Nicolas M. Chaillan

What is the point of it all? Why are we building AI for Prometheus alerts? Why does it even MATTER for your business? Here's an overview.

33

2 Comments

A new AD is available for public comments: 3946: NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations To post comments, create a FREE account and add comments in the box with the red balloon https://hubs.la/Q02J94Vh0 #unifiedcompliance #cybersecurity #authoritydocuments #riskmanagement

3

Episode 3026 Legit Security with Liav Caspi, CTO and Co-founder at BHUSA 2024. Why do you need an AI Command Center? GenAI use in software development is exploding and security struggling to keep up – both in terms of understanding where GenAI is in use, and and how to ensure its security. With the Legit AI security command center – security teams can proactively safeguard AI use across the software development lifecycle (SDLC) and prevent the accidental or intentional misuse of malicious and vulnerable machine learning (ML), GenAI, and large language models (LLMs) — all from a single pane of glass. https://lnkd.in/gENGdKUz #bhusa #bhusa2024 #cybersecurity #genai #aicommandcenter #LLM #ml #securityguytv #sdlc

8

RSA 2024 Takeaway: AI or Die 🥵 Met dozens of CISOs, execs & founders at RSA this week. Quick observations: 1️⃣ Every vendor is AI-fying their pitch. They're leveraging AI/LLMs for various use cases - threat intelligence, SOC automation & more. Impressed by Google Cloud, CrowdStrike & Microsoft Azure security offerings with lots of LLM-powered automation across their stack 🤖 2️⃣ The other side of AI adoption? Security / Compliance / Safety. Many pitches around securing AI systems & data. AI safety will be a hot topic for a while. Congrats to Reality Defender Ben Colman for winning the RSA Conference Innovation Sandbox 👏 3️⃣ Enterprises are shifting towards unified security stacks driven by cost, simplicity & agility needs - EDR + ASPM + CNAPP + SIEM +...all-in-one. This'll trigger a new wave of acquisitions by major players like CrowdStrike, Palo Alto Networks, Zscaler, Wiz, SentinelOne. While there are many innovative exciting startups, I'm afraid most exits may be below $500M. 4️⃣ Critical infrastructure security is gaining more attention due to rising geopolitical threats. This is an urgent national security matter. I'm super proud to be an early investor in Eclypsium, Inc.. They are the MOST innovative critical infrastructure security platform for enterprises. 💪 (cc Yuriy Bulygin Alex Bazhaniuk) 5️⃣ Identity is the new perimeter. Loads of innovation here. A non-human identity layer is emerging rapidly. Cerby showcased many exciting product updates to secure new vulnerabilities in the identity stack. Watch this space 👀 Share if I miss others. #RSAC2024 #cybersecurity #IAM #EDR #SIEM #CNAPP #ASPM #criticalinfrastructure #supplychainsecurity #ai #ml #llm #largelanguagemodels

79

10 Comments

Impactful cyber news today -- An important step in the direction that CISOs are treated more like a CFO, with the right level of accountability, transparency, as well as protection. Senator Wyden and Warner just proposed a new healthcare cybersecurity bill. This bill might be a watershed moment for the cybersecurity industry, an important step in codifying the practice of cyber security. It aims to regulate and document the official responsibilities of Cybersecurity leadership for a healthcare entity. This bill might do for the CISO what Sarbanes-Oxley did for the role of the CFO. If this bill passes, other industries may follow suit. The bill specifically calls out the - Establishment of a minimum cybersecurity standard for the health care industry - Public certification of compliance (The CISO must certify) - Annual security audit and stress test of incident recovery  - No Cap in Health and Human Services fine authority - Provides financial help to small and safety net hospitals Press release: https://lnkd.in/gqRS_ZMD One page summary:  https://lnkd.in/gQpszBrm For public companies today, the CFO and the CEO must certify the company's financial statements every quarter. This bill would have the CISO (and presumably the CEO) publicly certify its cybersecurity compliance annually. This step will allow the CISO to gain appropriate resources, take on proper accountability, and also receive much-needed protection for his/her job. Thank you to Joe Sullivan who brought this to my attention. Jim Higgins, Vitaly Gudanets, Kirsten Davies, Lakshmi Hanspal, Ariel Litvin, Confidence Staveley, Catherine A. Allen, Karissa A. Breen (KB), Jackie Bow, Gary Hayslip, Rinki Sethi, Matthew Rosenquist, Stephanie M. Shorter, PhD, Ross Haleliuk, Stephanie Domas, Heather Hinton, Chris Hughes, Tal Mozes

60

10 Comments

I have a new blog post in which I compare and contrast how privacy laws are proposed and implemented in California and at the Federal level. This is very analogous to software development: in California, it is open and agile, while at the Federal level, it is closed and waterfall. https://lnkd.in/gW387JRZ

34

1 Comment

Telegram’s founder, Pavel Durov, stated that he is the only product manager at the company and employs only about 30 engineers. This has been criticized by cybersecurity experts as a red flag for users. Last weekend, a clip from a recent interview with Telegram’s founder Pavel Durov went semi-viral on X (previously Twitter). In the video, Durov tells right-wing personality Tucker Carlson that he is the only product manager at the company, and that he only employs “about 30 engineers.” Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation and a longtime expert in the security of at-risk users, said that it’s important to remember that Telegram, unlike Signal, is a lot more than just a messaging app. “What makes Telegram different (and much worse!) is that Telegram is not just a messaging app, it is also a social media platform. As a social media platform, it is sitting on an enormous amount of user data. Indeed, it is sitting on the contents of all communications that are not one-on-one messages that have been specifically [end-to-end] encrypted,” Galperin said. “‘Thirty engineers’ means that there is no one to fight legal requests, there is no infrastructure for dealing with abuse and content moderation issues.” In other words, it’s unlikely for Telegram to be very effective fighting hackers, especially government-backed ones, with such a small staff... #cybersecurity #informationsecurity #security #telegram #cryptography #cybercrime #cyberdefense #hacking

19

7 Comments

👀 The DOD's Office of the CIO has released the "DevSecOps Continuous Authorization Implementation Guide" as guidance for defense agencies seeking to achieve cATO for DevSecOps platforms and other applications produced by a software factory. There's a lot in here, but I found some really interesting data, especially in the "Practical Implementation Advice" section regarding SBOMs, agile and cloud! A hierarchical set of foundational concepts is called out early in the document for: ➡ Software Factories (platform, people and processes) ➡ which have a DevSecOps platform (tools and automation) ➡ that rely on automated DevSecOps pipelines (process workflows). Implementation recommendations include: 1. Choose an existing platform or use an integrated DevSecOps Platform (DSOP). Cloud-native tooling is recommended, highlighting modernization targets of the DOD. 2. Run the DevSecOps Platform on a commercial cloud if possible. If not, at least consider some development and testing in the cloud. This brings to mind considerations such as cloud preference, web-based IDE and dev environments, template availability, and AI assisted platform feature availability. 3. Keep security involved. I immediately thought of the NIST SSDF, Secure by Design, and other best practice security frameworks and policies. It also brings to mind workflow controls such as merge approvals, protected environments, and role-based permissions. 4. Go Agile. There's a hard push for agile from a people and frameworks perspective. When considering a platform, ensure you can roll up data across projects to not only gain real-time status views, but also to aid in fine-tuning planning exercises. 5. Implement continuous monitoring, Think about this from a platform level, an application perspective, and a maintenance consideration. There are many components to this one, including SBOM support and monitoring-driven activity via continuous vulnerability scanning, which is related to the next point. 6. SBOM should be available for the DSOP AND all applications running through it. This is a big one, potentially the hardest requirement I've seen for SBOM creation to date. Team/people advice includes: 1. Culture change. This is always the starting point! This can be monitored to some extent through governance solutions within the DSOP and compliance frameworks and policies that focus on enforcement of best practices while reporting on outliers. 2. Lightweight agile use. Don't use waterfall, don't use a heavy agile process or requirements. This is a strong callout. Platforms should be flexible enough to accommodate variations in agile implementation! 3. Setup of test and integration environments early. I'd add "repeatably" here so that we eliminate as much human configuration requirement as possible. The doc: https://lnkd.in/geqFbikB #devsecops #dsop #sbom #gitlab #agile #dod #softwarefactory

52

7 Comments

MLSecOps Community Podcast S2Ep10 "Evaluating RAG and the Future of LLM Security: Insights with LlamaIndex" Watch or listen to the full episode here --> https://lnkd.in/d39JtN53 Hosts Neal Swaelens and Oleksandr Yaremchuk sit down with special guest Simon Suo, co-founder and CTO of LlamaIndex. The group discusses many topics, including: - Challenges and considerations of integrating LLMs into various applications, emphasizing the importance of contextualizing LLMs within specific environments. - The evolution of retrieval-augmented generation (RAG) techniques and the future trajectory of LLM-based applications, including the significance of balancing performance with cost and latency in leveraging LLM capabilities. - LLM security concerns and the critical need for robust input and output evaluation to mitigate potential risks. - The potential vulnerabilities associated with LLMs, including prompt injection attacks and data leakage, underscoring the importance of implementing strong access controls and data privacy measures. - Efforts within the community to address security challenges and foster a culture of education and awareness. Listen or read the transcript here to learn more about the ongoing innovation in large language model-based applications, while remaining vigilant about LLM security considerations ➡️ https://hubs.ly/Q02v63y60 Thanks again for joining and sharing your insights, Simon! Also, stop by and visit Protect AI at RSA and learn more about our MLSecOps community! #MLSecOps #aisecurity #MLSec #airisk #machinelearning #ai #llm h#genai #llamaindex #protectai #cybersecurity #rag

36

Quantifying Compliance ROI: How Fusion1, OmnibusX, and Avery Offset Risk, Save Time, and Minimize Errors When it comes to compliance, small improvements add up fast. With the Fusion1 Risk Offset Model, we’re quantifying the real, measurable impact of a unified compliance platform. Here’s how: 1. Compliance Hours Reclaimed: With 40% of time saved on routine tasks, a team gains back nearly 600 hours annually—adding 3 months of productivity. 2. Error Reduction Multiplier: By automating workflows, we reduce error rates by up to 80%, minimizing manual mistakes and ensuring accurate compliance records. 3. Risk Reduction Impact: From avoided fines to incident cost savings, OmnibusX and Avery proactively protect against costly compliance incidents, potentially saving $175K a year. 4. Compliance Efficiency Multiplier: Combined efficiencies of 240% demonstrate how Fusion1 amplifies compliance efforts with proactive monitoring and AI-driven insights. 5. Annual Cost Savings: Together, Fusion1, OmnibusX, and Avery yield over $200K in annual savings through a mix of time efficiency, risk reduction, and error minimization. The takeaway? With these solutions, compliance isn’t just a box to check—it’s a strategic advantage, freeing teams to focus on what matters most. www.regverse.com; www.kovair.com ; www.surgeventures.com #Fusion1 #ComplianceEfficiency #RiskOffsetModel #ProactiveCompliance #OmnibusX #AverybyRegVerse

18

💡 How does my PKI’s status compare to that of others? Understanding where your Public Key Infrastructure (PKI) stands compared to others can be a game-changer. It’s not just about identifying benchmarks and best practices but also uncovering areas ripe for improvement. 🌟 While it’s crucial to tailor your PKI evaluation to fit your organization’s unique needs and constraints, benchmarking against industry reports, case studies, and peer-reviewed publications can offer invaluable insights into your PKI’s performance. 📊✨ Though the PKI Consortium doesn’t publish individual maturity assessment results, we provide a vibrant community where you can exchange experiences and learn from others. Join our working groups and tap into a wealth of shared knowledge! 🤝🌐 Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium

13

I stay away from politics, but I feel this is an important article to share. CSO Online "Another red flag, experts say, is a recommendation to move the Office of the National Cyber Director (ONCD) to the National Security Council (NSC), and to require NSC employees to submit to something akin to a political loyalty test, injecting partisan politics into cybersecurity policy, which has long been a nonpartisan issue among lawmakers and policy professionals." #cybersecurity #riskmanagement #ITmanagement #CIO #CISO https://lnkd.in/ggDrtrth

6

🔍 Mind Map for Bypassing AV/EDR I recently found this great resource that efficiently maps out key techniques for bypassing anti-virus and EDR solutions. From droppers and shellcode obfuscation to process injection and sandbox evasion, it covers a wide range of practical methods. I highly recommend checking it out: https://lnkd.in/eEujX23V A must-see for anyone looking to enhance their offensive security skills! #CyberSecurity #RedTeam #BypassAV #OffensiveSecurity

4

Apple's iMessage has become the latest battleground for antitrust scrutiny. As the cornerstone of digital communication, Apple's iMessage has woven its way into our daily lives with its seamless integration and encryption. Yet, these very merits have put it under the microscope, as authorities weigh up the delicate balance between innovation and market monopolization. I've been keeping a close eye on these developments. They're pivotal steps towards ensuring the tech landscape doesn't become a playground for mega-corporations but remains a fertile ground for innovation and fair competition. iMessage's exclusivity, while offering an unparalleled user experience, constructs a walled garden potentially limiting consumer choice and stifling competition- the key concerns of antitrust debates. The European Union’s Digital Markets Act (DMA) is pushing against such digital monopolies, seeking to dismantle these barriers. Having championed open tech ecosystems and interoperable standards throughout my career, I view the EU’s actions as crucial steps towards balancing innovation and competition. I believe that technology should be a catalyst for human potential, accessible to all, not confined within the walls of mega-corporations. The ethical use of technology must also consider competition. Apple’s iMessage, while offering secure communication, should not curb the market's competitive spirit or confine consumers to a single ecosystem. We must strive for a tech landscape where innovation flourishes without erecting impenetrable barriers to competition and consumer choice. In conclusion, the ongoing scrutiny of Apple’s iMessage underscores the broader challenge of aligning technology with regulation and market dynamics. It's a wake-up call for ensuring our advancements are innovative and equitable. So here's to a future where our text messages and tech advancements are made with ethical, inclusive, and competitive spirit. Read more here: https://lnkd.in/eJwK9dfT And for more tech insights, subscribe to my Youtube channel here: https://lnkd.in/epAirURT #TechInsight #TechForAll #DigitalMarketsAct #TechConsultant #techfuturist #TheGodfatherofTech #TimBates

14

NIST Releases an Open-Source Platform for AI Safety Testing: America's National Institute of Standards and Technology (NIST) has released a new open-source software tool called Dioptra for testing the resilience of machine learning models to various types of attacks. "Key features that are new from the alpha release include a new web-based front end, user authentication, and provenance tracking of all the elements of an experiment, which enables reproducibility and verification of results," a NIST spokesperson told SC Media: Previous NIST research identified three main categories of attacks against machine learning algorithms: evasion, poisoning and oracle. Evasion attacks aim to trigger an inaccurate model response by manipulating the data input (for example, by adding noise), poisoning attacks aim to impede the model's accuracy by altering its training data, leading to incorrect associations, and oracle attacks aim to "reverse engineer" the model to gain information about its training dataset or parameters, according to NIST. The free platform enables users to determine to what degree attacks in the three categories mentioned will affect model performance and can also be used to gauge the use of various defenses such as data sanitization or more robust training methods. The open-source testbed has a modular design to support experimentation with different combinations of factors such as different models, training datasets, attack tactics and defenses. The newly released 1.0.0 version of Dioptra comes with a number of features to maximize its accessibility to first-party model developers, second-party model users or purchasers, third-party model testers or auditors, and researchers in the ML field alike. Along with its modular architecture design and user-friendly web interface, Dioptra 1.0.0 is also extensible and interoperable with Python plugins that add functionality... Dioptra tracks experiment histories, including inputs and resource snapshots that support traceable and reproducible testing, which can unveil insights that lead to more effective model development and defenses. NIST also published final versions of three "guidance" documents, according to the article. "The first tackles 12 unique risks of generative AI along with more than 200 recommended actions to help manage these risks. The second outlines Secure Software Development Practices for Generative AI and Dual-Use Foundation Models, and the third provides a plan for global cooperation in the development of AI standards." Thanks to Slashdot reader spatwei for sharing the news. Read more of this story at Slashdot.

1