It is imperative for executives and board members to know who their top allies are, and how to best leverage them to successfully navigate a crisis and minimize the harm caused by a breach.

Chris Crummey, Director, Executive & Board Cyber Services, Sygnia

September 27, 2024

5 Min Read

Source: Artur Marciniec via Alamy Stock Photo

COMMENTARY

Many organizations have gone to great lengths in preparing for a cyberattack, leveraging both services and solutions to limit risk and exposure. Despite these efforts, breaches persist, ransomware payouts have grown, and leaders continue to make mistakes during cyber crises that impact organizations and customers both short and long term.

Most of these mistakes happen when the stakeholders do not know their roles, responsibilities, and what they are authorized to do in a crisis. This lack of clarity causes friction when leaders are required to make several highly impactful decisions during a cyber incident with little time and often limited verified information.

The biggest challenge facing crisis response teams is the fact there simply is never enough time to gather, verify, and analyze the necessary information to make the best possible decision. Under the pressure of a compressed timeline and increasingly concerned stakeholders, executives and board members tend to fixate on finding ways to shorten the time to remediation.

They should also prioritize reducing present and future risks for the company and ensure their teams do the same, but that often gets overlooked. As everyone within the organization turns to leadership for guidance and direction, it's important for those in charge to understand who their greatest allies are during a crisis and how they can leverage them to minimize the business and reputational impact of a breach.

**Open and Ongoing Communications**

During the crisis, leadership must rely on its guiding principles to define their communication strategy and provide employees with a North Star that explains what they need to do forthwith. This starts with establishing a secure and classified crisis war room to collaborate and communicate under privilege, categorizing the event and defining what can and cannot be shared, and clearly defining roles and responsibilities for each stakeholder. This creates a leadership filter that determines who is authorized to make decisions and sets a timeline in motion for when information should be disseminated internally and externally, which systems need to be taken offline or brought back on, and if or when authorities and regulators should be contacted. 

Organizations must maintain constant communication with each line of business throughout the crisis because it empowers employees to make the micro-decisions necessary to limit the ongoing business and reputational harm. There is no better example of this than former Maersk CEO Soren Skou, whose tip-of-the-spear leadership helped the company navigate the unprecedented 2017 NotPetya malware attack. Skou participated in all crisis calls and meetings, focused on internal and external communication, and instructed all frontline staff across the 130 countries Maersk operates in to "do what you think is right to serve the customer — don't wait for the HQ, we'll accept the cost." In doing so, Maersk quickly mobilized to identify and remove the malware from its systems to restore operations, provided real-time feedback to its stakeholders about the situation, and resumed online books just eight days after the attack.

**Built-in Alternatives**

Each decision made during a crisis can set off a chain reaction that can compound damage. Business and security leaders often experience a rush of cortisol during the first few hours of a crisis that induces the "fog of war" feeling, clouding judgment and causing mistakes. It is important to understand during these moments that each choice has multiple options, leaders must ask the right information-gathering questions to support a full business response, and there is no perfect answer or solution. 

Redundancy is a key strategy to save time during a crisis, and the most mature organizations have created a collaborative response plan based on the PACE model. For instance, if an organization suffers a ransomware attack and its communications platforms are potentially compromised, moving to an alternate platform quickly removes a significant amount of risk. Teams should be aligned on how much risk they are willing to take with each decision and create a coordinated understanding of their options. By working through the pros and cons associated with these choices, executives and board members can determine which decisions their organizations should make to get operations back up and running as quickly and efficiently as possible.

**Driving a Culture of Preparedness**

Organizations that have dedicated the necessary time to preparing their teams for a crisis have confidence in their employees to successfully execute the incident response plan and limit the amount of damage inflicted by a threat actor. Testing each level of these plans, especially the "small details," is critical for successful execution of the organization's strategy. It allows leadership to adapt their playbooks and runbooks to various situations and circumstances, and evolve their pre-crisis plans to account for emerging threats and their effects on the business.

Conducting tabletop exercises, creating and testing playbooks and runbooks, and putting employees through real-life simulations during war games fosters a well-coordinated response and puts teams in the best position for when (not if) a situation arises. These operations can reveal potential gaps and answer questions that include: How is the company communicating to its employees when the email platform is compromised? Who is managing that list of employees and their corresponding contact information? Where is that document stored and when was it last updated? The responses to these questions are a direct correlation to a company's maturity and preparation.

When a corporation finds itself in the middle of a cyber crisis, the key stakeholders will shift their focus to the executive leadership team to determine how well they are responding. During these times, it is imperative for executives and board members to understand who their top allies are, and how to best leverage them to successfully navigate the situation and minimize the financial and reputational harm caused by the breach.

**About the Author**

Director, Executive & Board Cyber Services, Sygnia

Chris Crummey is the Director for Executive and Board Cyber Services globally at Sygnia. For the past eight years, Chris has prepared and advised thousands of companies, SOCs, executives and Boards of Directors on cybersecurity best practices before, during and after a cybersecurity crisis. These best practices focus on the intersection of cybersecurity, risk-based decision making, crisis communications, leadership under pressure and the role human beings play in cybersecurity. As a keynote speaker on these topics, Chris is also a cybersecurity faculty member of “Competent Boards,” which is the original and premier creator of online of ESG training programs for board directors and senior business professionals. Prior to this role, Chris was the Executive Director for the IBM’s X-Force Command Centers globally and specialized in tabletop exercises and cyber wargames.

Top Allies Executives &amp; Boards Should Leverage During a Cyber Crisis

Most general purpose large language models (LLM) are trained with a wide range of generic data on the internet. They often lack domain-specific knowledge, which makes it challenging to generate accurate or relevant responses in specialized fields. They also lack the ability to process new or technical terms, leading to misunderstandings or incorrect information.An "AI hallucination" is a term used to indicate that an AI model has produced information that's either false or misleading, but is presented as factual. This is a direct result of the model training goal of always predicting the next

Most general purpose large language models (LLM) are trained with a wide range of generic data on the internet. They often lack domain-specific knowledge, which makes it challenging to generate accurate or relevant responses in specialized fields. They also lack the ability to process new or technical terms, leading to misunderstandings or incorrect information.

An "AI hallucination" is a term used to indicate that an AI model has produced information that's either false or misleading, but is presented as factual. This is a direct result of the model training goal of always predicting the next token regardless of the question. It can be difficult to tell whether information provided by AI contains learned facts or a hallucination. This is a problem when you're trying to use an LLM for critical purposes and applications such as those used in healthcare or finance.

The diagram below demonstrates how an LLM predicts the next word in a sentence based on its training. In most cases a "greedy algorithm" is used, the word with the most probability is chosen and the output is generated. 

**Hallucinations can cause security problems**

Research has demonstrated that LLM output, when used verbatim, can lead to long-lasting, hard-to-detect security issues and cause supply chain security problems. A few months ago, researchers exposed a new attack technique known as AI Package Hallucination. This technique used LLM tools to spread malicious packages that do not exist, based on model outputs provided to the end user.

Code generation LLMs are often trained using code repositories on the internet. Sometimes these repositories contain intentionally malicious code, such as typosquatted or hijacked package dependencies. Should a developer use tainted code from a generated model, it can cause widespread security issues for their systems, and even spread the issues to their customers, causing widespread supply chain security issues.

**Hallucinations can cause financial losses and lawsuits**

The hallucination issue with LLMs is especially problematic in finance where precision is crucial. Recent research by Haoqiang Kang and Xiao-Yang Liu marks a pivotal effort in exploring LLM hallucination within financial contexts. When the outputs generated by LLMs are used directly to make financial decisions, they can lead to significant financial losses to companies and potential legal consequences.

**Hallucinations mitigation 101**

Hallucinations are a reality with LLM output. While researchers attempt to figure out the best way to eliminate them, mitigating them is currently the most appropriate solution for enterprises. To do so, enterprises should:

**1\. Fine-tune the model with domain-specific knowledge**

The primary source of LLM hallucinations is the model’s lack of training with domain-specific data. During inference, an LLM simply tries to account for knowledge gaps by inventing probable phrases. Training a model on more relevant and accurate information makes it more accurate at generating responses, thereby minimizing chances of hallucination.

InstructLab is an open source initiative by Red Hat and IBM that provides a platform for easy engagement with LLMs. It allows companies and contributors to easily fine-tune and align models with domain-specific knowledge using a taxonomy-based curation process.

**2\. Use Retrieval Augmented Generation (RAG)**

RAG addresses AI hallucinations by ensuring factual accuracy. It searches an organization's private data sources for relevant information to enhance the LLM's public knowledge.

User prompts are converted to a vector representation by using models like BERT. These vectors are used to search a database for relevant information. Vector databases are used to store domain specific information for this purpose. In the end, the output is generated from the original prompt and the retrieved information to produce an accurate response.

**3\. Use advance prompting techniques**

Advanced prompting techniques, such as chain of thought prompting, can considerably reduce hallucinations. Chain of thought prompting helps enable complex reasoning capabilities through intermediate reasoning steps. Further, it can be combined with other techniques, such as few-shot prompting, to get better results on complex tasks that require the model to reason before responding.

**4\. Use guardrails**

Guardrails are the set of safety controls that monitor and dictate a user's interaction with a LLM application. They are a set of programmable, rule-based systems that sit in between users and foundational models in order to make sure the AI model is operating between defined principles in an organization.

Using modern guardrails, especially those that support contextual grounding, can help reduce hallucinations. These guardrails check if the model response is factually accurate based on the source and make sure output is grounded in the source. Any new information introduced in the response will be considered un-grounded.

Understanding and mitigating the causes of hallucinations is critical for deploying an LLM in high-stakes domains such as health care, legal, and financial services, where accuracy and reliability are paramount. Though hallucinations cannot currently be completely eliminated, the way you implement solutions relying on an LLM can help mitigate them.

You can make setting up your own LLM solution for your organization easy with RHEL AI, an image specially designed for deploying AI.

When LLMs day dream: Hallucinations and how to prevent them

Ubuntu Security Notice 7021-2 - Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

    ==========================================================================Ubuntu Security Notice USN-7021-2September 23, 2024linux-ibm-5.15, linux-oracle-5.15, linux-xilinx-zynqmp vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTS- Ubuntu 20.04 LTSSummary:Several security issues were fixed in the Linux kernel.Software Description:- linux-xilinx-zynqmp: Linux kernel for Xilinx ZynqMP processors- linux-ibm-5.15: Linux kernel for IBM cloud systems- linux-oracle-5.15: Linux kernel for Oracle Cloud systemsDetails:Several security issues were discovered in the Linux kernel.An attacker could possibly use these to compromise the system.This update corrects flaws in the following subsystems:  - GPU drivers;  - BTRFS file system;  - F2FS file system;  - GFS2 file system;  - BPF subsystem;  - Netfilter;  - RxRPC session sockets;  - Integrity Measurement Architecture(IMA) framework;(CVE-2024-27012, CVE-2024-39496, CVE-2024-26677, CVE-2024-42228,CVE-2024-38570, CVE-2024-39494, CVE-2024-42160, CVE-2024-41009)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS  linux-image-5.15.0-1036-xilinx-zynqmp  5.15.0-1036.40  linux-image-xilinx-zynqmp       5.15.0.1036.40Ubuntu 20.04 LTS  linux-image-5.15.0-1063-ibm     5.15.0-1063.66~20.04.1  linux-image-5.15.0-1068-oracle  5.15.0-1068.74~20.04.1  linux-image-ibm                 5.15.0.1063.66~20.04.1  linux-image-oracle              5.15.0.1068.74~20.04.1After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References:  https://ubuntu.com/security/notices/USN-7021-2  https://ubuntu.com/security/notices/USN-7021-1  CVE-2024-26677, CVE-2024-27012, CVE-2024-38570, CVE-2024-39494,  CVE-2024-39496, CVE-2024-41009, CVE-2024-42160, CVE-2024-42228Package Information:  https://launchpad.net/ubuntu/+source/linux-xilinx-zynqmp/5.15.0-1036.40  https://launchpad.net/ubuntu/+source/linux-ibm-5.15/5.15.0-1063.66~20.04.1  https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1068.74~20.04.1

Ubuntu Security Notice USN-7021-2

The $2.65B buy validates the growing importance of threat intelligence to enterprise security strategies.

Source: incamerastock via Alamy Stock Photo

Mastercard's $2.65 billion acquisition of Recorded Future has focused attention on the increasing value of cyber-threat intelligence (CTI) to enterprise security strategies.

Security experts in the space perceive the deal as validating the business criticality of CTI and accelerating its mainstream adoption.

**A Multibillion-Dollar Bet**

Mastercard on Sept. 12 announced it had agreed to acquire Recorded Future for $2.65 billion — nearly equivalent to the cumulative amount it paid in nine previous purchases of cybersecurity vendors. Mastercard has said it will leverage Recorded Future's threat intelligence capabilities to bolster its own anti-fraud capabilities and to strengthen the third-party services it delivers via previous acquisitions such as RiskRecon.

The deal is expected to close in Q1 of 2025.

Fernando Montenegro, an analyst with Omdia, says Mastercard's acquisition aligns with the financial firm's efforts to integrate multiple capabilities around its suite of anti-fraud services. "One of the key components of successful anti-fraud initiatives is accurate threat intelligence, so it makes sense for Mastercard to improve their capabilities there," Montenegro says. "I think the deal shows that threat intelligence can be immensely valuable not only to pure-play cybersecurity efforts, but to broader anti-fraud initiatives as well."

The Business Research Company expects demand for cyber-threat intelligence services to hit some $11.5 billion in revenue in 2024, and to more than double to $25.68 billion in 2028, at a compound annual growth rate (CAGR) of 21.7%. The analyst firm identified the primary growth drivers as an increase in the volume and sophistication of cyberattacks, cloud adoption, a constantly expanding attack surface, and increasing regulatory pressures. Others, like Statista think the market is currently even larger — $14.59 billion in 2023 — but have a more modest annual growth rate expectation of 14.7% between now and 2030.

**Validation for CTI?**

Beenu Arora, CEO and co-founder of Cyble, sees the pending transaction as further cementing the role of threat intelligence in business strategies. The rapidly changing and increasingly sophisticated threat landscape has increased the importance of intelligence on emerging threats, threat groups, and their tactics, techniques, and procedures, Arora says. Now perceived as a highly technical component of SecOps, CTI has moved to front and center of security strategy at a growing number of organizations.

"If you speak to any seasoned CTO, CISO, or chief executive, there’s always concern about how they can make the right decisions" around what assets to protect, how, and against whom, Arora says. "Over the last 10 to 15 years, I think there has been much greater awareness with regard to how threat intelligence can sit at the center of day-to-day decision making for the business, whether that’s managing risk, safeguarding assets, or using external intelligence to help guide business decisions."

Analyst firm IT-Harvest, which maintains a dashboard tracking the performance of more than 4,050 cybersecurity vendors globally, counts 123 vendors as currently engaged in the cyber-threat intelligence space. Of that number, 63 have experienced headcount growth this year. Mastercard's recent acquisition underscores the value these vendors can bring to enterprise security strategies, says Richard Stiennon, chief research analyst at IT-Harvest.

"I think the acquisition is good for the 122 other threat intelligence vendors whose prospects will improve in the eyes of investors," Stiennon says.

The $2.65 billion that Mastercard has agreed to pay for Recorded Future is roughly 6.5 times the latter's annual revenue run rate. While that valuation is less than the 10-times valuations that cybersecurity firms garnered back in 2021 and 2022, it still is a healthy number, Stiennon says.

Many of the organizations that deliver CTI services, such as Recorded Future, Group-IB Flashpoint, and Digital Shadows, are what might be regarded as pure-play vendors in the space. Others, such as Mandiant, CrowdStrike, Kaspersky, IBM X-Force, Cisco Talos, and Palo Alto Networks, deliver threat intelligence as part of a broader portfolio of security services. All these vendors use a combination of open source intelligence (OSINT) and information from proprietary sources to deliver their CTI feeds.

"The acquisition validates the widespread, growing recognition that threat intelligence is no longer a complement to an organization's security posture," says Josh Lefkowitz, founder and CEO of Flashpoint. Organizations and government agencies are using threat intelligence to combat ransomware, protect data, lock down supply chains, prioritize critical vulnerabilities, and protect their people and assets.

"I’m constantly speaking with security leaders at organizations that consider these applications of threat intelligence critical to their daily operations," Lefkowitz notes.

He adds that Mastercard's Recorded Future purchase is bringing attention to the board level of the business criticality of CTI.

Don't miss the latest Dark Reading Confidential podcast, where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa, and forced to spend the night in jail — just for doing their pen-testing jobs. Listen now!

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Mastercard's Bet on Recorded Future a Win for Cyber-Threat Intel

Ubuntu Security Notice 7007-2 - Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service.

    =========================================================================Ubuntu Security Notice USN-7007-2September 23, 2024linux-ibm-5.15, linux-oracle-5.15 vulnerabilities=========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTSSummary:Several security issues were fixed in the Linux kernel.Software Description:- linux-ibm-5.15: Linux kernel for IBM cloud systems- linux-oracle-5.15: Linux kernel for Oracle Cloud systemsDetails:Chenyuan Yang discovered that the CEC driver driver in the Linux kernelcontained a use-after-free vulnerability. A local attacker could use thisto cause a denial of service (system crash) or possibly execute arbitrarycode. (CVE-2024-23848)Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kerneldid not properly check for the device to be enabled before writing. A localattacker could possibly use this to cause a denial of service.(CVE-2024-25741)It was discovered that the JFS file system contained an out-of-bounds readvulnerability when printing xattr debug information. A local attacker coulduse this to cause a denial of service (system crash). (CVE-2024-40902)Several security issues were discovered in the Linux kernel.An attacker could possibly use these to compromise the system.This update corrects flaws in the following subsystems:  - ARM64 architecture;  - M68K architecture;  - MIPS architecture;  - PowerPC architecture;  - RISC-V architecture;  - x86 architecture;  - Block layer subsystem;  - Cryptographic API;  - Accessibility subsystem;  - ACPI drivers;  - Serial ATA and Parallel ATA drivers;  - Drivers core;  - Bluetooth drivers;  - Character device driver;  - CPU frequency scaling framework;  - Hardware crypto device drivers;  - Buffer Sharing and Synchronization framework;  - DMA engine subsystem;  - FPGA Framework;  - GPIO subsystem;  - GPU drivers;  - Greybus drivers;  - HID subsystem;  - HW tracing;  - I2C subsystem;  - IIO subsystem;  - InfiniBand drivers;  - Input Device (Mouse) drivers;  - Macintosh device drivers;  - Multiple devices driver;  - Media drivers;  - VMware VMCI Driver;  - Network drivers;  - Near Field Communication (NFC) drivers;  - NVME drivers;  - Pin controllers subsystem;  - PTP clock framework;  - S/390 drivers;  - SCSI drivers;  - SoundWire subsystem;  - Greybus lights staging drivers;  - Media staging drivers;  - Thermal drivers;  - TTY drivers;  - USB subsystem;  - DesignWare USB3 driver;  - Framebuffer layer;  - ACRN Hypervisor Service Module driver;  - eCrypt file system;  - File systems infrastructure;  - Ext4 file system;  - F2FS file system;  - JFFS2 file system;  - JFS file system;  - NILFS2 file system;  - NTFS3 file system;  - SMB network file system;  - IOMMU subsystem;  - Memory management;  - Netfilter;  - BPF subsystem;  - Kernel debugger infrastructure;  - DMA mapping infrastructure;  - IRQ subsystem;  - Tracing infrastructure;  - 9P file system network protocol;  - B.A.T.M.A.N. meshing protocol;  - CAN network layer;  - Ceph Core library;  - Networking core;  - IPv4 networking;  - IPv6 networking;  - IUCV driver;  - MAC80211 subsystem;  - Multipath TCP;  - NET/ROM layer;  - NFC subsystem;  - Open vSwitch;  - Network traffic control;  - TIPC protocol;  - TLS protocol;  - Unix domain sockets;  - Wireless networking;  - XFRM subsystem;  - ALSA framework;  - SoC Audio for Freescale CPUs drivers;  - Kirkwood ASoC drivers;(CVE-2024-42140, CVE-2024-38580, CVE-2024-38555, CVE-2024-38591,CVE-2024-40942, CVE-2024-42130, CVE-2024-41095, CVE-2024-40994,CVE-2024-39469, CVE-2024-38610, CVE-2024-42097, CVE-2024-42137,CVE-2024-31076, CVE-2024-38552, CVE-2024-36489, CVE-2024-40983,CVE-2024-40908, CVE-2024-39493, CVE-2024-40970, CVE-2024-40901,CVE-2024-38567, CVE-2024-38599, CVE-2024-38605, CVE-2024-42119,CVE-2024-38590, CVE-2024-38558, CVE-2023-52884, CVE-2024-41000,CVE-2024-42101, CVE-2024-40943, CVE-2024-39507, CVE-2024-42115,CVE-2024-40968, CVE-2024-42095, CVE-2024-41034, CVE-2024-38618,CVE-2024-38633, CVE-2024-40904, CVE-2024-42070, CVE-2024-38583,CVE-2024-39471, CVE-2024-38578, CVE-2024-38637, CVE-2024-40987,CVE-2024-39506, CVE-2024-39482, CVE-2024-42124, CVE-2024-40981,CVE-2024-35927, CVE-2022-48772, CVE-2024-38588, CVE-2023-52887,CVE-2024-40941, CVE-2024-34027, CVE-2024-38627, CVE-2024-42106,CVE-2024-40927, CVE-2024-38559, CVE-2024-39499, CVE-2024-39505,CVE-2024-42120, CVE-2024-38615, CVE-2024-39467, CVE-2024-42232,CVE-2024-38589, CVE-2024-38621, CVE-2024-41002, CVE-2024-40934,CVE-2024-38582, CVE-2024-39480, CVE-2024-38571, CVE-2024-39301,CVE-2024-38612, CVE-2024-39495, CVE-2024-39276, CVE-2024-42096,CVE-2024-41041, CVE-2024-40912, CVE-2024-41089, CVE-2024-41093,CVE-2024-40931, CVE-2024-42092, CVE-2024-41047, CVE-2024-40956,CVE-2024-42229, CVE-2024-40914, CVE-2024-39490, CVE-2024-38548,CVE-2024-41044, CVE-2024-40967, CVE-2024-38596, CVE-2024-40902,CVE-2024-41055, CVE-2024-38601, CVE-2024-42153, CVE-2024-38623,CVE-2024-35247, CVE-2024-38635, CVE-2024-38662, CVE-2024-42086,CVE-2024-42102, CVE-2024-42154, CVE-2024-38587, CVE-2024-39466,CVE-2024-40911, CVE-2024-39503, CVE-2024-42090, CVE-2024-42087,CVE-2024-40929, CVE-2024-37078, CVE-2024-39489, CVE-2024-42244,CVE-2024-40980, CVE-2024-38624, CVE-2024-42105, CVE-2024-36270,CVE-2024-41092, CVE-2024-40937, CVE-2024-38780, CVE-2024-41035,CVE-2024-42104, CVE-2024-40988, CVE-2024-36894, CVE-2024-42157,CVE-2024-38613, CVE-2024-40916, CVE-2024-41040, CVE-2024-36032,CVE-2024-40978, CVE-2024-38579, CVE-2024-38550, CVE-2024-41049,CVE-2024-40959, CVE-2024-42131, CVE-2024-42161, CVE-2024-42247,CVE-2024-37356, CVE-2024-40905, CVE-2024-42098, CVE-2024-40932,CVE-2024-42236, CVE-2024-38565, CVE-2024-38661, CVE-2024-40963,CVE-2024-42240, CVE-2024-40984, CVE-2024-39277, CVE-2024-38573,CVE-2024-39509, CVE-2024-41006, CVE-2024-34777, CVE-2024-42152,CVE-2024-40954, CVE-2024-39501, CVE-2024-42109, CVE-2024-42080,CVE-2024-42225, CVE-2024-41007, CVE-2024-42077, CVE-2024-38634,CVE-2024-40995, CVE-2024-42084, CVE-2024-40974, CVE-2024-38586,CVE-2024-42224, CVE-2024-40960, CVE-2024-39500, CVE-2024-41004,CVE-2024-42145, CVE-2024-38619, CVE-2024-36974, CVE-2024-39502,CVE-2024-41097, CVE-2024-40958, CVE-2024-41027, CVE-2024-36972,CVE-2024-36286, CVE-2024-40990, CVE-2024-42082, CVE-2024-40945,CVE-2024-36014, CVE-2024-42068, CVE-2024-41087, CVE-2024-36978,CVE-2024-42148, CVE-2024-40971, CVE-2024-38546, CVE-2024-39488,CVE-2024-41048, CVE-2024-42121, CVE-2024-38381, CVE-2024-41046,CVE-2024-36971, CVE-2024-42085, CVE-2024-39487, CVE-2024-33847,CVE-2024-38607, CVE-2024-33621, CVE-2024-40957, CVE-2024-42127,CVE-2024-38547, CVE-2024-36015, CVE-2024-38549, CVE-2024-38597,CVE-2024-42093, CVE-2024-42089, CVE-2024-39468, CVE-2024-38560,CVE-2024-42223, CVE-2024-38659, CVE-2024-38598, CVE-2024-40976,CVE-2024-42094, CVE-2024-41005, CVE-2024-39475, CVE-2024-40961,CVE-2024-42076)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS  linux-image-5.15.0-1062-ibm     5.15.0-1062.65~20.04.1  linux-image-5.15.0-1067-oracle  5.15.0-1067.73~20.04.1  linux-image-ibm                 5.15.0.1062.65~20.04.1  linux-image-oracle              5.15.0.1067.73~20.04.1After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References:  https://ubuntu.com/security/notices/USN-7007-2  https://ubuntu.com/security/notices/USN-7007-1  CVE-2022-48772, CVE-2023-52884, CVE-2023-52887, CVE-2024-23848,  CVE-2024-25741, CVE-2024-31076, CVE-2024-33621, CVE-2024-33847,  CVE-2024-34027, CVE-2024-34777, CVE-2024-35247, CVE-2024-35927,  CVE-2024-36014, CVE-2024-36015, CVE-2024-36032, CVE-2024-36270,  CVE-2024-36286, CVE-2024-36489, CVE-2024-36894, CVE-2024-36971,  CVE-2024-36972, CVE-2024-36974, CVE-2024-36978, CVE-2024-37078,  CVE-2024-37356, CVE-2024-38381, CVE-2024-38546, CVE-2024-38547,  CVE-2024-38548, CVE-2024-38549, CVE-2024-38550, CVE-2024-38552,  CVE-2024-38555, CVE-2024-38558, CVE-2024-38559, CVE-2024-38560,  CVE-2024-38565, CVE-2024-38567, CVE-2024-38571, CVE-2024-38573,  CVE-2024-38578, CVE-2024-38579, CVE-2024-38580, CVE-2024-38582,  CVE-2024-38583, CVE-2024-38586, CVE-2024-38587, CVE-2024-38588,  CVE-2024-38589, CVE-2024-38590, CVE-2024-38591, CVE-2024-38596,  CVE-2024-38597, CVE-2024-38598, CVE-2024-38599, CVE-2024-38601,  CVE-2024-38605, CVE-2024-38607, CVE-2024-38610, CVE-2024-38612,  CVE-2024-38613, CVE-2024-38615, CVE-2024-38618, CVE-2024-38619,  CVE-2024-38621, CVE-2024-38623, CVE-2024-38624, CVE-2024-38627,  CVE-2024-38633, CVE-2024-38634, CVE-2024-38635, CVE-2024-38637,  CVE-2024-38659, CVE-2024-38661, CVE-2024-38662, CVE-2024-38780,  CVE-2024-39276, CVE-2024-39277, CVE-2024-39301, CVE-2024-39466,  CVE-2024-39467, CVE-2024-39468, CVE-2024-39469, CVE-2024-39471,  CVE-2024-39475, CVE-2024-39480, CVE-2024-39482, CVE-2024-39487,  CVE-2024-39488, CVE-2024-39489, CVE-2024-39490, CVE-2024-39493,  CVE-2024-39495, CVE-2024-39499, CVE-2024-39500, CVE-2024-39501,  CVE-2024-39502, CVE-2024-39503, CVE-2024-39505, CVE-2024-39506,  CVE-2024-39507, CVE-2024-39509, CVE-2024-40901, CVE-2024-40902,  CVE-2024-40904, CVE-2024-40905, CVE-2024-40908, CVE-2024-40911,  CVE-2024-40912, CVE-2024-40914, CVE-2024-40916, CVE-2024-40927,  CVE-2024-40929, CVE-2024-40931, CVE-2024-40932, CVE-2024-40934,  CVE-2024-40937, CVE-2024-40941, CVE-2024-40942, CVE-2024-40943,  CVE-2024-40945, CVE-2024-40954, CVE-2024-40956, CVE-2024-40957,  CVE-2024-40958, CVE-2024-40959, CVE-2024-40960, CVE-2024-40961,  CVE-2024-40963, CVE-2024-40967, CVE-2024-40968, CVE-2024-40970,  CVE-2024-40971, CVE-2024-40974, CVE-2024-40976, CVE-2024-40978,  CVE-2024-40980, CVE-2024-40981, CVE-2024-40983, CVE-2024-40984,  CVE-2024-40987, CVE-2024-40988, CVE-2024-40990, CVE-2024-40994,  CVE-2024-40995, CVE-2024-41000, CVE-2024-41002, CVE-2024-41004,  CVE-2024-41005, CVE-2024-41006, CVE-2024-41007, CVE-2024-41027,  CVE-2024-41034, CVE-2024-41035, CVE-2024-41040, CVE-2024-41041,  CVE-2024-41044, CVE-2024-41046, CVE-2024-41047, CVE-2024-41048,  CVE-2024-41049, CVE-2024-41055, CVE-2024-41087, CVE-2024-41089,  CVE-2024-41092, CVE-2024-41093, CVE-2024-41095, CVE-2024-41097,  CVE-2024-42068, CVE-2024-42070, CVE-2024-42076, CVE-2024-42077,  CVE-2024-42080, CVE-2024-42082, CVE-2024-42084, CVE-2024-42085,  CVE-2024-42086, CVE-2024-42087, CVE-2024-42089, CVE-2024-42090,  CVE-2024-42092, CVE-2024-42093, CVE-2024-42094, CVE-2024-42095,  CVE-2024-42096, CVE-2024-42097, CVE-2024-42098, CVE-2024-42101,  CVE-2024-42102, CVE-2024-42104, CVE-2024-42105, CVE-2024-42106,  CVE-2024-42109, CVE-2024-42115, CVE-2024-42119, CVE-2024-42120,  CVE-2024-42121, CVE-2024-42124, CVE-2024-42127, CVE-2024-42130,  CVE-2024-42131, CVE-2024-42137, CVE-2024-42140, CVE-2024-42145,  CVE-2024-42148, CVE-2024-42152, CVE-2024-42153, CVE-2024-42154,  CVE-2024-42157, CVE-2024-42161, CVE-2024-42223, CVE-2024-42224,  CVE-2024-42225, CVE-2024-42229, CVE-2024-42232, CVE-2024-42236,  CVE-2024-42240, CVE-2024-42244, CVE-2024-42247Package Information:  https://launchpad.net/ubuntu/+source/linux-ibm-5.15/5.15.0-1062.65~20.04.1  https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1067.73~20.04.1

Ubuntu Security Notice USN-7007-2

The Coalition for Secure AI (CoSAI) expanded its roster of members with the addition of threat intelligence management, collaboration and response orchestration vendor Cyware this week.

Source: ElenaBS via Alamy

The Coalition for Secure AI is a collaborative open-source initiative that seeks to aid those looking to create secure-by design AI technologies. Its network of stakeholders in business and academia work together to develop holistic approaches and best practices, tools and methodologies to secure AI development and deployment. 

This week, threat intelligence management, collaboration and response orchestration vendor Cyware became a member of CoSAI. Google is one of the founding members. Existing members include OpenAI, Anthropic, Microsoft, IBM, Intel, Nvidia, and PayPal.

The coalition has established three work streams that focus on different areas: software supply chain security for AI systems, preparing defenders for a changing cybersecurity landscape, and AI risk governance. In the future it expects to expand into additional areas. Cyware will contribute as an expert in AI-enabled security solutions to help develop industry standards that prioritize safety, ethics and transparency in AI development, the company said.

CoSAI operates under OASIS Open, an international standards and open source consortium that seeks to help members advance projects in areas including cybersecurity, blockchain, IoT, emergency management, cloud computing and legal data exchange.

**About the Author**

Jennifer Lawinski is a writer and editor with more than 20 years experience in media, covering a wide range of topics including business, news, culture, science, technology and cybersecurity. After earning a Master's degree in Journalism from Boston University, she started her career as a beat reporter for The Daily News of Newburyport. She has since written for a variety of publications including CNN, Fox News, Tech Target, CRN, CIO Insight, MSN News and Live Science. She lives in Brooklyn with her partner and two cats.

Coalition for Secure AI Promotes Safe, Ethical AI Development

Ubuntu Security Notice 7021-1 - Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

    ==========================================================================Ubuntu Security Notice USN-7021-1September 18, 2024linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15,linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15,linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15,linux-kvm, linux-nvidia, linux-oracle, linux-raspi vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTS- Ubuntu 20.04 LTSSummary:Several security issues were fixed in the Linux kernel.Software Description:- linux: Linux kernel- linux-aws: Linux kernel for Amazon Web Services (AWS) systems- linux-azure: Linux kernel for Microsoft Azure Cloud systems- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems- linux-gke: Linux kernel for Google Container Engine (GKE) systems- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems- linux-ibm: Linux kernel for IBM cloud systems- linux-intel-iotg: Linux kernel for Intel IoT platforms- linux-kvm: Linux kernel for cloud environments- linux-nvidia: Linux kernel for NVIDIA systems- linux-oracle: Linux kernel for Oracle Cloud systems- linux-raspi: Linux kernel for Raspberry Pi systems- linux-aws-5.15: Linux kernel for Amazon Web Services (AWS) systems- linux-azure-5.15: Linux kernel for Microsoft Azure cloud systems- linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems- linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems- linux-hwe-5.15: Linux hardware enablement (HWE) kernel- linux-intel-iotg-5.15: Linux kernel for Intel IoT platformsDetails:Several security issues were discovered in the Linux kernel.An attacker could possibly use these to compromise the system.This update corrects flaws in the following subsystems:  - GPU drivers;  - BTRFS file system;  - F2FS file system;  - GFS2 file system;  - BPF subsystem;  - Netfilter;  - RxRPC session sockets;  - Integrity Measurement Architecture(IMA) framework;(CVE-2024-39496, CVE-2024-41009, CVE-2024-26677, CVE-2024-42160,CVE-2024-27012, CVE-2024-42228, CVE-2024-39494, CVE-2024-38570)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS  linux-image-5.15.0-1053-gkeop   5.15.0-1053.60  linux-image-5.15.0-1063-ibm     5.15.0-1063.66  linux-image-5.15.0-1063-raspi   5.15.0-1063.66  linux-image-5.15.0-1065-intel-iotg  5.15.0-1065.71  linux-image-5.15.0-1065-nvidia  5.15.0-1065.66  linux-image-5.15.0-1065-nvidia-lowlatency  5.15.0-1065.66  linux-image-5.15.0-1067-gke     5.15.0-1067.73  linux-image-5.15.0-1067-kvm     5.15.0-1067.72  linux-image-5.15.0-1068-oracle  5.15.0-1068.74  linux-image-5.15.0-1069-gcp     5.15.0-1069.77  linux-image-5.15.0-1070-aws     5.15.0-1070.76  linux-image-5.15.0-1073-azure   5.15.0-1073.82  linux-image-5.15.0-122-generic  5.15.0-122.132  linux-image-5.15.0-122-generic-64k  5.15.0-122.132  linux-image-5.15.0-122-generic-lpae  5.15.0-122.132  linux-image-aws-lts-22.04       5.15.0.1070.70  linux-image-azure-lts-22.04     5.15.0.1073.71  linux-image-gcp-lts-22.04       5.15.0.1069.65  linux-image-generic             5.15.0.122.122  linux-image-generic-64k         5.15.0.122.122  linux-image-generic-lpae        5.15.0.122.122  linux-image-gke                 5.15.0.1067.66  linux-image-gke-5.15            5.15.0.1067.66  linux-image-gkeop               5.15.0.1053.52  linux-image-gkeop-5.15          5.15.0.1053.52  linux-image-ibm                 5.15.0.1063.59  linux-image-intel-iotg          5.15.0.1065.65  linux-image-kvm                 5.15.0.1067.63  linux-image-nvidia              5.15.0.1065.65  linux-image-nvidia-lowlatency   5.15.0.1065.65  linux-image-oracle-lts-22.04    5.15.0.1068.64  linux-image-raspi               5.15.0.1063.61  linux-image-raspi-nolpae        5.15.0.1063.61  linux-image-virtual             5.15.0.122.122Ubuntu 20.04 LTS  linux-image-5.15.0-1053-gkeop   5.15.0-1053.60~20.04.1  linux-image-5.15.0-1065-intel-iotg  5.15.0-1065.71~20.04.1  linux-image-5.15.0-1069-gcp     5.15.0-1069.77~20.04.1  linux-image-5.15.0-1070-aws     5.15.0-1070.76~20.04.1  linux-image-5.15.0-1073-azure   5.15.0-1073.82~20.04.1  linux-image-5.15.0-122-generic  5.15.0-122.132~20.04.1  linux-image-5.15.0-122-generic-64k  5.15.0-122.132~20.04.1  linux-image-5.15.0-122-generic-lpae  5.15.0-122.132~20.04.1  linux-image-aws                 5.15.0.1070.76~20.04.1  linux-image-azure               5.15.0.1073.82~20.04.1  linux-image-azure-cvm           5.15.0.1073.82~20.04.1  linux-image-gcp                 5.15.0.1069.77~20.04.1  linux-image-generic-64k-hwe-20.04  5.15.0.122.132~20.04.1  linux-image-generic-hwe-20.04   5.15.0.122.132~20.04.1  linux-image-generic-lpae-hwe-20.04  5.15.0.122.132~20.04.1  linux-image-gkeop-5.15          5.15.0.1053.60~20.04.1  linux-image-intel               5.15.0.1065.71~20.04.1  linux-image-intel-iotg          5.15.0.1065.71~20.04.1  linux-image-oem-20.04           5.15.0.122.132~20.04.1  linux-image-oem-20.04b          5.15.0.122.132~20.04.1  linux-image-oem-20.04c          5.15.0.122.132~20.04.1  linux-image-oem-20.04d          5.15.0.122.132~20.04.1  linux-image-virtual-hwe-20.04   5.15.0.122.132~20.04.1After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References:  https://ubuntu.com/security/notices/USN-7021-1  CVE-2024-26677, CVE-2024-27012, CVE-2024-38570, CVE-2024-39494,  CVE-2024-39496, CVE-2024-41009, CVE-2024-42160, CVE-2024-42228Package Information:  https://launchpad.net/ubuntu/+source/linux/5.15.0-122.132  https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1070.76  https://launchpad.net/ubuntu/+source/linux-azure/5.15.0-1073.82  https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1069.77  https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1067.73  https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1053.60  https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1063.66  https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1065.71  https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1067.72  https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1065.66  https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1068.74  https://launchpad.net/ubuntu/+source/linux-raspi/5.15.0-1063.66  https://launchpad.net/ubuntu/+source/linux-aws-5.15/5.15.0-1070.76~20.04.1  https://launchpad.net/ubuntu/+source/linux-azure-5.15/5.15.0-1073.82~20.04.1  https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1069.77~20.04.1  https://launchpad.net/ubuntu/+source/linux-gkeop-5.15/5.15.0-1053.60~20.04.1  https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-122.132~20.04.1  https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1065.71~20.04.1

Ubuntu Security Notice USN-7021-1

Ubuntu Security Notice 7020-1 - Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

    ==========================================================================Ubuntu Security Notice USN-7020-1September 18, 2024linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency,linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8,linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 24.04 LTS- Ubuntu 22.04 LTSSummary:Several security issues were fixed in the Linux kernel.Software Description:- linux: Linux kernel- linux-aws: Linux kernel for Amazon Web Services (AWS) systems- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems- linux-gke: Linux kernel for Google Container Engine (GKE) systems- linux-ibm: Linux kernel for IBM cloud systems- linux-lowlatency: Linux low latency kernel- linux-nvidia: Linux kernel for NVIDIA systems- linux-nvidia-lowlatency: Linux low latency kernel for NVIDIA systems- linux-oem-6.8: Linux kernel for OEM systems- linux-oracle: Linux kernel for Oracle Cloud systems- linux-lowlatency-hwe-6.8: Linux low latency kernel- linux-nvidia-6.8: Linux kernel for NVIDIA systemsDetails:Several security issues were discovered in the Linux kernel.An attacker could possibly use these to compromise the system.This update corrects flaws in the following subsystems:  - GPU drivers;  - Network drivers;  - SCSI drivers;  - F2FS file system;  - BPF subsystem;  - IPv4 networking;(CVE-2024-42160, CVE-2024-42159, CVE-2024-42154, CVE-2024-41009,CVE-2024-42228, CVE-2024-42224)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 24.04 LTS  linux-image-6.8.0-1011-gke      6.8.0-1011.14  linux-image-6.8.0-1013-ibm      6.8.0-1013.13  linux-image-6.8.0-1013-oem      6.8.0-1013.13  linux-image-6.8.0-1013-oracle   6.8.0-1013.13  linux-image-6.8.0-1013-oracle-64k  6.8.0-1013.13  linux-image-6.8.0-1014-nvidia   6.8.0-1014.15  linux-image-6.8.0-1014-nvidia-64k  6.8.0-1014.15  linux-image-6.8.0-1014-nvidia-lowlatency  6.8.0-1014.15.1  linux-image-6.8.0-1014-nvidia-lowlatency-64k  6.8.0-1014.15.1  linux-image-6.8.0-1015-gcp      6.8.0-1015.17  linux-image-6.8.0-1016-aws      6.8.0-1016.17  linux-image-6.8.0-45-generic    6.8.0-45.45  linux-image-6.8.0-45-generic-64k  6.8.0-45.45  linux-image-6.8.0-45-lowlatency  6.8.0-45.45.1  linux-image-6.8.0-45-lowlatency-64k  6.8.0-45.45.1  linux-image-aws                 6.8.0-1016.17  linux-image-gcp                 6.8.0-1015.17  linux-image-generic             6.8.0-45.45  linux-image-generic-64k         6.8.0-45.45  linux-image-generic-64k-hwe-24.04  6.8.0-45.45  linux-image-generic-hwe-24.04   6.8.0-45.45  linux-image-generic-lpae        6.8.0-45.45  linux-image-gke                 6.8.0-1011.14  linux-image-ibm                 6.8.0-1013.13  linux-image-ibm-classic         6.8.0-1013.13  linux-image-ibm-lts-24.04       6.8.0-1013.13  linux-image-kvm                 6.8.0-45.45  linux-image-lowlatency          6.8.0-45.45.1  linux-image-lowlatency-64k      6.8.0-45.45.1  linux-image-nvidia              6.8.0-1014.15  linux-image-nvidia-64k          6.8.0-1014.15  linux-image-nvidia-lowlatency   6.8.0-1014.15.1  linux-image-nvidia-lowlatency-64k  6.8.0-1014.15.1  linux-image-oem-24.04           6.8.0-1013.13  linux-image-oem-24.04a          6.8.0-1013.13  linux-image-oracle              6.8.0-1013.13  linux-image-oracle-64k          6.8.0-1013.13  linux-image-virtual             6.8.0-45.45  linux-image-virtual-hwe-24.04   6.8.0-45.45Ubuntu 22.04 LTS  linux-image-6.8.0-1014-nvidia   6.8.0-1014.15~22.04.1  linux-image-6.8.0-1014-nvidia-64k  6.8.0-1014.15~22.04.1  linux-image-6.8.0-45-lowlatency  6.8.0-45.45.1~22.04.1  linux-image-6.8.0-45-lowlatency-64k  6.8.0-45.45.1~22.04.1  linux-image-lowlatency-64k-hwe-22.04  6.8.0-45.45.1~22.04.1  linux-image-lowlatency-hwe-22.04  6.8.0-45.45.1~22.04.1  linux-image-nvidia-6.8          6.8.0-1014.15~22.04.1  linux-image-nvidia-64k-6.8      6.8.0-1014.15~22.04.1After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References:  https://ubuntu.com/security/notices/USN-7020-1  CVE-2024-41009, CVE-2024-42154, CVE-2024-42159, CVE-2024-42160,  CVE-2024-42224, CVE-2024-42228Package Information:  https://launchpad.net/ubuntu/+source/linux/6.8.0-45.45  https://launchpad.net/ubuntu/+source/linux-aws/6.8.0-1016.17  https://launchpad.net/ubuntu/+source/linux-gcp/6.8.0-1015.17  https://launchpad.net/ubuntu/+source/linux-gke/6.8.0-1011.14  https://launchpad.net/ubuntu/+source/linux-ibm/6.8.0-1013.13  https://launchpad.net/ubuntu/+source/linux-lowlatency/6.8.0-45.45.1  https://launchpad.net/ubuntu/+source/linux-nvidia/6.8.0-1014.15  https://launchpad.net/ubuntu/+source/linux-nvidia-lowlatency/6.8.0-1014.15.1  https://launchpad.net/ubuntu/+source/linux-oem-6.8/6.8.0-1013.13  https://launchpad.net/ubuntu/+source/linux-oracle/6.8.0-1013.13  https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-6.8/6.8.0-45.45.1~22.04.1  https://launchpad.net/ubuntu/+source/linux-nvidia-6.8/6.8.0-1014.15~22.04.1

Ubuntu Security Notice USN-7020-1

Ultimately, the goal of businesses and cyber insurers alike is to build more resilient IT environments to avoid cyberattacks and the ransom, downtime, and reputation hit that come along with them.

Source: Olekcii Mach via Alamy Stock Photo

COMMENTARY

The rising cost of cyberattacks, including downtime, investigations, lawsuits, ransoms, and more are prompting cyber insurers to re-examine underwriting and encourage greater cyber resiliency in their customer bases. With the influx of cyber-insurance claims stemming from the CrowdStrike IT outage and the exorbitant price of recovering from data breaches — $4.88 million, on average, according to IBM — the cyber-insurance industry will continue to self-correct and evolve to fit market needs while maintaining profitability.

Insurers will come away from July's widespread IT outage relatively unscathed, as the outages were caused by a vendor error, not a cyberattack, and because it was fixed fairly quickly. Still, insurer Parametrix estimates insured losses from US Fortune 500 companies will total $540 million to $1.08 billion, not even including Microsoft. Now, imagine this is a cyberattack that goes through a third-party software-as-a-service (SaaS) provider and takes down a similar swath of business, but recovery is slower, and companies must pay ransoms to recoup their data. How many billions of dollars will cyber insurers be out then? 

Because cybersecurity is still a relatively new corner of the insurance market, ambiguity remains around what should be covered, the role cyber insurance plays in potentially encouraging ransom payments, etc. There's no doubt that it's still finding its footing, figuring out in real-time and on a world stage how to insure companies against rapidly changing and advancing cybersecurity threats.

This evolution will be what finally causes businesses to face reality and prioritize cyber resiliency to ensure data is always recoverable in the event their primary network is taken offline or data is held for ransom. Companies may not take it upon themselves to invest in better data protection practices, and the cyber-insurance market ultimately will force their hand.

**Cyber Insurers Drag Us Into the Future**

Over the past five years, the rise of ransomware has shifted not only an organization's risk profile but also the estimated payouts. In many insurance policies, it's all about risk mitigation, but unless an underwriter can accurately assess the risk or implement requirements to mitigate the threat, it becomes a financial business risk for the insurance company. Therefore, cyber-insurance prices have significantly risen along with the bar to qualify for coverage.

Many of the new requirements focus on data storage and backups. Segmented, encrypted, and immutable backups are the industry standard, but because of limited resources, unawareness, or segmented cybersecurity teams, it hasn't always been a prioritized industry standard. Now, companies will have no choice but to up their game if they want coverage. Those who fail to adopt these requirements will be left without insurance or an effective recovery plan, unable to financially recover when the inevitable ransomware attack hits.

However, in June, businesses stood before the House Homeland Security Committee and told Congress that they are struggling to obtain cyber insurance, and even once insurance is secured, they struggle to understand the nuances of what's covered. Plus, ransom payments themselves are increasing as cybercriminals learn they can demand, and receive, large payouts. According to Chainalysis, the median ransom payment in 2024 was $1.5 million as of July, a huge increase from $200,000 in early 2023.

Because such a significant portion of companies are uncertain what is actually covered by their cyber insurance — around 40%, according to Sophos — they can't risk having to pay the whole ransom themselves or face never recovering their valuable data. Companies must do what they can to reduce their own risk.

**Recoverable Data Is Its Own Form of Cyber Insurance**

Companies can reduce the cost of attacks by ensuring data remains recoverable, mitigating operational downtime, and preventing the need to pay ransoms. Ransomware relies on the fact that production or backup data is made useless for organizations to recover following an attack, but with immutable backup in place, organizations ensure access to their data remains. This is especially true as ransomware is now targeting backups specifically.

Immutability is a must-have for any type of backup storage because it is time-based, not key-based like encryption. This means that there is truly no way (outside of destruction of the physical hardware) to alter or remove the backup data once it is written into a device that has object lock, i.e., immutability, enabled. You can truly maximize this strategy by encrypting backup data before writing it to immutable storage; that way, it's unreadable (unless you have the key) and unalterable. 

It's also important to ensure that a disaster recovery plan is in place that includes a multilevel backup solution and disaster recovery testing on a weekly and monthly basis to get ahead of any potential issues. Once these are implemented, keep copies of all the backup tests to prove to an insurance company that you have a lower risk factor. 

Ultimately, the goal of businesses and cyber insurers alike is to build more-resilient IT environments to avoid cyberattacks and the ransom, downtime, and reputation hit that come along with them. Law enforcement will continue to fight cybercrime, but there's no indication it will let up. Changes in the cyber-insurance market have the potential to disrupt the threat landscape by prompting the ubiquitous adoption of backup best practices and cyber resiliency.

**About the Author**

CEO, Object First

Object First CEO, David Bennett is a tech veteran and a seasoned channel executive with more than 30 years of IT channel leadership. Before joining Object First, he was CEO of Axcient and chief revenue officer at Webroot. Bennett has also held international leadership roles within such companies as Lenovo, Sony, and Kingston. British-born, he now resides in Colorado with his wife and family.

How Shifts in Cyber Insurance Are Affecting the Security Landscape

The evolution of software always catches us by surprise. I remember betting against the IBM computer Deep Blue during its chess match against the grandmaster Garry Kasparov in 1997, only to be stunned when the machine claimed victory. Fast forward to today, would we have imagined just three years ago that a chatbot could write essays, handle customer support calls, and even craft commercial

Penetration Testing / Automation

The evolution of software always catches us by surprise. I remember betting against the IBM computer Deep Blue during its chess match against the grandmaster Garry Kasparov in 1997, only to be stunned when the machine claimed victory. Fast forward to today, would we have imagined just three years ago that a chatbot could write essays, handle customer support calls, and even craft commercial artwork? We continue to be amazed by what software can achieve—tasks we once thought were strictly human domains. Such is the surprise unfolding in the sphere of cybersecurity testing. Hold tight!

****Demystifying Penetration Testing****

If someone had told me 10 years ago that computer software could one day perform the work of an ethical hacker, I would have said 'No way, Jose'. Penetration testing—PT for short—is when experts mimic hackers to test a company's defenses. It's a critical practice, mandated by major regulatory bodies like PCI DSS, HIPAA, and DORA to ensure network safety. Yet, despite its critical role, PT has been conducted in much the same way for decades.

****We've Been Used to Paying the Bill****

Traditional PT doesn't come cheap, ranging from $30,000 for basic external web tests to $150,000 for complex cloud systems analyses. The process is lengthy, too often taking two to three months from the initial service request to final reporting, and only covering 5% to 10% of an organization's assets at each pass.

Now consider the new economics: for the price of a single manual pentesting exercise one can perform automated daily exercises with ten times the scope in each run throughout the year. The financial argument for automation is truly disruptive. With software the cost per test run turns from the price of a BMW M4 to the price of a pair of Air Jordan sneakers. It's that drastic.

****The Brief History of Security Validation****

While the broader cybersecurity field has seen rapid advancements, such as AI-driven endpoint security, PT has been slow to evolve. Pentera led the charge by introducing automated security testing capabilities back in 2015. That was the birth of algorithm-based security validation solutions. Its commercial debut was met with enthusiasm from a few early adopters and skepticism from many traditionalists. Nearly a decade later, Pentera, and several others, have expanded the envelope to fully automated infrastructure and application penetration testing with thousands of raving enterprise security professionals using the software daily.

****Embracing Automated Solutions****

The shift toward automation is gaining momentum, and the benefits of frequent and thorough testing are evident. While there's still a place for the expert work of a master pentester for application testing, physical-cyber attack paths, and other advanced and bespoke scenarios, the need for broad coverage and frequent checks is clear. When it comes to addressing the world's hundreds of millions of untested systems, software-based solutions offer unmatched efficiency and affordability. As cybersecurity challenges continue to grow, investing in automated PT isn't just a smart move—it's essential for maintaining robust security defenses without breaking the bank.

The Future of Cybersecurity Testing - is in Software. So, I ask: why pay a pentester?

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Tag

#ibm