloud-first approach. That means cloud security must be near the top of any CISO's priorities because attackers are shifting to the cloud just as quickly as enterprises. There are many tools out there that let enterprises address data challenges related to the cloud, but they don't necessarily go far enough to help CISOs discover the who, what, and where in the event of a data breach.

**CISO Survival Guide**

There is a lot that CISOs must do to stay ahead of these constantly evolving cybersecurity threats. Thankfully, emerging technology startups are providing fresh solutions to help CISOs stay one step ahead of the game in securing their enterprises. Defining security postures of the identities, data, and code distributed across a hybrid infrastructure is just one part to having a secured network that can protect data with a distributed workforce.

For more information, with an in-depth look at survey results as well as insights and analysis from CISOs, read the 2023 CISO Survival Guide from Cisco.

**About the Author**

    

Janey Hoe is a Vice President of Cisco Investments. Previously, she held multiple product management, technical marketing, and business development leadership roles at Cisco, operating multi-billion-dollar product lines as well as pioneering new products in switching, security, data center, and video collaboration. Along with her team, she was recognized as a finalist for the Pioneer Award, the highest honor for innovation at Cisco.

Securing Modern Enterprises in a Borderless Landscape

The CISO role has evolved from a strictly technical position to one that increasingly requires business acumen. Here are some things you need to know.

What types of skills do CISOs need now? As senior vice president and chief information security officer (CISO) of one of the world's most trusted cybersecurity software and services companies, it's literally my job to know.

My responsibilities include protecting and enabling business development at a global organization that wears a big target on its back. We are also "customer zero" at a company that believes deeply in the need to "drink its own champagne." That means we base our cyber defenses on our own internally developed products to the greatest extent possible.

In addition, we're a managed security service provider (MSSP) through our CylanceGUARD managed detection and response (MDR) subscription service, and many of our channel partners are also MSSPs, all using BlackBerry Cylance artificial intelligence (AI)-based products to protect external organizations.

The ultimate decision-maker for purchasing and deploying our portfolio of cyber products is often the CISO of an organization. For all these reasons and more, I spend a fair amount of time talking to fellow CISOs and comparing notes on what keeps us up at night and what success looks like for a modern CISO.

Over two decades of cybersecurity and technology experience across a wide range of industries and organizations have helped me grow as a leader and afforded me many opportunities to "give back" by sharing hard-won knowledge with other cybersecurity professionals. I have watched the CISO role evolve from a strictly technical position to one that increasingly requires business ability and acumen.

Today's CISOs must be able to effectively evaluate both risk and opportunity. They must be able to formulate and execute strategies to strike a healthy balance between these two competing factors and communicate those solutions to senior leadership.

**What Future CISOs Need to Know**

If you are already a CISO, you are well aware of the way this role has pivoted. But what if you are a cybersecurity professional aspiring to reach a CISO role? What kind of mindset and skills should you cultivate? Here are a few to consider.

*   **CISOs must be critical thinkers:** In our digitized world, CISOs play a pivotal role beyond the technical aspects by engaging in strategic business discussions. Their input should be integral to organizational decision-making, requiring a balance of technical and business acumen.
*   **CISOs must be educators:** With increasing reliance on CISO insights for business decisions, they must educate boards and decision-makers and often report directly to CEOs. Staying updated on industry trends and aligning decisions with current risks is essential.
*   **CISOs must value different perspectives:** Effective CISOs benefit from diverse security perspectives gained through experiences in various industries and roles. A broad background spanning different functions equips them to excel in their roles.
*   **CISOs are cybersecurity evangelists:** As cybersecurity leaders, CISOs promote a multi-layered defense strategy, encompassing both technological advancements and workforce awareness. They ensure that end users are informed about risks and contribute as an additional layer of defense.

**Final Advice for All Information Security Professionals**

As you build and mature your program using multi-layered defenses, always bear in mind that _cyber risk can only be managed, never eliminated_. For today's CISOs and those of the future, cyber-risk is another type of business risk every organization will continually face.

In an interview earlier this year, I shared what I think are the top cyber-risk challenges facing CISOs.

I hope these perspectives will help you on your CISO journey, no matter which stage of your career you are in.

**About the Author**

    

Arvind Raman is a Senior Vice President and BlackBerry's Chief Information Security Officer. In this role, he leads all aspects of the company's information security, product security, and GRC program globally, focusing on effective management of cybersecurity risks, policies, and procedures.

Arvind brings over 20 years of information security, technology, R&D experience, and leadership to BlackBerry. Arvind's previous experience includes serving as the Global CISO at Mitel, Global Head Information Security for Scotia Bank, and Director of Cyber & Data Security for CIBC.

CISO Skills in a Changing Security Market: Are You Prepared?

Try these tricks for devising an education program that gets employees invested — and stays with them after the training is over.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

10 Tips for Security Awareness Training That Hits the Target

CrowdStrike is moving deeper into application security with its agreement to acquire Bionic, provider of ASPM technology that proactively scans software in production for vulnerabilities.

CrowdStrike’s acquisition of Bionic last month is an example of how the company is strengthening its cloud security offerings.

Omdia senior principal analyst Rik Turner believes Bionic will lift CrowdStrike, best known as a leading extended detection and response (XDR), into a significant player in reactive cloud security. "This deal not only takes CrowdStrike into the world of AppSec but also the proactive side of the security market," Turner wrote in a research note.

The acquisition brings Cloud Native Application Protection Platform (CNAPP) and Application Security Posture Management (ASPM) capabilities to CrowdStrike’s Falcon platform. The company plans to combine the Falcon Horizon Cloud Security Posture Management (CSPM) and Falcon Cloud Workload Protection (CWP) modules with Bionic’s technology into a unified dashboard to allow DevOps teams the ability to prioritize cloud security incidents, mitigate runtime threats and provide threat hunting, the company said. Bionic said its ASPM features proactively discovers security, data privacy, and operational risks by continuously scanning and analyzing an organization’s application architecture and software dependencies to uncover any anomalies. Notably, it provides views into the security posture of applications in production.

At CrowdStrike’s Fal.Con user event last month, CrowdStrike president Mike Sentonas demonstrated how Bionic can expand CrowdStrike’s cloud security portfolio to include cloud infrastructure entitlement management (CIEM) capabilities. Bionic can provide visibility into Amazon Web Services and Microsoft Azure applications and the third-party services they communicate with, Sentonas said.

Developers update microservices and serverless functions daily through their CI/CD pipelines. Sentonas showed how Bionic mapped 102 application services, presented their dependencies, and identified how they communicate with each other. “You can drill into each cloud and see what business applications are running,” he said.

Proactive security consists of tools that can identify and remediate vulnerabilities, excessive access permissions and misconfigurations before threat actors discover and exploit them, according to Omdia’s Turner. “It is an approach that complements rather than replaces reactive security, effectively reducing the attack surface that reactive platforms such as XDR and the SIEM/SOAR continuum must address,” Turner said.

Many CrowdStrike customers attending the Fal.Con were familiar with Bionic, and some say they intend to evaluate it, such as Prabhath Karanth, global head of security and Trust at Navan (formerly TripAdvisor). "I’ve looked at Bionic in the past, and they have really good runtime application security technology in the context of the infrastructure," Karanth says.

"It sounds like they want to approach the problem from a runtime perspective and address the problem of running your applications and containers and all of that in production," Karanth says. "Because in a distributed microservices architecture, where your application is sitting in a containerized environment, this container runtime security becomes critical. I’d like to know more. It was just announced. But I think it’s a very strategic acquisition."

Bionic gives organizations a comprehensive view of the risk associated with everything that’s running in the cloud — the applications, the microservices, and everything that’s connected to it — which really represents risk, CrowdStrike founder and CEO George Kurtz said during the opening keynote at the Fal.Con event last month.

"The beauty and the magic of this technology is that you don’t need source code, or you don’t have to plug in the libraries," Kurtz said.

What the Bionic Acquisition Can Bring to CrowdStrike

The "iLeakage" attack affects all recent iPhone, iPad, and MacBook models, allowing attackers to peruse your Gmail inbox, steal your Instagram password, or scrutinize your YouTube history.

Researchers have developed a side-channel exploit for Apple CPUs, enabling sophisticated attackers to extract sensitive information from browsers.

Side-channel attacks are usually overlooked, often physical counterparts to traditional software hacks. Rather than an unsecured password or a vulnerability in a program, they take advantage of the extra information a computer system or hardware generates — in the form of sound, light, or electromagnetic radiation, for example, or in the time it takes to complete certain computations (a timing attack).

On Wednesday, four researchers — including two of those responsible for uncovering the Spectre processor vulnerability back in 2018 — published the details of such an attack, which they've named "iLeakage," affecting all recent iPhone, iPad, and MacBook models.

The researchers informed Apple of their findings on Sept. 12, 2022, according to their website, and the company has since developed a mitigation. However, it's still considered unstable, it's not enabled on devices by default, and mitigating is only possible on Macs, not mobile devices.

In comments provided to Dark Reading on background, an Apple spokesperson wrote, "This proof of concept advances our understanding of these types of threats. We are aware of the issue and it will be addressed in our next scheduled software release."

**How iLeakage Works**

iLeakage takes advantage of A- and M-series Apple silicon CPUs' capacity to perform speculative execution.

Speculative execution is a method by which modern CPUs predict tasks before they're even prompted, in order to speed up information processing. "This technique has been around for over 20 years, and today all modern CPUs use it — it significantly speeds up processing, even accounting for times it might get the anticipated instructions wrong," explains John Gallagher, vice president of Viakoo Labs.

The rub is that "cache inside the CPU holds a lot of valuable data, including what might be staged for upcoming instructions. iLeakage uses the Apple WebKit capabilities inside a browser to use JavaScript to gain access to those contents."

Specifically, the researchers used a new speculation-based gadget to read the contents of another webpage when a victim clicked on their malicious webpage.

"Alone, WebKit would not enable the cache contents to be divulged, nor would how A-Series and M-Series perform speculative execution — it's the combination of the two together that leads to this exploit," Gallagher explains.

**A Successor to Meltdown/Spectre**

"This builds on a line of attacks against CPU vulnerabilities that started around 2017 with Meltdown and Spectre," Lionel Litty, chief security architect at Menlo Security points out. "High level, you want to think about applications and processes, and trust that the operating system with help from the hardware is properly isolating these from one another," but those two exploits broke the fundamental isolation between different applications, and an application and operating system, that we tend to take for granted as users, he says.

iLeakage, then, is a spiritual successor that focuses on breaking the isolation between browser tabs.

The good news is, in their website's FAQ section, the researchers described iLeakage as "a significantly difficult attack to orchestrate end-to-end," which "requires advanced knowledge of browser-based side-channel attacks and Safari's implementation." They also noted that successful exploitation hasn't been demonstrated in the wild.

Were a capable enough attacker to come along and try it, however, this method is powerful enough to siphon just about any data users traffic online: logins, search histories, credit card details, what have you. In YouTube videos, the researchers demonstrated how their exploit could expose victims' Gmail inboxes, their YouTube watch histories, and their Instagram passwords, as just a few examples.

**iPhone Users Are Especially Affected**

Though it takes advantage of the idiosyncrasies in Safari's JavaScript engine specifically, iLeakage affects all browsers on iOS, because Apple's policies force all iPhone browser apps to use Safari's engine.

"Chrome, Firefox and Edge on iOS are simply wrappers on top of Safari that provide auxiliary features such as synchronizing bookmarks and settings. Consequently, nearly every browser application listed on the App Store is vulnerable to iLeakage," the researchers explained.

iPhone users are doubly in trouble, because the best fix Apple has released thus far only works on MacBooks (and, for that matter, only in an unstable state). But for his part, Gallagher backs Apple's ability to design an effective remediation.

"Chip-level vulnerabilities are typically hard to patch, which is why it is not surprising that there is not a fix for this right now. It will take time, but ultimately if this becomes a real exploited vulnerability a patch will likely be available," he says.

Safari Side-Channel Attack Enables Browser Theft

The financially motivated English-speaking threat actors use advanced social engineering techniques, SIM swapping, and even threats of violence to breach targets.

The financially motivated hacking group Octo Tempest, responsible for attacking MGM Resorts International and Caesars Entertainment in September, has been branded "one of the most dangerous financial criminal groups" by Microsoft's Incident Response and Threat Intelligence team.

The group, also known as 0ktapus, Scattered Spider, and UNC3944, has been active since early 2022, initially targeting telecom and outsourcing companies with SIM swap attacks.

It later shifted to extortion using stolen data, and by mid-2023 the group had partnered with ALPHV/BlackCat ransomware, initially leveraging the ALPHV Collections leak site and later deploying the ransomware, focusing on VMWare ESXi servers.

Microsoft's in-depth post about the group and its extensive range of tactics, techniques, and procedures (TTPs) details the evolution of Octo Tempest and the fluidity of its operations.

"In recent campaigns, we observed Octo Tempest leverage a diverse array of TTPs to navigate complex hybrid environments, exfiltrate sensitive data, and encrypt data," the report notes. "Octo Tempest leverages tradecraft that many organizations don't have in their typical threat models, such as SMS phishing, SIM swapping, and advanced social engineering techniques."

**The Multi-Armed 0ktapus Cybercrime Playbook**

The group gains initial access through advanced social advanced social engineering techniques, often targeting employees with access to network permissions, including support and help desk personnel.

The attackers call these individuals, and attempt to persuade them to reset user passwords, change or add authentication tokens, or install a remote monitoring and management (RMM) utility.

The group is not beyond leveraging personal information, such as home addresses and family names, or even making physical threats, to coerce victims into sharing corporate access credentials.

During the initial stages of the attacks, Octo Tempest conducts extensive reconnaissance, which includes gathering data on users, groups, and device information, and exploring network architecture, employee onboarding, and password policies.

The group uses tools including PingCastle and ADRecon for Active Directory reconnaissance, and the PureStorage FlashArray PowerShell SDK for enumerating storage arrays.

They reach deep into multi-cloud environments, code repositories, and server infrastructure, aiming to validate access and plan footholds for subsequent attack phases, a process that helps the group enhance their activities within targeted environments.

**Partnering With Russians: Unprecedented Fusion of Tactics, Tools**

Callie Guenther, senior manager of cyber threat research at Critical Start, says English-speaking Octo Tempest's affiliation with the Russian-speaking BlackCat group signifies an "unprecedented fusion" of resources, technical tools, and refined ransomware tactics.

"Historically, the distinct boundaries maintained between Eastern European and English-speaking cybercriminals provided some semblance of regional demarcation," she explains. "Now, this alliance allows Octo Tempest to operate on a wider canvas, both geographically and in terms of potential targets."

She notes that the convergence of Eastern European cyber expertise with the linguistic and cultural nuances of English-speaking affiliates enhances the localization and efficacy of their attacks.

From her perspective, the multifaceted approach Octo Tempest employs is particularly alarming.

"Beyond their technical prowess, they've mastered the art of social engineering, adapting their tactics to impersonate and blend seamlessly into targeted organizations," she says. "This, combined with their alignment with the formidable BlackCat ransomware group, amplifies their threat manifold."

She notes the real concern emerges when one realizes they've diversified from specific industries to a broader spectrum and are now unafraid to resort to outright physical threats, showcasing a concerning escalation in cybercriminal tactics.

Tony Goulding, cybersecurity evangelist at Delinea, agrees the blend of sophisticated techniques, broad scope of industries targeted, and their aggressive approach — even resorting to physical threats — are the most dangerous aspects of the group.

"Organizations should be very concerned," he explains. "Being native English speakers, they can more effectively launch wide-ranging social engineering campaigns compared to BlackCat."

He says this is particularly beneficial when using idiolect methods to convincingly impersonate employees during phone calls.

"Proficiency in English also helps them craft more convincing phishing messages for their signature SMS phishing and SIM swapping techniques," he adds.

**Defense In-Depth**

Guenther says defending against Octo Tempest's financial pursuits involves a series of proactive and reactive measures, adhering to the principle of least privilege to ensure restricted access.

"Cryptocurrencies should be stored in offline cold wallets to minimize online exposure," she advises. "Continual system updates and anti-ransomware solutions can thwart most ransomware deployments."

Advanced network monitoring can detect anomalous data flows, indicative of potential data exfiltration attempts.

"In case of breaches or attacks, an established incident response strategy can guide immediate actions," she adds. "Collaborative threat intelligence sharing with industry peers can also keep organizations abreast of emerging threats and countermeasures."

Goulding points out education, awareness training, and technical controls that vault privileged accounts and protect access workstations and servers are key.

"Putting obstacles in the path of threat actors all along the attack chain, to divert them from their playbook and generate noise, is super important for early detection," he says. "The more advanced and proficient the attack group, the better prepared they will be, so investing in the best tools that include modern capabilities is your best bet."

Octo Tempest Group Threatens Physical Violence as Social Engineering Tactic

Preventative security should be driven by data and risk assessment, not compliance.

As organizations increasingly move their data and workloads to the cloud, securing cloud identities has become paramount. Identities are the keys to accessing cloud resources, and, if compromised, they enable attackers to gain access to sensitive data and systems.

Most attacks we see today are client-side attacks, in which attackers compromise someone's account and use their privileges to move laterally and access sensitive data and resources. To prevent this, you need visibility into your cloud's identity infrastructure. Unless you know the identity of all the people and objects that are accessing systems, their permissions, and their relationships, you won't have the context necessary to effectively assess your risk and take preventative measures.

A number of high-profile attacks illustrate this problem. A compromised cloud identity gave attackers access to SolarWinds' Orion software, where they deployed malicious code to thousands of their customers, including government agencies and Fortune 500 companies. Another example is the Microsoft Exchange attack, in which attackers exploited a vulnerability in Exchange to gain access to email accounts. From there, they stole sensitive data and sent phishing emails in an attempt to compromise other accounts.

For securing the cloud, I advise implementing an approach known as applied risk, which allows security practitioners to make decisions about preventative actions based on contextual data about the relationship between identities and what the downstream impacts of threats are in their specific environments. Here are some practical tips for adopting applied risk.

**Treat Cloud Protection as a Security Project, Not a Compliance Exercise**

For starters, shift your mindset. Gone are the simple days of client-server computing. The cloud environment is a complicated system of data, users, systems, and interactions between all of them.

Checking a series of boxes won't bring greater security if you don't understand how everything works together. Most teams take an unguided approach to preventive security, putting blind faith in the prioritization and remediation strategy put in place years ago. Yet security requires a bespoke approach tailored to every security team based on the organization's broader risk exposure. Not every "critical" alert from a security vendor is necessarily the biggest risk to that specific environment.

To accurately prioritize remediation and reduce risk, you must consider the entire attack surface. Understanding the relationships between exposures, assets, and users help you to determine which issues pose the greatest risk. When you take into account additional context, the "critical" finding may not be the biggest issue.

**Get Visibility Into Your Cloud Identity Infrastructure**

Next, visibility is key. To credibly identify the applied risk, you should do a comprehensive audit of all the identities and access control points in your cloud identity infrastructure. You need to know what resources you have in your environment, whether they're in the cloud or on-premises, how they're provisioned and configured, and other variables.

When securing the cloud, you can't only look at how cloud-specific resources are configured — you have to audit the identity aspect: virtual machines (VMs), serverless functions, Kubernetes clusters, and containers, for instance. One admin may have an account tied to AWS, an Active Directory account with a different role to log into their local systems, an account on GitHub, a Salesforce account, etc. You also have to consider things like the hygiene of the machines that the developers, DevOps, and IT teams are using. A successful phishing attack on a DevOps engineer can have a massive impact on the security posture of your cloud environments.

From there, you should map the relationships between identities and the systems they access. This is an important part of understanding your attack surface. Cloud-native application protection platforms (CNAPPs) are designed to help with this. Having a strong CNAPP platform gives the security team the ability to detect abnormal behavior around a particular identity and detect when configurations start to drift.

**Align Your Different Teams**

Once you have the identities and the relationships mapped out, you need to tie them to vulnerabilities and misconfigurations to determine where you are most vulnerable and start quantifying the applied risk. You can't create an effective remediation strategy without that.

But data and strategy will take you only so far. Teams tend to operate in silos, and each follows prioritization actions based on the specific software they are using, without communication with other teams or alignment on a holistic vision for minimizing risk. Because not every attack surface is the same, you need to structure the organization so that different skill sets can take mitigative action based on the variables specific to their environment.

When teams are coupled more closely, organizational risk drops. Let's say you have a cross-site scripting vulnerability in one of your Web applications. Wouldn't it make sense to prioritize any security or configuration issue associated with the infrastructure running that application? The inverse is also true. Does it not make more sense to address the vulnerability that is running in production or sitting on the Internet versus a vulnerability running in a dev environment with no chance of exploitation?

A large part of the reason security teams work in these silos is because the vendor landscape has kind of forced them to work this way. Until recently, there hasn't been a way to do the things I'm proposing here — at least not for anyone but the 1% of organizations that have vast security budgets and built in-house tools and teams.

To sum up, protecting identities — cloud and otherwise — requires adopting a mindset shift from compliance to a holistic security, applied risk approach that involves gaining visibility into your cloud infrastructure with CNAPP and aligning different teams on prioritizing remediation.

Securing Cloud Identities to Protect Assets and Minimize Risk

When investing in a unified endpoint management solution, prioritize the needs of your network and users ahead of brand names. This Tech Tip focuses on questions to ask.

A high-caliber, enterprise-grade unified endpoint management (UEM) solution is more critical than ever in today's remote, hybrid, and constantly fluctuating work landscape. If you're in procurement or finance, you're likely under a lot of pressure to choose the right one. You must drive operational efficiency through cost savings and overhead optimization.

For many organizations, Microsoft Intune (rebranded from Microsoft Endpoint Manager \[MEM\] and generally sold as part of an MS Enterprise License Agreement \[ELA\]) looks like a solid choice for endpoint management. It's a cloud-based solution with clear name recognition. Another plus: Microsoft's Intune plan pricing seems very approachable.

Other options have less name recognition than Microsoft but may be a better fit depending on an organization's needs. For example, according to G2, Ivanti Neurons for UEM gets high ratings for quality of support and ease of use. Atera offers particular expertise for small businesses. NinjaOne is rated well for being "a good partner in doing business."

The upshot: Organizations should not be making purchasing decisions based on brand name and pricing. Instead, companies should look beneath the surface before investing in technology, particularly in high-stakes scenarios with serious return on investment (ROI) potential.

**What to Ask Before Investing in a UEM Solution**

We cannot attempt to discuss the pros and cons of every major UEM solution available. With that in mind, here's what I recommend asking when evaluating a UEM solution:

1.  What type of devices will I be using the UEM solution for? Is it primarily mobile, mostly laptops or desktops, or a combination?
2.  Are my endpoints dispersed regionally, globally, or mostly on-site behind a perimeter?
3.  How is my IT help desk going to support and troubleshoot these devices? What is the additional cost per year to support?
4.  How many employees will be involved, and what's the cost per employee?
5.  What are the licensing agreements like? Do I need to buy a whole pie when I only want a slice?
6.  How is pricing structured? Will it scale based on usage?
7.  Do my employees exclusively use one type of device and operating system or a mix? If it's the latter, will the UEM solution work just as well regardless of the device type and OS used?
8.  Would my IT and security team benefit more from a central dashboard with a single-pane-of-glass view or integrated Mobile Threat Defense capabilities?
9.  How does the solution integrate with my other vendors/solutions and third-party apps?
10.  How many more IT employees will it take to manage? Does it require more servers?

Some of those questions might sound overly technical to those in finance and procurement, but your answers can significantly affect your true usability and costs.

**Get the Full Picture of Your Total Cost of Ownership**

As a rule, technology must suit the organization using it, and no technology solution is suitable for everyone. Total cost of ownership, for instance, is important, and it varies among solutions. Let's look at Intune as an example.

For all its strengths and lightweight supports on operating systems such as Android and macOS, Intune is not recommended for some verticals and businesses that require robust support on third-party applications. It is not intended as a complete systems-management platform. Part of the reason it might look like you're saving money by switching to Intune is because it's built primarily for a narrow subset of needs — and those needs are more cost-effective for Microsoft to handle.

Suppose you have diverse endpoints and many third-party apps to manage and integrate. In that case, you'll end up in a tough spot — either tolerating significant vulnerability or shelling out more for a comprehensive solution to pick up the slack. You'll also likely need to acquire additional software to run on certain operating systems. Furthermore, Microsoft charges additional costs per year for its Remote Help/Remote View of mobile devices.

There are more gaps like this, but perhaps most critically for finance, Microsoft Intune's pricing is based in part on the volume of data transmitted. These usage fees are challenging to predict and budget for and can add up. It becomes problematic when deciding between facilitating an unlimited flow of protected data or managing costs. Additionally, I've seen many enterprises having to buy more servers to manage Intune and hire additional administrators to manage those servers.

**The Bottom Line for Your Bottom Line**

In this example, Microsoft Intune is a fantastic option if:

*   You need a robust solution for lightweight mobile applications mainly on the same OS.
*   Your use case is straightforward enough that a single-pane-of-glass view isn't relevant.
*   The numbers look favorable based on your usage needs.

If you have more complicated requirements, perform due diligence to identify more flexible options.

Regardless of where you end up, do not go _without_ a UEM solution. Your company's security depends on it.

Understand the True Cost of a UEM Before Making the Switch

Groups have fallen silent after bold claims of action at the start of the conflict.

Hacktivist cyber activities around the Israel-Hamas conflict have significantly slowed, with some groups no longer plotting such attacks and others focusing on targets outside Israel.

Research of Dark Web discussions released this month by Security Scorecard found several hacktivist groups had made plans to conduct attacks or identified targets to be attacked, but many groups have since fallen silent or resorted to selling attack services.

A pro-Palestinian group, Dark Storm Team, posted claims in August 2023 on Dark Web forums that it would "attack Israel infrastructure," and in early October, claimed to be preparing attacks against Israel's European allies. However, as of Oct. 20, it had reverted to promoting its DDoS-as-a-service options.

Many hacktivist groups threatened to launch disruptive attacks against Israel and Palestine, while the hacktivist group SiegedSec claimed responsibility for a series of attacks against Israeli infrastructure and industrial control systems.

In addition, the Persian language-speaking, pro-Palestinian hacktivist channel Solomon's Ring has not claimed an attack since Oct. 8. Despite being active since October 2022 and its claims of hacking and stealing data from an Israeli data center, there is no evidence of this nor of any leaks of that data.

KillNet Palestine (potentially a division of the Russian hacktivist group KillNet), meanwhile, has not posted any new content since a message announcing its formation on Oct 13.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading