Complex multicloud environments present organizations with security challenges, but also opportunities for efficiency.

Many enterprises find themselves with hybrid and multicloud environments. While the days where everything was either on-premises or in private clouds are gone, it is far from the case that enterprises have put all — or even the vast majority of — their applications and infrastructure into the cloud. Further, it is nearly never the case that an enterprise has consolidated everything into a single cloud provider; instead, businesses operate with a complex mix of diverse environments. It appears that this will be the case for quite some time.

What may be less known, or at least less considered, is the amount of complexity and the number of challenges that these environments bring. What this means for most enterprises is that they find themselves struggling to efficiently manage and secure hybrid and multicloud environments. In addition, many enterprises find themselves spinning up and maintaining multiple technology stacks within each environment, often requiring entire teams dedicated to this function. As the popular security mantra so aptly says, complexity is the enemy of security.

How so? For starters, complexity introduces the opportunity for human error and oversight. This often brings with it security holes, which in turn increase the attack surface of business-critical applications and the infrastructure they run on.

To get an idea of how complex of an environment most enterprises are faced with, let's look at a few data points from F5's "2023 State of Application Strategy" report:

*   85% of organizations operate multiple application architectures and locations.
*   90% of organizations that maintain multicloud infrastructures report challenges.
*   42% of organizations leverage four or more cloud providers.
*   37% of applications are deployed on-premises.
*   15% of applications are deployed in the cloud.
*   58% of organizations are using digital services to substantially drive the business, with those services accounting for half or more of the firm's annual revenue.

The data clearly articulates the complexity that most enterprises face, and it also shows that hybrid and multicloud environments — and the challenges they bring — are here to stay.

**Business Challenges of Multicloud Environments**

What are some of these challenges that businesses face? While not an exhaustive list, here are a few of them:

*   Managing and securing multiple complex environments.
*   Applying policy and security consistently across diverse environments.
*   Easily provisioning the required networking and security infrastructure.
*   Deploying applications easily where required across the ecosystem.
*   Ensuring the requisite connectivity and security across applications.
*   Needing a central console to manage multiple complex environments.
*   Gaining visibility into infrastructure and applications to ensure health, compliance, and security.
*   Properly monitoring for and responding to infrastructure and security issues.

Thankfully, enterprises have options when it comes to addressing these points and can leverage distributed cloud and multicloud solutions to help reduce complexity and simplify. Doing so allows enterprises to more efficiently and effectively manage and secure their hybrid and multicloud environments.

**What to Look for in Distributed Cloud**

When looking at distributed cloud solutions, enterprises should take into account a few important points:

*   Workload protection and application security (at layer 7) is a must, particularly for applications that span multiple environments.
*   While many solutions provide network security (layers 3 and 4), fewer seamlessly integrate workload protection and application security on top of network security.
*   The user layer (layer 8) is extremely important when looking to protect against automated attacks and fraud. This is mainly because differentiating between human and automated traffic and between legitimate and fraudulent traffic requires an understanding of intent that can only be gleaned from the user layer.
*   A central console that brings everything together and facilitates the management and security of both applications and infrastructure is imperative.
*   Inclusion in the architecture and design of the enterprise early on, with an ability to flexibly consume different features and grow around, is central.
*   An ability to efficiently address what the market demands — flexibility and fast pace — without introducing complexity and security holes is important.

Although it requires some investment and effort, taking control of the challenges that hybrid and multicloud environments present is essential for enterprises to remain competitive, keep costs under control, reduce complexity, and adequately manage and secure both applications and infrastructure. The sooner an enterprise begins tackling these challenges, the sooner it can efficiently and securely provide its customers the functionality they seek.

How and Why to Put Multicloud to Work

A CISO with a focused role will be better prepared to thrive in an organization and accelerate adoption and understanding of cybersecurity.

Effective cybersecurity operations are as unique as the business models and technology choices of the companies they protect. Their creation and management are constantly complicated by a lack of common terminology and set of expectations, due mainly to the chaotic path our industry has taken since its relatively recent birth.

Cybersecurity leaders are similarly difficult to measure and understand because our language and their capabilities aren't clear, with the lack of a common nomenclature further reflected in the assessment of skill sets and qualifications. The mix of cybersecurity complexity, opaqueness, and urgency creates a vague picture of who can successfully lead and hold responsibility for the operation.

The relative immaturity of the cybersecurity function leaves insufficient organizational precedent for titles and hierarchy. Some organizations default to practicality: Whoever runs IT or the help desk becomes be the security leader. Others are interested in hiring a chief information security officer (CISO) who will manage the details of security that are unfamiliar to all other business leaders. Neither of these approaches are healthy.

The popular narrative around security is dominated by images of fear, uncertainty, and doubt. We're led to believe security is terrible, that breaches are inevitable, or that the right leader can render the organization invulnerable. This kind of absolutism usually comes from those new to the space who aren't yet well-versed in security. It's pervasive, it's incorrect, and it breeds insecurity for both the organization and the individual. 

According to one report, stress (60%) and burnout (53%) were the largest personal risks CISOs face. It doesn't have to be that way. These difficulties start early, with CISO job postings that are poorly constructed, written by someone who doesn't have proficiency in security, and without clear descriptions of desired outcomes. A game-changing shift is a focus on those outcomes and the role that supporting business objectives play in evangelizing, and ultimately delivering, security. The resulting CISO is far better prepared to thrive in the organization and accelerate adoption and understanding of cybersecurity.

How does a CISO do that? Here's the advice I would offer — a guide to creating supporters, champions, and realistic expectations.

**1\. Set Expectations**

The difference between successful leaders and those who burn out is communicating the realities of cybersecurity, from current measures to potential future states. The burnouts accept and even promote the expectation that they will heroically keep an organization from getting breached. History has painfully, and repeatedly, proven that the very best CISO cannot block everything. Successful, more balanced CISOs focus on improvements in protection and in demonstrating progress.

Successful CISOs are specific and transparent about what they will do in their role. They reinforce the reality that security is a team sport. These communications and collaborations are far more important than any technology purchase or deployment. Security budgets may have tripled over the past four years in the face of increasing cyberattacks, but a bigger wallet won't solve every problem. 

When you create a common language and vision within your organization, everyone understands the topics when you evangelize security for a particular outcome. It also means that everyone knows what to do in the event of one of those fires. As a result, the stress levels will lessen, as will the frequency and pain of today's CISO burnouts.

**2\. Be a Business Executive First, Cyber Expert Second**

The ability to solve business problems using security is what turns a security practitioner into a CISO. This is especially difficult for the organization that has asked a non-security IT professional to oversee security. That person may not understand that the role isn't just about being an elevated security expert. Understanding risk, tradeoffs, costs, and enabling business objectives is what creates successful relationships and outcomes

As an example, imagine a company expanding into Europe. That expansion is subject to General Data Protection Regulation (GDPR), and this will influence priorities and investments in areas that may not be as critical to a purely security-focused program. A valuable CISO recognizes the business need and context for the controls they recommend. In this example, fines could easily outpace the financial impact of a minor breach, and communicating those tradeoffs is good for the business and good for the reputation of the CISO.

In general, successful business leaders have an area of personal expertise, but thrive by enabling macro-objectives. As CISO, your security expertise should always make cybersecurity a business accelerator, not a hindrance.

**3\. Align on a Strategy**

Long-lived and successful CISOs are intentional and calculated in their planning and decision making. Without a strategy, you're purely reactive, and you find yourself reacting to fires all day, every day.

Instead, when you design a security program, create a structure that allows you to manage by exception, not rule. This lights a torch to guide others in the organization, empowering them to excel. You'll quickly find that most people want to do the right thing. If you explain what that success looks like rather than point out their failures, you'll start building a security muscle, and security support, across the organization. Peers will know when to put their hand up and ask for help, and it will be easier for you to impact direction because you're not advocating the changes alone.

**Be That CISO**

When you've created this kind of culture, management expectations are rooted in reality, where everyone considers their effect on the organization's security posture, and CISOs aren't faced with surprises, resistance, and friction that make them want to quit. If you advocate with the clarity that most cannot find in cybersecurity, you will achieve the outcomes everyone is striving for.

Rethinking Cybersecurity's Structure & the Role of the Modern CISO

It's not hacking if organizations fail to terminate password access after employees leave.

An alarming number of organizations are not properly offboarding employees when they leave, especially in regard to passwords. In a March PasswordManager.com survey of 1,000 U.S. workers who had access to company passwords at their previous jobs, 47% admitted to using them after leaving the company.

Security teams should be terminating access to all employee accounts, such as email, cloud applications, and internal tools, after employees leave. For accounts or services where multiple employees share passwords, those passwords should be rotated to ensure that the former employees no longer have access.

According to the survey, 58% of respondents indicated they were still able to use their former company's passwords after they left. One in three respondents said they had been using the passwords for upwards of two years, which is a distressingly long time for organizations not to be aware of who is accessing those accounts and services.

“Ideally the company creates standard operating procedures or consistent schedules of updating passwords based on criticality,” says Daniel Farber Huang, head of privacy and cybersecurity at PasswordManager.com.

When asked what they use the passwords for, 64% said to access their former email accounts and 44% to access company data. Though the majority of the respondents, 56%, said they were accessing the accounts for personal use, a concerning 10% said they were trying to disrupt company activities.

A survey from Beyond Identity in 2022 had similar findings: Fifty-three percent of employee respondents admitted to using their access to harm their former employers, and 74% of business leaders reported suffering damages from former employees who exploited their digital access.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Almost Half of Former Employees Say Their Passwords Still Work

The effort aims to disrupt the use of altered Cobalt Strike software by cybercriminals in ransomware and other attacks.

Microsoft's Digital Crimes Unit (DCU), security software vendor Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC), have joined forces to remove cracked legacy copies of Cobalt Strike by way of legal and technical action.

Using dated and maliciously altered versions of the Cobalt Strike software, threat actors have targeted healthcare organizations in nearly 70 ransomware attacks in 19 countries.

Cobalt Strike, sold by Fortra, is a reputable and popular post-exploitation security tool, but its older versions have become a favorite for cybercriminals to employ in nefarious activities. Pulling these legacy copies globally is a new approach for Microsoft's DCU, and it's aimed at cutting off the threat at the source: illegal distribution of compromised, malicious software.

"While this action will impact the criminals' immediate operations, we fully anticipate they will attempt to revive their efforts. Our action is therefore not one and done," Microsoft stated in a blog post. "Through ongoing legal and technical action, Microsoft, Fortra and Health-ISAC, along with our partners, will continue to monitor and take action to disrupt further criminal operations, including the use of cracked copies of Cobalt Strike."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Microsoft, Fortra & Health-ISAC Team Up to Remove Illicit Cobalt Strike Tools

App developers are ignoring laws and guidelines regulating data protection measures aimed at minors, putting their monetization plans in jeopardy and risking user trust.

The popular and increasingly controversial social media app TikTok must pay a fine of 12.7 million pounds (equivalent to around $16 million) in the UK for disregarding data protection for children.

The British data protection authority Information Commissioner's Office (ICO) announced this week that TikTok had allowed up to 1.4 million children under the age of 13 in the country to open accounts in 2020, despite the app's own rules prohibiting it.

Children's personal data had also been used without parental consent, it said, despite UK law requiring it.

"TikTok also failed to implement adequate controls to identify and remove underage children from its platform," an ICO statement added.

While some senior TikTok executives had raised concerns internally, the company had not responded appropriately, the ICO said.

Meanwhile, a new report from Pixalate analyzing the privacy policy of every US-registered child-directed app in the Apple App Store found that the majority (54%) of those apps appear to violate the Children's Online Privacy Protection Act (COPPA).

COPPA is a US federal law enacted in 1998 to protect the privacy of children under the age of 13 on the Internet. COPPA applies to websites and online services that collect personal information from children under the age of 13, such as their name, address, email address, phone number, and other identifiable information.

They must also post a clear and comprehensive privacy policy on their website or online service and provide parents with the option to review and delete their children's personal information.

**Privacy for Kids**

Due to skyrocketing online activity by children and teens, protecting their privacy and security online has become one of the most discussed topics in 2023.

The Biden administration has called on Congress to strengthen privacy protections, ban targeted advertising to children, and demand technology companies stop collecting personal data on children.

In children’s privacy enforcement actions against publishers and advertising platforms, the FTC has imposed hefty fines, customer refunds, and lengthy compliance and auditing obligations.

**App Violations Widespread**

According to the Pixalate report, 21% of apps in the Apple Store don't even have a privacy policy, despite Apple's claim that all apps in the store are required to have a privacy policy.

Among the US-registered, child-directed apps that do have a privacy policy, 34% are missing a Children's Privacy Disclosure, and 13% are missing contact information.

Jalal Nasir, CEO of Pixalate, explains there are multiple risks for app developers who ignore the regulations and names three that stand out.

"The first involves FTC fines, settlements, oversight and other similar remedies, and the second concerns losing the ability to monetize, for example undergoing business practices scrutiny, or being dropped by ad partners as they look to shed risk," he says. "The third involves losing your customers' trust."

Krishna Vishnubhotla, vice president of product strategy at Zimperium, says the penalties for violating the COPPA Rule can be substantial.

"The FTC has the authority to bring enforcement actions against violators, and it may seek civil penalties of up to $43,280 per violation," he explains.

In addition to monetary penalties, violators may also be required to take corrective action, such as deleting the personal information of children that was collected in violation of COPPA.

"The larger issue is that it can also harm a company's reputation and lead to a loss of trust among customers and partners," Vishnubhotla says.

**Holes in Apple Oversight**

Nasir says for smaller developers, lack of awareness or lack of resources are likely two of the biggest factors when it comes to failing COPPA compliance. But the biggest factor may be Apple's failure to provide reasonable oversight.

Apple, as the gatekeeper of its app ecosystem, needs to take a much stronger stance in protecting children’s privacy, he says.

"Apple not only needs to do a much better job of giving its developers the resources necessary to be compliant with the latest privacy laws, but it also seems to need to step up monitoring and enforcement of its own app store policies," Nasir says.

He adds that if app developers work with any third parties — including any advertising partners — they must ensure that those partners also have compliant privacy policies and practices.

"It creates a complicated web," Nasir says.

The real problem concerns the vast number of apps and frequent releases, he says, which makes it difficult for the Federal Trade Commission or any organization to check for noncompliance.

"Stores must provide these regulatory organizations with a dashboard or notifications in order to make it viable," he notes. "Public stores may not allow that. It's almost impossible to accomplish this in a proactive, feasible, and structured manner."

**"Technical Debt" for App Developers**

Melissa Bischoping, director of endpoint security research at Tanium, says development of applications must balance available resources, regulatory requirements, and competing business priorities in their planning and execution.

"While almost no one would disagree that privacy and protection of children's data is always a priority, the technical debt and workload can make engineering the compliance a long and expensive process," she says.

She adds that complying with these, and other regulations and security best practices requires not only the talent to implement the solutions but also adequate staff to test and review that the designed solution meets the desired outcome.

"This is, effectively, engineering a safer airplane while it's in flight," she explains. "It takes the work of multiple teams to engineer and assure. This effort, and others like it that are centered around protecting vulnerable populations, cannot be ignored."

TikTok, Other Mobile Apps Violate Privacy Regulations

Consolidating identity management on one platform gives organizations real-time access management for all identities on hybrid and multicloud installations. (First of a two-part series.)

Did you know that more than 40,000 permissions exist across the top three leading cloud platform providers? And yet 99% of these permissions are going unused. This has created a dangerous permissions gap in which a single server admin could potentially access thousands of permissions across multiple cloud infrastructures.

As this permissions gap expands, so too does an organization's attack surface. Current identity and access management (IAM) solutions are ill-equipped to manage multicloud identity infrastructure, and many security teams are unable to enforce the zero-trust tenet of least privilege access due to the sheer volume of permissions within their organizations.

As organizations work to modernize their IAM model for multicloud environments, there are a few best practices to keep in mind. For example, single sign-on and multifactor authentication can be implemented alongside new identity governance and permissions solutions to create a comprehensive IAM model that improves security without interfering with end-user productivity.

Read on for our top tips on optimizing IAM for multicloud environments.

**Securing Identity Starts With Individual Usage Profiles**

One of the first things that security teams will need to do is audit their current IAM model. For that audit to be successful, the IT department will need to create an individual usage profile for each unique user and nonhuman workload identity within the organization.

Workload identities are a type of nonhuman or machine identity that is assigned to software workloads to authenticate and access other services and resources. Though the use of workload identities can vary from organization to organization, they’re typically used to allow software entities to authenticate with some system. Their rise in popularity represents a new kind of security risk for organizations, as workload identities currently outnumber human identities 10:1. And while human users typically have one identity that is used to access multiple resources, software workloads can use multiple credentials to access different resources.

By creating individual usage profiles for all human and nonhuman workload identities, security teams can understand how many identities exist within their organizations, who has access to what, and how those permissions are currently being used. This provides better visibility into current risks. It also allows security teams to determine whether past permissions are still necessary — for example, when a contractor's work is complete or an employee has transitioned into a new position.

Additionally, because the rising adoption of multicloud environments has led to a boom in identities, permissions, and resources, organizations need to ensure that they have visibility across all of their cloud providers. Cloud infrastructure entitlement management (CIEM) is one solution.

**What Is CIEM?**

Originally coined by Gartner, CIEM comprises seven core pillars: account and entitlements discovery, cross-cloud entitlements correlation, entitlements visualization, entitlements optimization, entitlements protection, entitlements detection, and entitlements remediation. Essentially, CIEM uses analytics and machine learning to determine whether a permission has been granted unnecessarily, is being used incorrectly, or whether a previously granted permission is going unused. From there, security teams can use CIEM to enforce least privilege access and monitor permission risks across their entire networks.

CIEM differs from security information and event management (SIEM) in that it is more focused on addressing access management risks. SIEM is used to collect and analyze event and log data from multiple sources into a single centralized platform. From there, SIEM can deliver threat detection, prioritize security alerts, offer response guidance, and more. CIEM works with SIEM to deliver that same level of security and comprehensive monitoring across hybrid and multicloud environments using zero trust principles.

When implementing CIEM or any other IAM model, organizations must ensure that they don’t interfere with end-user productivity. These access decisions must be granular enough to cover all identities and workloads within the organization while also being responsive enough to adapt to real-time risk assessments. By unifying identity management procedures within a single centralized solution, organizations can enable real-time access decisions for all identities across hybrid and multicloud environments. This, in turn, instills greater trust in every digital experience and interaction that power everyday operations.

_Part 2: How CIEM Can Improve Identity, Permissions Management for Multicloud Deployments_

Close the Permissions Gap With Identity and Access Management for Multicloud Workforces

Vulnerabilities in the device firmware and drivers underscore how printers cannot be set-and-forget technology and need to be managed.

A rash of printer-related vulnerabilities in 2023 have punctuated security expert warnings that printers continue to be a significant source of vulnerability within companies — especially as remote workers require printing resources or access to corporate printers.

So far in 2023, Lexmark advised that a publicly available remote exploit had already targeted a code execution flaw in its printers, HP warned of a vulnerable firmware version on some of its enterprise printers, and Microsoft fixed three remote code execution vulnerabilities in its printer drivers. And four months ago, security researchers at the Pwn2Own contest in Toronto showed off more than a dozen exploits against bugs in top printer brands, including Canon, HP, and Lexmark.

The spate of vulnerabilities underscores that printers remain a likely soft spot in most companies' attack surface area, says Matt Lewis, commercial research director at NCC Group, particularly because printers are not always part of company's asset management process and are often left out of security assessments.

"Many organizations don't know where their printers are, what security status or configuration they are in, and they are certainly not monitoring or logging activity on those printers," he says. "We don't typically see printers featuring as any sort of priority on organizational security plans and risk registers."

While security researchers have raised the issue of printer vulnerabilities over the past decade or more, the security of printers continues to be a major area of concern for companies. Only a quarter (26%) of information technology and cybersecurity professionals feel completely confident that their printing infrastructure is secure, according to the "Global Print Security Landscape Report 2022" published by technology-analyst firm Quocirca. In addition, 61% of CIOs and 44% of CISOs had difficulty keeping up with print-security challenges and demands, the report stated.

    

Home printers are tied for the No. 4 security concern of IT professionals. Data source: Quocirca

The digital vein of printer vulnerabilities is far from being tapped out, says Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, which runs the Pwn2Own competition.

"As evidenced by the number of printer-related patches released by Microsoft every month, the attack surface is broad and poorly defended," he says. "Printers are the sort of devices people don't want to touch once they get them working. As a consequence, they rarely receive firmware updates or other routine maintenance — at least until something breaks."

**Overlooked Dangers**

The hands-off approach to managing printers — or failing to manage printers — can sometimes be a blessing, as in the case of the latest vulnerability in some enterprise HP printer models. On April 3, the company acknowledged a vulnerability in the latest FutureSmart firmware (version 5.6), pulling down the six-week-old software and directing customers to revert their printers to FutureSmart version 5.5.0.3. The devices can leak information when IPSec is enabled, the company said in an advisory.

In a statement to Dark Reading, HP noted that the vulnerability only affected its printers for about a six-week window — between mid-February and the end of March — and only those installed with a specific version of firmware. The company did not say how many customers had downloaded or installed the vulnerable firmware and stated it would patch the latest version and make it available in 90 days.

Overall, printers represent a blind spot in most company's infrastructure and an opportunity for attackers, says NCC Group's Lewis.

"Printers can still offer an easy and less-detectable method for attackers to infiltrate a network and remain stealthy via backdoors planted within compromised printers," he says. "Most modern printers lack security detection and prevention measures and are often not monitored by organizations — for these reasons, there's no concrete data on how much printer compromise might actually be occurring globally."

**Bringing the Danger Home**

A significant twist in the printer threat landscape is the expansion of hybrid work and the commensurate risks posed by employees' home printers. Nearly two-thirds of companies (67%) are worried that home printers may pose risks to their business's security, according to the Quocirca report.

Whether home printers are yet getting targeted is not clear, but they do pose a significant attack surface, says NCC Group's Lewis.

"Home printers ... typically lack any organizational configuration and policy lockdown, thus there is a need for organizations to provide useful advice and guidance for home workers on how they can secure their home printers," he says.

Companies should ensure that their printers — both managed at the office and unmanaged at employees' homes — are part of their security assessments. Overlooking those devices puts companies at risk, says Trend Micro's Childs.

"Many enterprises only look at the big printers in their offices if they look at all," he says. "They rarely consider the printers in the home office of their remote workers when threat modeling."

Less than four in ten companies have reporting and analytics (38%) or formal risk assessments that include printers (38%) in place, according to the Quocirca report. Nearly nine in 10 companies will have or plan to implement a broad range of printer security measure in 2023, with seven in 10 companies planning to increase spending on security this year, the report stated.

Printers Pose Persistent Yet Overlooked Threat

Security teams need to find the best, most effective uses of large language models for defensive purposes.

AI is dominating headlines. ChatGPT, specifically, has become the topic du jour. Everyone is taken by the novelty, the distraction. But no one is addressing the elephant in the room: how large language models (LLMs) can and will be weaponized.

The Internet has become incredibly large and complex, exposing our most precious crown jewels. Whereas a decade ago a company had a single website, today it may have dozens — filled with unknown and untracked assets and subsidiaries — that an attacker can use to exfiltrate IP and/or breach into their network and systems. Recent research we conducted provided an eye-opening glimpse into this reality:

*   Companies' attack surfaces fluctuate 9% in size each month, making security gaps harder to detect. 

*   Organizations have, on average, 104 subsidiaries (i.e., entities owned by a parent company, which might be business units, brands, or standalone companies), and the core security team is unaware of 10 to 31 of them.

*   Invisible or hard-to-detect subsidiaries contain an average of 56% of the critical and high-priority vulnerabilities affecting customer assets.

In short, companies' attack surfaces have never been larger and more vulnerable. And security leaders are in constant fear that another issue like Log4j is going to cripple their business.

And as if we didn't have enough security threats to contend with, large language models like ChatGPT have entered the mainstream, shining a light on language AI as a potential weapon for cyberattacks. Should we be worried? The short answer is yes. But there is a bright side, which I'll address later.

**Large Language Models Can and Will Be Used Against You**

There are several stages of cyberattacks where LLMs can give bad actors a major advantage of scale, scope, reach, and speed. Here are a few:

*   **Automated reconnaissance.** Map and discover any assets (devices, files, etc.) and subsidiaries, brands, and services associated with your organization. Find sensitive information such as exposed credentials in AWS directories.

*   **Vulnerability discovery.** Find weaknesses in the targeted network.

*   **Exploitation.** To begin, initial exploitation is about using a technique like phishing to gain access to a network. Then, targeted exploitation might use watering-hole attacks to develop and exploit vulnerabilities within the network. 

*   **Data theft.** Copy or exfiltrate sensitive or valuable data from the network.

Also, consumer applications based on LLMs, most notably ChatGPT, can be used both intentionally and unintentionally by employees to leak company IP, simply by using the free public version. Companies like JP Morgan caught on to this early and were swift to ban corporate use of ChatGPT.

Spear-phishing campaigns provide another use case. High-quality phishing is based on deep understanding of the target; that is precisely what large language models can do quite well, because they process large volumes of data very quickly and customize messages effectively. Emails created by a large language model can impersonate a boss, co-worker, friend, or reputable organization with increasing precision and believability. Since 82% of data breaches involve a human element, including phishing and the use of stolen credentials, this will be an area to watch as hackers use LLMs to ramp up such attacks.

**Security Teams Can Turn the Tables on Attackers**

There is good news: Security teams can also use machine learning and LLMs to do reconnaissance on their own companies and remediate vulnerabilities before attackers get to them. They can use them to quickly and cost-effectively scan and map their own attack surfaces deeply to find exposed sensitive assets, personal identifiable information (PII), files, etc. By contrast, performing the same feat with manual methods could take months and/or cost hundreds of thousands of dollars.

Knowing the business context of any given asset is the only way security teams can effectively prioritize risk — and machine learning can help. For example, machine learning could recognize a database holding PII and play a role in revenue transactions. 

Machine learning can also determine the business purpose of an asset, distinguishing between a payment mechanism, a critical database, and a random device — and classify its risk profile. This context allows exponentially better risk prioritization and a higher level of threat intelligence. Without proper prioritization, security teams confront endless lists of vulnerabilities with labels like Urgent and Critical that are often, in fact, not correct. 

**Preparing for a New Era of Attacks**

There is every reason to expect attackers will make the most of large language models to automate reconnaissance and map your attack surfaces. It is time for security teams to embark on yet another learning curve: Find the best, most effective uses of large language models for defensive purposes. Right now, someone somewhere is looking for your organization's vulnerabilities, and it's just a matter of time before they use this newly popular type of tool to find them.

Bad Actors Will Use Large Language Models — but Defenders Can, Too

Your family's SUV could be gone in the night thanks to a headlight crack and hack attack.

Automotive security experts have uncovered a novel method for stealing cars by breaking into their control systems through a headlight.

The key (so to speak) is the controller area network (CAN) bus, the Internet of Things (IoT) protocol through which devices and microcontrollers in a vehicle communicate with one another. It’s basically the car's onboard, local communications network that cyberattackers can subvert to potentially stop and start the car, open doors and windows, play around with the radio, and much more.

While car hacking is hardly new, in a blog post published April 3, Ken Tindell, CTO of Canis Automotive Labs, described how attackers manipulated an electronic control unit (ECU) in a Toyota RAV4's headlight to gain access to its CAN bus, through which they were able to, ultimately, steal the vehicle. That's an approach that hasn't been seen before. Once connected via the headlight, they hacked their way into the CAN bus — responsible for functions like the parking brakes, headlights, and smart key — through a gateway and then into the powertrain panel, wherein lies the engine control.

    

How ECUs in a RAV4 are wired together with CAN bus. Source: Canis CTO blog

This type of CAN injection will require manufacturers to rethink control network security in their vehicles, he warns.

"When you're a car engineer," Tindell tells Dark Reading, "you're trying to solve all sorts of problems: minimizing the wiring, reliability, cost. You're not thinking 'cyber, cyber, cyber' all the time."

"We're not wired that way," he says. "Forgive the pun."

**Cyber Theft Auto**

On April 24 last year, Ian Tabor woke up to find that his Toyota RAV4's front bumper and left headlight had been manhandled, while it was parked out on the street in London.

> No fcuking point having a nice car these days, came out early to find the front bumper and arch trim pulled off and even worse the headlight wiring plug had been yanked out, if definitely wasn't an accident, kerb side and massive screwdriver mark. Breaks in the clips etc. C&#ts pic.twitter.com/7JaF6blWq9  
> 
> — Ian Tabor (@mintynet) April 24, 2022

One month later, those same areas of the car were again obviously tampered with. Tabor didn't realize the full scope of the sabotage until it was too late.

One day, the vehicle was gone.

> I know what they were doing, the car is gone! My @ToyotaUK app shows it's in motion. I only filled the tank last night. FCUK! https://t.co/SWl8PcmfZJ
> 
> — Ian Tabor (@mintynet) July 21, 2022

Tabor, it should be noted, is an automotive security consultant. The irony was not lost on Tabor's friend, Tindell. "When I first read his tweet, I thought: Someone's making a point," he says. "But no, not at all."

Tindell, it turned out, was in a unique position to help. He'd helped develop the first CAN-based platform for Volvo vehicles — an experience applicable to the situation given that the CAN proved to be the RAV4's key weakness.

**How Hackers Typically Steal Cars**

To break into a modern vehicle, the key is usually … the key.

"The car is defended with the key," Tindell explains. "The wireless key is a perimeter defense. It talks to an engine control unit (ECU), which asks: 'Are you the real key?' The key responds: 'Yeah.' Then the message goes to the engine immobilizer: 'OK, the owner's here with the key.'"

To breach this line of communication, thieves have historically opted for so-called "relay attacks." Using a handheld radio relay station, attackers can beam a car's authentication request to its associated smart key, presumably lying in a nearby home. The key responds, and the car accepts the message because it is, in the end, valid.

Attuned to this, manufacturers now commonly design keys to go to sleep after a few minutes of inaction. Owners with keys that don't go to sleep can store them inside of a radio-impenetrable metal box

Other attack types include subverting mobile apps, and making use of flaws in the infotainment systems of cars — the latter of which became a lightning rod for reform after the famed hack of the 2014 Jeep Cherokee by Charlie Miller and Chris Valasek in 2015. In that case, the discovery of a wide open cellular communications port 6667 ultimately led to their ability to control the Jeep's steering, braking, high beams, turn signals, windshield wipers and fluid, and door locks, as well as reset the speedometer and tachometer, kill the engine, and disengage the transmission so the accelerator pedal failed.

Cybercriminals 'CAN' Steal Your Car, Using Novel IoT Hack

By developing new tools to defend against adversarial AI, companies can help ensure that artificial intelligence is developed and used in a responsible and safe manner.

On Wednesday, KPMG Studios, the consulting giant's incubator, launched Cranium, a startup to secure artificial intelligence (AI) applications and models. Cranium's "end-to-end AI security and trust platform" straddles two areas — MLOps (machine learning operations) and cybersecurity — and provides visibility into AI security and supply chain risks.

"Fundamentally, data scientists don't understand the cybersecurity risks of AI, and cyber professionals don't understand data science the way they understand other topics in technology," says Jonathan Dambrot, former KPMG partner and founder and CEO of Cranium. He says there is a wide gulf of understanding between data scientists and cybersecurity professionals, similar to the gap that often exists between development teams and cybersecurity staff.

With Cranium, key AI life-cycle stakeholders will have a common operating picture across teams to improve visibility and collaboration, the company says. The platform captures both in-development and deployed AI pipelines, including associated assets involved throughout the AI life cycle. Cranium quantifies the organization's AI security risk and establishes continuous monitoring. Customers will be able to establish an AI security framework, providing data science and security teams with a foundation for building a proactive and holistic AI security program.

To keep data and systems secure, Cranium maps the AI pipelines, validates their security, and monitors for adversarial threats. The technology integrates with existing environments to allow organizations to test, train, and deploy their AI models without changing workflow, the company says. In addition, security teams can use Cranium's playbook alongside the software to protect their AI systems and adhere to existing US and EU regulatory standards.

With Cranium's launch, KPMG is tapping into growing concerns about adversarial AI — the practice of modifying AI systems that have been intentionally manipulated or attacked to produce incorrect or harmful results. For example, an autonomous vehicle that has been manipulated could cause a serious accident, or a facial recognition system that has been attacked could misidentify individuals and lead to false arrests. These attacks can come from a variety of sources, including malicious actors, and could be used to spread disinformation, conduct cyberattacks, or commit other types of crimes.

Cranium is not the only company looking at protecting AI applications from adversarial AI attacks. Competitors such as HiddenLayer and Picus are already working on tools to detect and prevent AI attacks.

**Opportunities for Innovation**

The entrepreneurial opportunities in this area are significant, as the risks of adversarial AI are likely to increase in the coming years. There is also incentive for the major players in the AI space — OpenAI, Google, Microsoft, and possibly IBM — to focus on securing the AI models and platforms that they are producing.

Businesses can focus their AI efforts on detection and prevention, adversarial training, explainability and transparency, or post-attack recovery. Software companies can develop tools and techniques to identify and block adversarial inputs, such as images or text that have been intentionally modified to mislead an AI system. Companies can also develop techniques to detect when an AI system is behaving abnormally or in an unexpected manner, which could be a sign of an attack.

Another approach to protecting against adversarial AI is to "train" AI systems to be resistant to attacks. By exposing an AI system to adversarial examples during the training process, developers can help the system learn to recognize and defend against similar attacks in the future. Software companies can develop new algorithms and techniques for adversarial training, as well as tools to evaluate the effectiveness of these techniques.

With AI, it can be difficult to understand how a system is making its decisions. This lack of transparency can make it difficult to detect and defend against adversarial attacks. Software companies can develop tools and techniques to make AI systems more explainable and transparent so that developers and users can better understand how the system is making its decisions and identify potential vulnerabilities.

Even with the best prevention techniques in place, it's possible that an AI system could still be breached. In these cases, it's important to have tools and techniques to recover from the attack and restore the system to a safe and functional state. Software companies can develop tools to help identify and remove any malicious code or inputs, as well as techniques to restore the system to a "clean" state.

However, protecting AI models can be challenging. It can be difficult to test and validate the effectiveness of AI security solutions, since attackers can constantly adapt and evolve their techniques. There is also the risk of unintended consequences, where AI security solutions could themselves introduce new vulnerabilities.

Overall, the risks of adversarial AI are significant, but so are the entrepreneurial opportunities for software companies to innovate in this area. In addition to improving the safety and reliability of AI systems, protecting against adversarial AI can help build trust and confidence in AI among users and stakeholders. This, in turn, can help drive adoption and innovation in the field.

Source

DARKReading