Recently, a friend posted a wonderful piece attributed to their hero, the CISO. I disagreed and immediately felt like a party pooper. But, I had to do it.

Here’s why.

In business today, the role of a CISO is crucial. With the consistency and severity of cyber attacks and data breaches worsening, compliance becoming a minefield, organisations are turning to (and paying) CISOs for protection and guidance.

However, it’s important to note that while the CISO may be seen as a hero in the eyes of many, this mindset can be dangerous. Placing too much pressure on one individual to single-handedly protect an entire organisation can result in someone developing what’s commonly referred to as a hero complex.

And before you say, the buck has to stop with someone, hear me out.

First, What’s a Hero Complex?

Often stemming from a strong desire to be seen as exceptional, indispensable, or the sole saviour in challenging situations, this complex can manifest in various ways. Considering how it develops, here are a few things to be aware of:

• Need for Recognition: In environments that emphasise heroism, individuals might feel compelled to constantly seek recognition and praise for their actions, leading to a reliance on being perceived as the only solution to problems.
  
  
• Overextension and Burnout: Those with a hero complex may struggle to delegate tasks or seek support, resulting in overextension and potential burnout as they take on more than they can reasonably handle.
  
  
• Disregard for Team Effort: The hero complex can lead individuals to undervalue the contributions of others and undermine the importance of collaborative efforts in achieving success.
  
  
• Risk of Perfectionism: There’s a risk of developing perfectionist tendencies, as individuals with a hero complex may feel the need to consistently excel and maintain an image of infallibility.

Heroes Often Attract Drama

Steven Karpman, the creator of the Drama Triangle model, see below, outlined how the hero, along with the victim and persecutor, contributes to the cycle of interpersonal conflict and dysfunction.

His work sheds light on the underlying motivations and consequences of hero behaviour within this framework. Karpman’s analysis emphasises that the hero’s actions, while initially driven by a desire to help, can inadvertently perpetuate a sense of powerlessness and dependency among those they seek to rescue.

Furthermore, the hero’s interventions may stem from their own need for validation or a sense of purpose, leading to a complex interplay of psychological dynamics within the drama triangle. As such, understanding the role of the hero in the drama triangle provides valuable insights into the complexities of human interaction and the potential for transformative change through awareness and conscious communication.

A Securer Approach

That’s why I advocate for a different, securer approach – positioning the CISO as a guide rather than a hero. This concept is similar to that of Obi One in Star Wars, who acted as a mentor and guide to Luke Skywalker rather than doing all the work himself.

And yes, I bet you’re saying well his role wasn’t to protect an entire galaxy, but hear me out, again.

The CISO’s role is more than just protecting the company from cyber threats for the CISO has to become an enabler for the rest of the organisation. They educate and empower employees on cybersecurity best practices, implement policies and procedures, and provide guidance on identifying and mitigating potential risks.

By taking on this role as a guide, the CISO builds a stronger culture of security within the organisation. Employees become effective cyber defenders as they’re now more aware of potential threats and are better equipped with the knowledge and resources to protect themselves and their company.

Additionally, by shifting away from the idea of a hero, organisations avoid placing unrealistic expectations on their CISOs.

Here’s how they building stronger security postures and healthier environments:

• • Promote Collaboration: Emphasise the value of teamwork and collective problem-solving to reduce the pressure on individuals to always be the hero.

• • Recognise Contributions: Acknowledge and celebrate the efforts of all team members, highlighting the collective achievements rather than individual heroics.

• • Encourage Self-Care: Foster a culture that prioritises self-care, work-life balance, and open discussions about mental health to prevent burnout and promote well-being.

• • Develop Leadership Skills: Provide opportunities for individuals to cultivate leadership skills that prioritise delegation, mentorship, and empowering others.

To end…

I believe CISOs should never be positioned as a hero. By acknowledging and addressing the potential development of heroes, organisations and individuals can create a more supportive and balanced work environment that values collaboration, shared success, and individual well-being.

Now I want to hear from you…

In a culture that celebrates heroes, tell me how can we shift the narrative to honour collective efforts and collaborative achievements, fostering a more inclusive and sustainable approach to success? Drop me an email or join me on LinkedIn where we can continue this discussion and you can tell me your thoughts on this matter.

Or, reflect on a time when you felt compelled to be the hero in a situation. How might the outcome have differed if a collaborative approach was prioritised?

By Jane Frankland (Business Owner & CEO, KnewStart)

Original link of post is here

As we emerge from an intense season of industry conferences like Infosec and RSA, I believe the cybersecurity community finds itself at a critical juncture. While hot topics like AI’s role in combating hacker threats has dominated discussions, an equally significant issue has remained—mental health and burnout.

As an industry veteran, having spent over two decades in cybersecurity, I’ve been thinking a lot about the current state of the field—our relentless pursuit of productivity, and how we often find ourselves trapped in a cycle of continuous hard work — an endless grind of task completion, goal attainment, and often burnout.

And while the modern world champions the industrious individual, I posit that this push for unwavering productivity might just be the arch-nemesis of creativity and the innovation we need in cyber if we’re to win against our attackers.

Consider the paradox where the most innovative ideas often occur not when we’re buried in work, but when we’re relaxing and taking a break from work.

History tells us that it’s on the backs of such moments that Sir Isaac Newton pondered gravity, Sir Charles Darwin’s mind unraveled the theory of evolution, and Albert Einstein profoundly reshaped our understanding of the universe with his theory of relativity, all during moments of introspection and contemplation.

It’s in these times of relaxation, our minds have the freedom to wander and make connections that may not arise in a busy work schedule. Yet, our obsession with being productive and “always on” often leaves little room for the mind to wander and explore the vast expanses of imagination.

This industriousness, driven partly by economic demands, and an adrenaline addicted corporate culture, inadvertently establishes a framework where time spent idle or in leisure is regarded as someone being lazy, having a lack of ambition, and quite simply wrong.

But is it really so?

Let’s consider AI

AI’s integration into the cybersecurity landscape is not only optimising operational efficiency but it’s also paving the way for valuable downtime, crucial for ideation and problem solving. By handling routine and monotonous tasks, AI is now enabling cybersecurity professionals to divert their cognitive resources towards more strategic endeavours.

This technological partnership means that while AI manages real-time threat detection and basic incidence responses, human experts can engage in creative deliberation, deeper analysis, and strategic planning. This blend of human ingenuity and AI brings with it the potential to create a more cyber resilient defence mechanism and foster an environment where breakthrough ideas and novel solutions can flourish, ultimately contributing to more robust cybersecurity frameworks.

Story time

On a personal note, I recall the time a Managing Director at one of the companies I was working at joined a new team and stepped into a whirlwind of responsibilities. She believed in the power of relentless hard work until she took her first holiday with her family after joining this team and was forced to disconnect. Upon her return, she raved about the rejuvenation she felt from genuinely disconnecting, engaging in quality time with her loved ones, and stepping away from the all-consuming digital ties to her professional life, including an important tender which due date coincided with her holiday.

This break from constant productivity didn’t send her team into disarray. Quite the opposite. She returned with a wellspring of energy, each idea sharper, each decision crisper, an embodiment of how periods of rest not only restore but renew our creative spirit.

Harnessing the Power of Pause in Cyber

With cybercrime costs growing globally at the rate of 15% per year, AI technology expected to grow 4x in the next five years, and cybersecurity professionals burning out at a faster rate than frontline health care workers. I believe now is the time to ask ourselves whether the uninterrupted chase after productivity can be held responsible for dulling the spark of innovation within us and stopping the flow of good ideas.

Perhaps it’s in the moments of stillness, in the pause between the notes of our daily lives, that the symphony of creativity truly unfolds.

Practical Steps for Implementing Downtime in Cybersecurity Teams

• Institutionalise Breaks:Encourage employees to take regular breaks throughout the day to refresh their minds and reduce stress.
  
  
• Create Flexible Work Arrangements: Flexibility in work schedules allows employees to find their optimal working hours, leading to increased productivity and creativity. Consider implementing a four-day workweek, shorter working days to give your team time to recharge, or (if possible) giving them the freedom to find their most productive times without being constrained by traditional office hours.
  
  
• Support Mental Health: Addressing mental health concerns is crucial for fostering a creative and healthy workplace culture. Invest in programs that provide resources for managing stress, building resilience, and promoting overall well-being.
  
  
• Embrace AI Technology: As mentioned earlier.
  
  
• Promote Work-Life Balance: Foster a culture that values time spent pursuing passions outside of work, whether it’s hobbies, family time, or simply relaxing.
  
  
• Encourage Mindfulness Practices: Introduce mindfulness and relaxation techniques, such as meditation or yoga, to help employees manage stress and maintain mental clarity.
  
  
• Lead by Example: Leadership should model these behaviours, demonstrating that taking time to recharge is not only acceptable but encouraged.
  
  
• Contact companies who specialise in reducing burnout in cybersecurty: Cybermindz instantly springs to mind but The Mental Health in Cybersecurity Foundation via Sarb Sembhi‘s lead in the UK is doing some great work to unite groups, as well as Forrester for research via Jinan Budge.

To End

To entrepreneurs and corporate leaders, I say this: recognise that efficiency isn’t always the frequency of output but sometimes the latitude of the thoughts we breed. Offer the world of work the room it needs to flex the muscles of creativity rather than chain it down with timesheets and the weighty expectations of constant productivity.

Trust in your employees to deliver the best results when they’re given the freedom, space and guardrails to unlock their true potential. Embrace a culture that values taking breaks, pursuing passions outside of work, and allowing minds to wander. Reshape this understanding of what it means to be productive, and unlock the full potential of creative energies.

Because in advocating for periods of respite and a redefinition of a successful work ethic, you do not call for indolence but a balanced approach where industriousness does not become creativity’s stranglehold.

Now I want to hear from you…

Tell me about a time when you experienced a burst of creativity after taking a break from work. How did it impact your productivity in the long run?

Drop me an email or join me on LinkedIn so we can continue this conversation and find ways to embrace both industriousness and creativity in our lives.

By Jane Frankland (Business Owner & CEO, KnewStart)

Original link of post is here

We had a community session on The CISO's Journey: From Expert to Leader featuring David B. Cross (SVP & CISO at Oracle), Bikash Barai (CEO, FireCompass; Advisor, CISO Platform) & David Randleman (Field CISO, FireCompass)

In this discussion, we covered the journey from cybersecurity expert to strategic leader including stages of a CISO’s evolution, the balance between technical expertise and leadership, the unique value veterans bring to cybersecurity, and strategies to stay ahead of emerging attack techniques in an ever-changing threat landscape.

Key Highlights:

• Career Evolution: Insights into the journey to becoming a CISO at Oracle and defining career moments.
  
• Success Metrics: Industry trends shaping how CISOs measure success.
  
• Veterans’ Role: The impact of veterans’ skills and clearances in cybersecurity hiring.
  
• Mental Health & Pop Culture: Managing stress as a CISO and pop culture’s take on cybersecurity.

About Speaker

• David B. Cross (SVP & CISO at Oracle)
  
• Bikash Barai (CEO, FireCompass; Advisor, CISO Platform)
  
• David Randleman (Field CISO, FireCompass)

Executive Summary (Session Highlights):

• The Journey from Expert to Leader: A CISO’s Perspective
  
  The session delved into the evolution of security professionals into leadership roles. David Cross, CISO at Oracle, emphasized that becoming a CISO is a journey requiring patience, adaptability, and preparation, much like training for a marathon. Key insights included the importance of seizing opportunities, even when the path isn’t clearly defined, and continually evolving one’s leadership capabilities.
  
• The Power of Mentorship in Leadership Development
  
  The speakers underscored mentorship as a cornerstone for growth. David Cross introduced three types of mentors:

1. Long-term mentors for career guidance.
   
2. Tactical mentors for skill-specific improvements.
   
3. Peer mentors for candid, constructive feedback.
   Bikash Barai highlighted the value of collaboration over mere networking, urging CISOs to “pay it forward” and contribute to community growth.
   

• Stress Management and Achieving Work-Life Harmony
  
  Stress management was a central theme, with both speakers sharing personal strategies. David Cross described running as his form of meditation, enabling mental clarity and resilience. Bikash Barai spoke about evolving from task management to a philosophy of happiness, integrating mindfulness, gratitude, and awareness into his routine.
  
• Prioritization: A Key Challenge for CISOs
  
  The discussion highlighted the complexity of prioritizing risks and tasks in cybersecurity. Bikash Barai compared life’s minimalism with cybersecurity’s intricacies, emphasizing risk-based and exploitability-based prioritization. David Cross advocated for standardizing prioritization frameworks to reduce ambiguity, ensuring decisions are fact-based rather than political.
  
• AI and the Future of Cybersecurity
  
  AI emerged as a pivotal theme for 2025. The panel explored two key AI considerations:

1. AI for Security – Leveraging AI to enhance threat detection, automate security operations, and optimize response.
   
2. Security for AI – Integrating robust security development lifecycles for AI systems to mitigate vulnerabilities.
   Both speakers stressed the necessity for CISOs to maintain a technical foundation, as understanding AI and its risks is now critical for leadership credibility.
   

• Networking, Community, and Continuous Learning
  
  The session emphasized building strong professional networks and leveraging communities for shared learning. The speakers encouraged CISOs to prioritize ongoing skill development, aligning with evolving technologies such as AI and quantum computing.
  

Conclusion: Preparing for the Next Phase of Leadership

The conversation concluded with actionable takeaways for CISOs:

• Invest in mentorship and continuous learning.
  
• Standardize prioritization processes to manage risks effectively.
  
• Build resilience through stress management strategies.
  
• Leverage AI both as a security tool and as a protected asset.
  
• Focus on collaboration, networking, and contributing to the larger cybersecurity community.

We are hosting an exclusive Best of the World Talks session on "How the rapidly evolving expectations of cybersecurity are forcing CISOs to adapt and show more value to their organization?" featuring Matthew Rosenquist (CISO at Mercury Risk & Compliance) & David Randleman (Field CISO at FireCompass).

The rapidly evolving expectations of cybersecurity are pushing CISOs to adapt and demonstrate greater value to their organizations. This session explores the changing role of the CISO heading into 2025, strategies for managing increasing expectations, and how to effectively organize a cybersecurity roadmap to align with business goals in a dynamic threat landscape.

Key Discussion Points: 

• What are the expectations for the CISO role going into 2025?
• How can an effective security leader manage these expectations?
• How do you organize your cybersecurity roadmap for the year?

Date: 19th Dec, 2024 (Thursday)
Time: 8:00 AM PST | 9:30 PM IST

Join us live or register to receive the session recording if the timing doesn’t suit your timezone.

>> Register here

Part 2 of Interview with Enoch Long

As cyber threats become more sophisticated, the need for visibility across your organization’s cyber asset environment and proactive strategies has become increasingly critical. According to Enoch Long, Field CISO at JupiterOne, true visibility goes beyond asset tracking and instead should encompass people, processes, and technology to create a unified defense. In Part 2, Enoch dives into actionable advice for security leaders, including the importance of asset management, strategies for adapting to evolving threats, and critical trends that will shape cybersecurity in 2025. If resilience is the goal, visibility is the foundation—and Enoch offers insights to help organizations build both.

What advice would you give to security leaders and practitioners as they work to protect their organizations from evolving threat actors?

In today’s environment, your security strategy must start with a clear understanding of your attack surface—knowing your assets, and where they reside. In the past, security teams focused on log management and monitoring network access without integrating asset management into their approach. With the rise of hybrid environments, cloud infrastructure, and distributed networks, you need to understand every asset—where it resides, how it’s connected, and what vulnerabilities it presents. An asset isn’t just an item on a checklist; it’s a potential entry point that needs to be secured and monitored.

As organizations adopt more federated IT models and hybrid cloud setups, many business units operate with their own quasi-IT teams, deploying systems and SaaS applications autonomously. Security teams must ensure that even with this decentralization, asset management and security standards are consistent across the organization. Establish clear protocols for asset discovery, vulnerability tracking, and continuous monitoring to maintain a unified security posture, regardless of where the assets are located or who manages them.

My top recommendation is to focus on improving the storytelling around incidents and near-misses. Often, the things we "just got lucky on" can be powerful learning moments and a compelling way to communicate the importance of proactive security measures to leadership. Dig into situations where luck played a role. For example, maybe an employee didn’t click on a malicious link, or maybe a threat was caught by chance rather than through a well-designed control. These close calls highlight vulnerabilities that need addressing, and they provide stories that illustrate the risks clearly to executives and other stakeholders.

Many near-misses can be traced back to incomplete asset management, outdated configurations, or a lack of visibility into the environment. By connecting these incidents to gaps in asset management or inventory, you provide a practical context that shows where better resources, tools, or processes could make a difference. Convey that relying on luck isn’t sustainable while demonstrating an urgent need for proactive improvements.

Looking at trends, how important is visibility in cybersecurity in the evolving cybersecurity threat environment?

Visibility means more than just knowing where your devices are; it’s about having a comprehensive understanding of your people, processes, and technologies. True visibility isn't simply tracking assets—it's about knowing who’s managing them, how they’re being used, and how they fit into the bigger picture of your operations.

Starting with a clear view of the people supporting your infrastructure. It’s not just about knowing roles but understanding who manages specific devices, applications, servers, and connections. Security is most effective when it considers the operating model—knowing who’s responsible for what and ensuring they have the context needed to make informed decisions.

Beyond asset tracking, true visibility extends into how systems are deployed and managed throughout their lifecycle. From deployment in production environments to manufacturing and operational sites, visibility requires insight into every step, from inception to production. Knowing the lifecycle of each asset and the processes that support them gives you a deeper understanding of potential risks and areas to monitor.

While it’s common for organizations to use 30-40+ security tools, visibility requires going beyond simply having these technologies. It's about configuring each tool effectively, ensuring they’re logging appropriately, and collecting the right data for meaningful analysis. When your technology stack is not only comprehensive but also configured with purpose, it transforms raw data into actionable insights.

In the evolving threat environment, true visibility is the fusion of people, processes, and technology into one cohesive approach. It’s this level of visibility that equips security teams to respond swiftly and proactively, maintaining a strong defense against an increasingly complex threat landscape.

What cyber trends are you seeing for 2025?

When it comes to key security trends, this varies based on an organization’s level of maturity. More mature security programs tend to look beyond the immediate buzzwords and dig into threats and trends that may be overlooked. Here are four critical trends I see security leaders at more mature organization are tracking closely:

●      A few years back, supply chain attacks were all over the news, and while this has quieted down, mature security leaders haven’t forgotten. They know the risk is still very real and likely to resurface. Organizations still rely on interconnected software, so keeping an eye on supply chain vulnerabilities is crucial to staying a step ahead.

●      AI is the hot topic, but not all of the excitement translates into practical use cases. A lot of experienced teams are taking a step back to sort out what’s real and useful versus what’s marketing fluff. They’re asking tough questions about measurable impacts, focusing on AI applications that add value today instead of getting caught up in futuristic possibilities that the organization may not even be ready to handle.

●      With data moving in and out of systems, countries, and even cloud environments, data protection is more critical than ever. Security leaders are now treating data like an asset, asking not only where sensitive information is stored but also how it moves within and outside the organization. It’s about having a complete data inventory, knowing classification levels, and ensuring protection policies are in place wherever that data goes.

●      Vulnerability management has stepped up a notch with Continuous Threat Exposure Management (CTEM). Rather than tackling vulnerabilities as isolated issues, CTEM helps teams get visibility across both internal and external attack surfaces, allowing them to prioritize based on real exposure. It’s a shift toward proactive threat management, merging traditional vulnerability insights with a broader attack surface view to help teams handle risks more strategically.

Cybersecurity is no longer just about reacting to incidents—it’s about staying ahead of them. As Enoch has indicated, building resilience starts with a clear understanding of your environment, from assets and vulnerabilities to the people and processes behind them. By prioritizing visibility and adopting proactive strategies, organizations can transform their security posture from reactive to strategic.

If you’re ready to take the next step in proactive cybersecurity, JupiterOne offers the tools and insights you need to uncover risks, prioritize actions, and secure your most critical assets. Learn more about how JupiterOne can help you build a resilient, future-ready cybersecurity program.

 

- By Chuck Brooks (President, Brooks Consulting International)

Original link of post is here

Cybersecurity is a constantly changing battleground, where threats are evolving more rapidly than ever before. For Enoch Long, Field CISO at JupiterOne, navigating this complex environment requires not only technical expertise, but also a calm and strategic mindset which he has developed over his two decades spent in the field. From leading SOC teams during high-pressure incidents to managing enterprise security for Fortune 500 companies, Enoch has seen firsthand how the threat landscape has evolved over time. In Part 1 of this two part series, Enoch shares his experiences handling major threats, the challenge of staying ahead in the SOC, and how modern-day adversaries have transformed the way security operations teams must respond.

Can you describe one of the biggest threats you’ve personally dealt with during your time in the SOC, and how you approached handling it?

One of the biggest threats I’ve encountered in my time in the SOC was not necessarily a headline-grabbing event, but rather a smaller incident that had a major impact on the business and significant visibility within the leadership chain. In many cases, we don’t immediately grasp the full scale or impact of an incident. Often, it's only through the process of collecting data, analyzing information, and providing regular updates that we begin to understand just how far-reaching the effects may be.

In this case, as more data emerged, it became clear that this seemingly minor issue had larger implications, requiring extensive internal communication and coordinated response efforts across teams. This experience really drove home the fact that the “biggest” threats aren’t always the flashiest. Sometimes it’s quieter, underlying issues that end up testing a team’s resilience and response agility. It’s a reminder that visibility, strong reporting, and a proactive mindset are crucial—because in this line of work, anything can become a serious challenge.

As a SOC lead, it’s essential to stay composed and level-headed, no matter the situation. My approach is all about balancing emotional intelligence with a visible presence, clear communication, and data-driven updates. This combination ensures we’re not only responding to the incident effectively but also maintaining the trust and confidence of both the team and leadership throughout the process. This approach also helps the team stay focused and confident, and it sets the tone for a controlled, organized response. During an incident, I ensure that everyone, from defenders and operators actively mitigating the threat to IT teams providing support, can reach me quickly. Whether on video or in person, this accessibility allows me to offer guidance, answer questions, and address immediate needs directly. I prioritize clear, fact-based updates, focusing on what we know, the steps we’re taking, and practical next steps for the team. I keep executive stakeholders, like the CIO and GC, informed with regular updates, laying out the incident’s status, our response plan, and what they can expect moving forward.

Looking back at the threat landscape from the past compared to today, what are the three biggest changes that stand out to you? How have these changes impacted the way the SOC operates and responds to threats?

From my perspective as someone who’s spent over 20 years in security operations, these changes represent the types of threats we focused on in the past.

●     Back in the day, we focused on sophisticated attacks from nation-state actors and the occasional insider threat. Ransomware wasn’t a primary concern, nor were we overly worried about “script kiddies” or loosely organized hacker groups. Now, ransomware gangs have transformed into well-organized operations, often behaving more like businesses than lone hackers. They’re targeting companies indiscriminately, and their methods have evolved to impact organizations at every level.

●     Today, the landscape is filled with a much broader range of threat actors. Now, we have to consider a spectrum that includes lone wolf hackers, hacktivists, and politically motivated groups alongside nation-states. This diversity has added more complexity to our defense strategies, as each type of actor has different goals, methods, and levels of sophistication.

●     Insider threats used to primarily involve accidental exposures or compromises of individuals who were physically present within the organization. We now deal with sophisticated insider threats that can be linked to external cybercriminals, like employees who unintentionally open the door to attackers through phishing or other social engineering tactics.

All of these changes mean that SOCs must account for a wider array of tactics and motives. Threat response now requires a more nuanced understanding of the context behind each incident. For example, attacks can be triggered by something as simple as a political statement from leadership. In one case, I read about how a two-person hacker team launched an attack solely to embarrass the company over a public affiliation with a political figure. This level of targeted retaliation requires the SOC to consider potential reputational triggers and how they could motivate actors to disrupt operations.

The SOC has to expand its approach, adopting proactive intelligence gathering to identify emerging threats before they escalate. Response strategies have to become more dynamic, relying on flexible playbooks that allow for rapid adaptation to unexpected motives and sophisticated attack methods.

As cyber threats grow more complex, the role of visibility and intelligence has never been more critical. In Part 2, Enoch dives into actionable strategies for security leaders to protect their organizations in this ever-changing landscape.

About Enoch: Enoch Long serves as JupiterOne’s Field CISO. In this capacity, Mr. Long has global responsibility for providing executive leadership, domain expertise, strategic, technical, operational, and security guidance for the Global GTM organization. Before joining JupiterOne, Enoch held key strategic leadership positions at Regeneron Pharmaceuticals, Alexion, Splunk, and Northrop Grumman. He also served key cyber engineering and advisory roles supporting the Dept of Defense and the intelligence community. Enoch earned his MBA from Georgetown University and a Bachelor of Science in Computer Science from Temple University. Enoch is based in Washington, DC.

- By Chuck Brooks (President, Brooks Consulting International)

Original link of post is here

Spooky Cyber Stats And Trends In Time For Halloween

Chuck Brooks

FORBES Contributor

Global Thought Leader in Cybersecurity and Emerging Tech

Spooky Cyber Stats and Trends in Time for Halloween

Every year the stats on cyber-attacks seem to get spookier! As we finish October’s Cybersecurity Awareness month, it is a suitable time to review some of the key statistics and trends that can haunt us and help us meet the cybersecurity challenges of the evolving digital ecosystem. There are so many frightening cyber stats that I had room for only a few categories, but they are important ones to know.

The healthcare industry is a continuing prime target for criminal hackers. Consider these realities:

Two-thirds of healthcare organizations hit by ransomware in past year: survey

Two-thirds of healthcare organizations hit by ransomware in past year: survey | Healthcare Dive

“Nearly 40% of healthcare organizations reported it took more than a month to recover after an attack, according to the survey by cybersecurity firm Sophos. The healthcare sector’s increased burden of ransomware attacks comes as other industries face fewer incidents, according to the survey by cybersecurity firm Sophos. Recovery from ransomware attacks is taking longer  — sometimes more than a month  —  as attacks increase against the healthcare industry, About two-thirds of respondents said they were hit by a ransomware attack in the past year, up from 60% the year prior. Just 34% said they were hit by a ransomware attack in Sophos’ 2021 report.”

14M patients affected by healthcare data breaches in 2024

Healthcare organizations remain top targets for cyberthreat actors, according to a SonicWall threat brief that explored trends in healthcare data breaches.14M patients affected by healthcare data breaches in 2024 | TechTarget

“At least 14 million patients in the U.S. have been affected by healthcare data breaches in 2024 so far, a threat brief by cybersecurity company SonicWall revealed. What's more, 91% of the healthcare data breaches that SonicWall researchers analyzed involved ransomware, highlighting the continued targeting of the U.S. healthcare sector. SonicWall based its report on data from SonicWall Capture Labs, which uses machine learning to collect and retain data about attack vectors and threats in real time. The researchers concluded that healthcare remains a top target for exploitation by cyberthreat actors due to its data-driven nature and reliance on sensitive data.”

Change Healthcare data breach officially affects 100M

Change Healthcare data breach officially affects 100M | Healthcare Dive

“The massive Change Healthcare cyberattack could have compromised data from 100 million people — the largest healthcare data breach ever reported to federal regulators. Responding to the cyberattack has cost UnitedHealth too. Earlier this month, the healthcare giant said it has recorded $2.5 billion in total impacts from the attack through the nine months ended Sept. 30, including $1.7 billion in direct response costs.”

CB Take: The cyber-attack on Change Healthcare is certainly alarming and is another wake-up call. It is not surprising that hackers focus on healthcare. As computers and other devices used for medical care become more networked and linked, the digital world of health management, clinics, hospitals, and patients has become more vulnerable. A more comprehensive approach to healthcare cybersecurity should include better risk management, more investments in cybersecurity to protect systems, and good cyber hygiene.

Dmitry Raidman, CTO & Co-founder, of the company Cybeats offers excellent advice:  “Given its critical nature and unique vulnerabilities, the healthcare sector must adopt a multi-layered approach to combat the rise in ransomware attacks. This means strengthening security through continuous network segmentation, deploying endpoint detection, and enhancing user training, as healthcare systems are only as resilient as their most vulnerable points. A proactive, risk-based approach that includes frequent vulnerability assessments and comprehensive data backups is essential to ensure both operational continuity and patient safety. Collaboration with industry stakeholders and sharing threat intelligence can also provide the healthcare sector with a stronger front against these growing cyber threats."

Ransomware, especially popular for extorting healthcare, has also been deployed across industries and significantly elevated incidents.

Ransomware incidents rose 73% globally in 2023, report shows

Ransomware incidents rose 73% globally in 2023, report shows | StateScoop

“Ransomware attacks rose 73% between 2022 and 2023, according a report published Thursday by the Ransomware Task Force, part of the Institute for Security Technology, a Washington D.C. think tank. The annual report, which includes a map of global ransomware incidents and identifies ransomware trends based on reporting of double-extortion attacks — in which cybercriminals demand ransom payments from victims to keep their data private and off the dark web — found there were 6,670 ransomware incidents in 2023, with more than 2,800 incidents just in the United States.”

Ransomware Will Strike Every 2 Seconds By 2031

https://cybersecurityventures.com/ransomware-will-strike-every-2-seconds-by-2031/

“Cybersecurity Ventures predicts that by 2031, ransomware will cost victims $265 billion annually, and it will attack a business, consumer, or device every 2 seconds. Chief information security officers and cybersecurity teams are devoting more time than ever protecting against ransomware. Ransomware gangs are, in almost every case, financially motivated. These cybercriminals will stop at nothing to be paid — whether this means locking up your personal information or grinding the operations of a Fortune 500 company to a halt.”

The 2023 RTF Global Ransomware Incident Map

Institute for Security and Technology2023 RTF Global Ransomware Incident Map: Attacks Increase by 73%, Big Game Hunting Appears to Surge - Institute for Security and Technology

“The 2023 RTF Global Ransomware Incident Map presents the task force’s annual map of ransomware incidents and identifies ransomware trends worldwide. In 2023, the data showed 6,670 ransomware incidents, a 73% year-over-year increase from 2022. This increase is consistent with other recently published findings, which demonstrate an overall increase in ransomware activity and illicit cryptocurrency payments. For example, the FBI Internet Crime Center (IC3) reported over 2,825 complaints from the American public alone. According to Chainalysis, ransomware payments broke a new record, totaling over $1 billion in 2023.”

CB Take: Due to the substantial number of easy targets, ransomware will continue to be a devastating threat. A world that is becoming more hyper-connected affects every part of our lives. Maintaining and safeguarding data is an important security requirement for all businesses and organizations.  Knowledge of and skill with ransomware can assist in solving numerous safety issues. Cyber hygiene is particularly important as strong passwords, multifactor authentication, and phishing awareness training make a company less of a target. New cybersecurity technologies, tools, and standards can help slow down the staggering rise in ransomware attacks. Actively protecting systems, networks, and devices are essential to make them more resilient

While the healthcare, financial, and educational industries are always prime targets for breaches, no industry or sector is immune. One area to watch is the legal community as they possess valuable and confidential data of clients.

Over one million law firm passwords found on dark web

Over one million law firm passwords found on dark web - Legal Cheek

“New research has uncovered more than a million passwords linked to the IT systems of UK law firms on the dark web. Researchers found that nearly three-quarters (72.2%) of the 5,140 law firms audited had employee username and password combinations that appeared in lists circulating in the darkest corners of the internet. A total of 1,001,313 passwords were discovered, averaging 195 password combinations per firm or 1.27 per individual staff member. Atlas Cloud, the IT outfit that conducted the research, warns that cybercriminals could use this information to infiltrate a firm’s IT systems, potentially gaining access to valuable data or intercepting transactions.

Last autumn, before its merger with Shearman, Allen & Overy confirmed that it had “experienced a data incident affecting a small number of storage servers” after reportedly being targeted by a hacking group with ransomware. Similarly, in 2017, Legal Cheek reported that hackers had taken DLA Piper‘s computer systems and phones offline using malicious software.”

Outside Cybersecurity Subject Matter Expertise Needed!

Nearly 9 in 10 Companies Hiring Outside Cybersecurity Advisers

“87% of companies bring in outside cybersecurity advisers, 72% list cybersecurity as desired board skill

Companies are dramatically increasing their use of external cybersecurity advisers, with 87% now engaging outside experts compared to 43% in 2023, according to new research from EY’s Center for Board Matters. The surge comes as cyber threats grow more sophisticated, with FBI data showing a 10% increase in complaints and a 22% rise in losses to $12.5 billion annually.”

CB Take: Law firms should think about getting help from subject matter experts (SMEs) who know about the newest technologies and compliance/governance rules in the cyber ecosystem. This is because new threats and technology problems pose a higher risk to their clients' money and reputation. SMEs for the legal community are especially important because the cyber danger comes from both criminal organizations and countries that are at odds with each other. Because of a change in the cyber risk environment, more money is being spent on threat awareness and sharing information, which is important for businesses to stay open. SMEs are a particularly important part of figuring out the danger landscape and finding weaknesses.

According to Enoch Long, Field CISO for Jupiter One  “Cybersecurity SMEs can build a risk management cybersecurity strategy for law firms. The framework can also be utilized for compliance, (GDPR expertise), and other regulatory issues related to policy and industry specializations. An SME can help bolster the internal IT security team of a law firm, recommending potential technological solutions and protocols depending on budgets and needs. As the threats and cost of breaches continue to escalate in the legal profession landscape, getting outside help is a sensible option.

The Impact of Artificial Intelligence

This is a particularly frightening statistic, as identity fraud is now being significantly enabled by generative artificial intelligence tools:

Deepfake Fraud Doubles Down: 49% of Businesses Now Hit by Audio and Video Scams, Regula’s Survey Reveals

Deepfake Fraud Doubles Down: 49% of Businesses Now Hit by Audio and Video Scams, Regula’s Survey Reveals

“In 2024, every second business globally reported incidents of deepfake fraud, revealing a growing trend in AI-related crimes over the past two years. Meanwhile, fraud involving fake or modified documents now outpaces AI-generated scams. These are the first findings from a new survey* “The Deepfake Trends 2024” commissioned by Regula, a global developer of forensic devices and identity verification solutions.

Regula’s survey data shows a significant rise in the prevalence of video deepfakes, with a 20% increase in companies reporting incidents compared to 2022**. While 29% of fraud decision-makers across Australia, France, Germany, Mexico, Turkey, UAE, UK, and the USA reported encountering video deepfake fraud in 2022, this year’s data — covering the USA, UAE, Mexico, Singapore, and Germany — shows this figure has surged to 49%. This sharp increase across the revised cohort underscores the growing challenge of video deepfakes and their continued threat to businesses. Audio deepfakes are also on the rise, with a 12% increase compared to 2022 survey data.”

AI impersonation emerges as top cyber threat in new report

AI impersonation emerges as top cyber threat in new report

“New research from Teleport reveals that AI impersonation now ranks as the most challenging cyber-attack vector for security experts to defend against, as indicated by 52% of senior leaders surveyed. The 2024 State of Infrastructure Access Security Report issued by Teleport highlights the growing complexity of social engineering techniques, with AI and deepfakes substantially enhancing the effectiveness of phishing scams.

CB Take: Identity theft is a logical target of hackers using AI tools. We have been anticipating artificial intelligence's arrival and AI is becoming mainstream. Machine learning and natural language processing, which are already commonplace in our daily lives, contributed to the creation of AI. Criminal hackers are automating more of their phishing attacks with artificial intelligence and exponentially reaching many more businesses, agencies, and consumers. Generative AI makes it easy for anyone to become a hacker. Advances in technology have rendered phishing more accessible to cybercriminals. They have easy access to digital images for creating deep fake, and social engineering data to make it more viable. Hackers often combine spear-phishing, a technique they use to target executives at companies or organizations, with ransomware. Throughout its two-decade history, ransomware has grown in popularity because it makes it simpler for hackers to collect money via cryptocurrency.

Emerging Technologies Are Impacting Cybersecurity

Inside Cyber by Chuck Brooks: Reviewed - Irish Tech News

https://irishtechnews.ie/inside-cyber-by-chuck-brooks-reviewed/

“Inside Cyber, by Chuck Brooks, takes complex ideas about emerging technologies and provides a simplistic explanation of the technology. Brooks takes technology such as quantum computing, 5G, and Artificial Intelligence, and explains the positives and negatives of these new technologies.

We live in a world that seems like it is changing by the day. Keeping up with the times and understanding all of the innovative technology around us can seem like an impossible task, especially as it affects our daily lives. Just a few years ago, artificial intelligence was considered to exist only in sci-fi movies. Cellular speeds are coming close to rivaling Wi-Fi as global satellite communication nears. Countries are scrambling as they prepare for the looming threat of cyber-attacks aided by AI. These modern technologies will forever change the way the world operates. This book dives into what may seem like an existential threat, providing necessary steps to remain safe and secure.”

Generative AI in Security: Risks and Mitigation Strategies

Generative AI in Security: Risks and Mitigation Strategies

“Security teams must balance the risks and benefits of AI. Microsoft’s Siva Sundaramoorthy provides a blueprint for how common cyber precautions apply to generative AI deployed in and around security systems. Pain points security teams should be aware of around AI include:

·         The integration of new technology or design decisions introduces vulnerabilities.

·         Users must be trained to adapt to new AI capabilities.

·         Sensitive data access and processing with AI systems creates new risks.

·         Transparency and control must be established and maintained throughout the AI’s lifecycle.

·         The AI supply chain can introduce vulnerable or malicious code.

·         The absence of established compliance standards and the rapid evolution of best practices make it unclear how to secure AI effectively.

·         Leaders must establish a trusted pathway to generative AI-integrated applications from the top down.

·         AI introduces unique and poorly understood challenges, such as hallucinations.

·         The ROI of AI has not yet been proven in the real world.”

CB Take: We are currently in a disruptive era of technological advancement labeled The Fourth Industrial Era. It is characterized by exponential connectivity of people and devices and involves the meshing of physical, digital, and biological worlds. This includes a multitude of innovative technologies (among others) such as artificial intelligence (AI) & machine learning (ML), robotics, sensors, 5G nanotechnologies, biotech, blockchain, and quantum.

Artificial intelligence (AI) is one to watch as it is a highly intriguing subset of emerging technologies. Science fiction no longer exists in the realm of AI. These days, AI can comprehend, diagnose, and resolve issues from organized and unstructured data, sometimes even without special programming. Although AI can be a useful instrument for cyber defense, threat actors may also take advantage. Malicious hackers are using AI to find and exploit threat detection model weaknesses. Malicious malware can also be distributed using artificial intelligence and machine intelligence to automate target selection, inspect compromised environments before launching further assault stages, and prevent detection.

Quantum technology, especially quantum computing, has immense potential that could change many fields, such as communications, real-time data analytics, biotech, genetic sequencing, and materials science. With its effects on artificial intelligence and the Metaverse, quantum computing will also speed us into the future. But with the good, we need to plan for and stop the bad, especially when it comes to data, which is the lifeblood of industry and trade. Starting right now, it is important to go down a road toward quantum-proof cybersecurity. For more on emerging tech, please also check out my recent FORBES article Artificial Intelligence, Quantum Computing, and Space are 3 Tech areas to Watch in 2024

As an additional thought, avoid hackers' tricks by being cyber aware and practicing good cyber hygiene this Halloween and beyond. Be prepared and vigilant!

###

Keep Your Manufacturing Operations Safe with This Cybersecurity Checklist

From zero trust to security by design, this checklist will help you customize a strategy that fits your business.

by Chuck Brooks, President and Consultant, Brooks Consulting International

Keep Your Manufacturing Operations Safe with This Cybersecurity Checklist

See content credentials

The manufacturing sector is a prime target for hackers. These organizations tend to lack expertise and investment in cybersecurity, carry vulnerabilities in their supply chains, favor productivity over security, and maintain a low level of cyber preparedness compared to other industry sectors, making them not just a prime target but also ripe for breaching.

The data tells this story well–Statista found that in 2023 there were 259 cases of data compromise in the manufacturing and utilities industry in the United States and that the cases registered in 2022 impacted 23.9 million people. Furthermore, according to the World Economic Forum (WEF), cyber-attacks on the manufacturing industry accounted for 25.7% of all attacks, with ransomware involved in 71% of these incidents. As a result of attacks costing 125% more each year, cyber risk is now seen as the third biggest outside risk to manufacturers.

The WEF also noted that cyber-attacks on the industry were caused by long production cycles, the large amounts of investment capital needed to redesign production lines, and the lack of cyber-security resilience. The WEF provided an example of a hacker attacking a German battery company’s IT system in February 2024, which caused production to stop at five plants for more than two weeks.

Last year, manufacturing giant Clorox experienced a cyber-attack that ended up costing the company $356 million, in addition to a big drop in their stock price. Also last year, the manufacturing company Brunswick Corporation suffered a cyber-attack that disrupted operations for 9 days and cost the organization around $85 million. While Clorox and Brunswick are large companies, many smaller and medium-sized manufacturers experienced similar fates.

The rise in breaches is not surprising, given the pace of industrial digitization. Already, most physical security systems are linked to IT networks and changing cloud infrastructure and, as industrial hardware and software become more integrated and more IT sensors are connected to the internet, hackers are finding new ways to get into all kinds of digital systems.

A Manufacturing Cybersecurity Checklist

To protect themselves from this ever-expanding field of threats, manufacturers must adopt a robust cybersecurity plan that fits within their production and security environments. There are many approaches for a risk management framework and no one-size-fits-all solution, so this plan development takes some work.

To help, I have composed a checklist of major concerns and considerations to help you on your way:

• Identify, define, and monitor the company’s threat environment. Use an established manufacturing cybersecurity risk management framework that draws on industry experience and best practices, such as those provided by NIST
• Conduct a comprehensive Zero Trust vulnerability assessment of all devices (and people) connected to the network
• Evaluate and set policies with all connected to manufacturing supply chains
• Make sure security architectures (cloud, hybrid cloud, are fully updated and monitored)
• Update and patch vulnerabilities to both networks and devices
• Control and management of access and identity, including biometrics (Zero Trust goals). Use strong authentication and perhaps biometrics for access control and establish privileged access for device controls and applications
• Secure framework layers via firewalls, antivirus software, payload, network, and any endpoints
• Compartmentalize any connected IoT devices, and stored data on the network to minimize attack surfaces. Add security software, containers, and devices to “digitally fence” networks and devices. Consider network isolation to guard against insider threats, botnets, and malware
• Use the latest real-time horizon and threat scanning data or shared intelligence
• Use encryption (should be quantum resistant, or if possible, quantum-proof)
• Continually audit and use real-time analytics (including predictive analytics). Consider using AI/ML-enabled forensics (network traffic analysis, payload analysis, and endpoint behavior analysis), data analytics, and diagnostics
• Back up all sensitive data from potential breaches or ransomware attacks
• Develop an incident response and resilience plan that can be practiced and instituted
• Implement security awareness training for all employees

Note: NIST has more detailed technical frameworks available for companies in the sector to use, especially for supply chain security.

Zero Trust and Security By Design

The risk management checklist can operate under the security framework themes of both Zero Trust and Security by Design.

Trust frameworks and designs should be used by manufacturing companies to protect their gaps better. In a zero-trust architecture, everything in the network is seen as potentially hostile, so trust is not based on where the network is located, and devices, users, and apps trying to get into the network must be authenticated and given permission.

A Zero Trust model is based on achieving and maintaining the highest level of segmentation and fortification possible. This way, the chances of a breach happening are kept to a minimum, and the damage from a breach is kept to a minimum by stopping lateral movement and escalation.

To keep up with emerging cyberrisks, OT and IT networks need to be planned, updated, and made stronger. “Security By Design,” is a strategy that builds security up front in the planning. This approach for manufacturing can help create flexible systems with practical cyber-fusion to adapt to new threats. Security By Design can also find organizational and system dependencies early in the process to eliminate known risks. As new manufacturing plants expand, and or are created, it makes sense to replace legacy systems with new fortified Security By Design architectures.

About the Author

Chuck Brooks, President and Consultant, Brooks Consulting International

Chuck Brooks serves as President and Consultant of Brooks Consulting International. Chuck also serves as an Adjunct Professor at Georgetown University in the Cyber Risk Management Program, where he teaches graduate courses on risk management, homeland security, and cybersecurity. Chuck has received numerous global accolades for his work and promotion of cybersecurity. Recently, he was named the top cybersecurity expert to follow on social media, and also as one top cybersecurity leaders for 2024. He has also been named "Cybersecurity Person of the Year" by Cyber Express, Cybersecurity Marketer of the Year, and a "Top 5 Tech Person to Follow" by LinkedIn” where he has 120,000 followers on his profile. Chuck has keynoted dozens of global conferences and written over 350 articles relating to technologies and cybersecurity. As a thought leader, blogger, and event speaker, he has briefed the G20 on energy cybersecurity, The US Embassy to the Holy See and the Vatican on global cybersecurity cooperation. He has served on two National Academy of Science Advisory groups, including one on digitalizing the USAF, and another on securing BioTech. He has also addressed USTRANSCOM on cybersecurity and serves on an industry/government Working group for DHS CISA focused on security space systems. In his career, Chuck has received presidential appointments for executive service by two U.S. presidents and served as the first Director of Legislative Affairs at the DHS Science & Technology Directorate. He served a decade on the Hill for the late Senator Arlen Specter on Capitol Hill on tech and security issues. Chuck has also served in executive roles for companies such as General Dynamics, Rapiscan, and Xerox. Chuck has an MA from the University of Chicago, a BA from DePauw University, and a certificate in International Law from The Hague Academy of International Law.

###

Transformative Power: Artificial Intelligence Reshapes Global Society

By Chuck Brooks, Skytop Contributor

Transformative Power: Artificial Intelligence Reshapes Global Society — SKYTOP

The coming years will bring about a digital transformation or convergence that will significantly alter the way we communicate, work, and live. We are entering a new era of dynamic, networked technologies that combine engineering, computational algorithms, and culture on a global scale. Machine learning and artificial intelligence will play a crucial role in this transformation.

The digital ecosystem’s networked computer components, enabled by AI and machine learning, will create a plethora of new opportunities and significantly impact nearly all types of organizations. These combined AI and computer technology capabilities may open up new horizons in various fields, including big data, digital security, robotics, genetic engineering, augmented reality, and quantum computing.

What is Artificial Intelligence?

Gartner defines artificial intelligence as “technology that appears to emulate human performance typically by learning, coming to its conclusions, appearing to understand complex content, engaging in natural dialogs with people, enhancing human cognitive performance, or replacing people in the execution of non-routine tasks.”

With the intention of outpacing human speed and constraints, artificial intelligence (AI) systems simulate human characteristics and computational abilities in a computer. Machine learning and natural language processing—two technologies that are now extensively utilized in our daily lives—have helped develop artificial intelligence. With the help of organized and unstructured data, modern AI can comprehend, identify issues, and provide solutions—in certain cases even without the need for professional programming.

Artificial intelligence has the power to fundamentally alter both the economy and cognitive capacities. According to McKinsey & Company, automating knowledge work with intelligent software systems that can carry out knowledge work tasks from unstructured commands might have an economic impact of $5–$7 trillion by 2025. These technologies provide a plethora of fascinating opportunities. AI is “the most important technology that anybody on the planet is working on today,” according to Dave Choplin, chief envisioning officer of Microsoft UK, and research and development spending is a good indicator of future technical advancements. Financial giant Goldman Sachs estimates that by 2025, global investments in AI might total $200 billion.

Computers with artificial intelligence capabilities are made to automate tasks like learning, planning, problem-solving, and speech recognition. By leveraging data to prioritize and take action, these technologies can aid in more effective decision-making, particularly in larger networks with more users and elements. AI-enabled computers are now being developed for a number of fundamental tasks, such as speech recognition, learning and planning, and problem-solving. AI will affect a wide range of enterprises by 2023. According to Gartner, 40% of infrastructure and operations teams in large AI companies are proficient in creating algorithms that aid in problem-solving. AI-augmented automation is already being used by several businesses to increase efficiency.

AI in Medicine

Artificial intelligence is already transforming the healthcare industry by being used to discover novel drugs and evaluate mixtures of substances and procedures that will improve human health and combat illnesses and pandemics. AI was essential in helping medical professionals respond to the pandemic and in the development of the COVID-19 vaccines.

Predictive analytics is one of the most fascinating applications of AI in healthcare. By using past data on a patient’s ailments and treatments, predictive analytics makes predictions about their future depending on their current health or symptoms. This facilitates the decision-making process for medical professionals when treating individuals with chronic illnesses or recurrent medical conditions. For scientific and medical research, the computers developed by Google’s DeepMind AI division—which recently demonstrated the ability to predict millions of protein configurations—would be immensely beneficial.

AI will grow more skilled at diagnosing conditions, creating individualized treatment plans, and forecasting medical results as it develops. Medical professionals will be able to treat patients more expertly in the office, at charitable or religious institutions, and at home with this expertise at their disposal.

Interface Between Human and Computer

The human/computer interface is a fascinating field of AI research that has the potential to improve human memory and cognitive function. Significant scientific progress has already been made in the field of brain/computer connection. Brain mapping and neuromorphic chips are two examples of this. The development of assistive technology that uses implantable sensors to recognize electrical impulses from the brain and use those signals to power external devices has led to the creation of brain-computer interfaces.

It has even been demonstrated that a brain-computer interface is capable of reading thoughts. To detect electrical activity, an electrode plate known as an ECOG is placed in direct contact with the surface of the brain. Professor Brian Brown of the Icahn School of Medicine at Mount Sinai asserts that patients who received electroconvulsive treatment (ECOG) and were rendered immobile are now able to interact with others through text translation of their ideas.

The promise of human-computer interfaces was summed up in a Frontiers in Science publication that brought together scientists, academics, and organizations. A human brain-machine interface system powered by neural nanorobotics has the potential to significantly improve human intellect and learning capacities, enabling people to conclude that “We can imagine the possibilities of what may come next with the human brain-machine interface.” It may also set new standards for immersive virtual and augmented reality, enabling users to express themselves more fully and richly and to have more profound experiences. All of this is made possible by the instantaneous access to all of the human information stored in the cloud. These developments may help mankind adapt to new difficulties facing the species since they make it possible to leverage evolving artificial intelligence systems as human-augmentation technologies.

Neuromorphic computing is a technique that uses artificial intelligence to facilitate human/computer contact; it may help improve human brain functions, memories, and skills. At a seminar on the future of the globe in 2045, Google futurist Ray Kurzweil declared that processing power will, on average, quadruple every two years and that humans will “expand the scope of our intelligence a billion-fold.”

Connections and the Client’s Experience

AI is also changing the ways that people communicate in our culture. Businesses are already using robotic processing automation (RPA), a type of artificial intelligence, to cut down on manual labor and assist in getting rid of human error for routine tasks. By employing technology to manage monotonous, repetitive tasks, RPA improves service operations by freeing up human expertise for more complicated, higher-level problems. It is scalable and can be modified to satisfy performance requirements. In the private sector, RPA is widely utilized for many different purposes, such as contact centers, medical coding, insurance enrollment and invoicing, and claims processing.

Chatbots, voice assistants, and other messaging apps that leverage conversational AI to fully automate customer support and provide round-the-clock assistance can be advantageous for a variety of sectors.

###

Future Medicine: Physics, Biology, And AI Will Transform Human Health

Co-written by Chuck Brooks and Dr. Thomas A. Cellucci, MBA

Future Medicine: Physics, Biology, And AI Will Transform Human Health

Verticals that will be most impacted by innovative developments in technology and science are the disciplines of medicine, biotechnology, and health. Those industry verticals will see a profound growth of technological innovation in the near future.

Twenty years ago, Craig Venter and Daniel Cohen remarked, “If the 20th century was the century of physics, the 21st century will be the century of biology.” Since then, there have been some amazing advances in the fields of biotechnology and bioscience, with the promise of even more astounding breakthroughs to come. Over the past decade, we have seen significant strides in artificial intelligence, with radical long-term implications for every human endeavor. And now the convergence of the fields of physics, biology, and AI promises a far greater impact on humanity than any one of these fields alone. Even though a path to successfully integrating these fields exists, it is neither easy nor clear cut—but if done correctly, will revolutionize medicine and human health.

The Human Genome Project was just the beginning of the journey to find treatments for human diseases. Our genes are merely a codebook for making different proteins. These proteins are the fundamental building blocks for our cell structures and are responsible for their core functions. Understanding the biological processes behind a disease means identifying the specific protein or proteins whose undesirable effects in the body cause that disease. To treat the disease, a therapeutic agent is needed. This is usually given as a pill or an injection and contains active drug molecules that bind to copies of a disease-associated protein and change how they work.

4 key steps associated with finding treatments for human disease are as follows:

1) Figure out which proteins are implicated in the disease

2) Ensure that we can produce those proteins in a form conducive to testing and determine their structures either experimentally or through computer models

3) Find binders to those proteins (these binders are the drug candidates, and this step is the most important)

4) Test those binders first in vitro, then advance the most promising ones to animal tests, and finally select the best ones for clinical trials in humans

Step 1: Identifying Target Proteins

Top of Form

Bottom of Form

There has been tremendous amount of work in labs worldwide over the last three decades to identify the proteins implicated in various diseases. This work will continue into the near future, and AI-driven knowledge graphs can complement and speed up the work of biologists.

To map and characterize all the proteins encoded and produced by the human genome, scientists have embarked on the Human Proteome Project (HPP). So far, HPP has characterized 18,397 out of the estimated 19,778 proteins that make up the human body.[1] However, it is estimated that only 10,248 play roles in human disease.[2] This subset of proteins is what scientists call the “druggable” proteome.

Step 2: Isolating Target Proteins & Determining Their Structure

To verify whether a drug candidate works, it must be tested against a target protein implicated in a disease. Isolating target proteins is important to ensure target proteins are available for testing against drug candidates and for determining their three-dimensional structures. Some proteins are easy to isolate and purify; others can only be produced in conjunction with their associated cellular machinery. Scientists have made tremendous strides in determining the three-dimensional structures of these target proteins through x-ray crystallography and NMR. These structures are freely available for all to use in databases such as the Protein Data Bank (PDB). Now, AI is helping figure out the structures of those proteins for which we have not yet experimentally validated structures.

Step 3: Finding Drug Candidates

The Most Crucial Step

Once the target protein is properly characterized, then begins the truly daunting challenge of searching for drug-like molecules that bind to the protein and effectively intervene in the disease process. All of the work in steps 1 and 2 is for naught if we cannot find drug candidates that bind to the target proteins. So-called small-molecule drugs are the mainstay of modern medicine. Most pharmaceuticals are small molecules. Not only can these low-molecular-weight organic molecules bind to disease-associated proteins outside of cells, but they can also pass through cell membranes to bind to target proteins inside cells. Typically administered orally as shelf-stable drugs, small-molecule pharmaceuticals can be also manufactured and distributed efficiently.

A Challenging Process

The process of finding small-molecule drug candidates primarily relies on trial and error. The isolated and purified protein is tested against a collection of previously synthesized compounds stored in the lab to check for signs of a chemical reaction in the hope of finding a binder. But there is a fundamentally crippling limitation to this approach. Over the past 150 years, humanity has made fewer than 10 million distinct drug-like small-molecule structures, or chemotypes. Yet estimates of the total number of unique drug-like small-molecule chemotypes possible under the rules of chemistry range from a decillion (that is, 1033, or a one followed by 33 zeroes) to a novemdecillion (1060, or a one followed by 60 zeroes).

Drug-Like Molecules

Even if it were possible to magically accelerate the creation of brand-new chemical structures to one per second, it would take more than three septillion (that is, three plus 25 zeros) years to create a decillion chemotypes. That is well over two trillion times the currently estimated age of the universe! In other words, figuring out which small molecules would make viable drugs through brute-force synthesis and testing is an utterly impossible task.

Some companies have turned to AI as a substitute for trial-and-error experimentation. But can AI really help in the field of small-molecule drug discovery? AI only produces solutions similar to the ones for which it has seen examples in the data used to train it. Expecting AI to find drug candidates for which there is no pre-existing data is even more unreasonable than expecting Chat GPT trained exclusively on massive amounts of English webpage text to suddenly construct sentences in perfect Russian. AI will find drug-like molecules similar to the fewer than 10 million chemotypes for which experimental data already exists, but it cannot explore the other decillion+ possibilities. AI trained on existing data cannot unlock the secrets of a decillion unexamined compounds.

What if pharmaceutical companies could design never-before-made molecules on the computer and figure out if they will bind to a target protein without having to actually make the molecule, isolate the protein, and run experiments? We already rely on such technologies every day in other areas. For example, no one erects reduced-scale models of buildings or bridges to see if they will stand before actually constructing them.

But modeling the quantum physics of how a drug molecule binds to a protein in water is a forbiddingly complex challenge. Attempting to model the interaction between a protein with thousands of atoms and a drug-like molecule with hundreds of atoms quickly becomes intractable, exceeding the computing power of even the most advanced computing clouds. To tackle this extreme level of complexity, most simulation-based drug discovery technology companies found that drastic compromises were necessary. These compromises involved crude approximations of physics and computational short cuts. And invariably, these compromises led to gross inaccuracies when modeling molecular interactions.

Are both AI-based and physics-based approaches dead ends? Not quite. Various companies are still trying both approaches. However, reaching sufficient accuracy requires significant fundamental advances in modeling the physics of protein-drug interactions. Pfizer’s former Senior VP of R&D Strategy, Robert Karr, points out that one company, Verseon, has built a seamless platform incorporating propriety advances in physics and AI. In his words, “Verseon's disruptive platform changes how drugs can be discovered and developed, and the company is poised to make a dramatic impact on modern medicine.” After examining the company’s drug-discovery platform, Nobel Laureate Hartmut Michel said, “The fundamental advancements Verseon has made in quantum mechanical modeling of protein-drug interactions are extremely impressive.”

Verseon has built technology to design never-before-made novel drug molecules on the computer. The company’s advances in quantum-physics modeling, which it calls Deep Quantum Modeling™ (DQM™), are sufficiently accurate to determine whether its computationally designed new drug-like molecules will bind to a target protein before making and testing them in the lab. And AI trained on data from these new molecules identified by DQM will help generate more variants from which to pick the best ones for clinical trials.

Step 4: In Vitro, Preclinical, and Clinical Testing

All new drug candidates must still be taken through preclinical and clinical trials to fully establish their safety and effectiveness. This process typically takes years to complete, and process improvements that speed promising new treatments to market would be a welcome boon. AI can help with regulatory documentation. Weave is one example of a company selling solutions that utilize AI to streamline the process of preparing Investigational New Drug regulatory filings (INDs). Preparing INDs is one area that could benefit from automation. The company touts its ability to create INDs faster without sacrificing quality and offers greater control over data organization for IND filings.

Human organoid-based testing during the preclinical process is an emerging technique that can dramatically improve the characterization of how a drug will behave in clinical trials. Organoids are miniature versions of organs in the human body that are generated using adult stem cells. After taking samples from patients and trial volunteers, these lab-grown replicas mimic the function of various organs. Testing drug candidates on organoids can give a lot of clues into how the human body would react to a drug candidate before human trials.

Regulators like the US FDA are tasked with weeding out unsafe and ineffective drug candidates that enter trial pipelines. But it is a process that takes years once drug candidates enter the clinic. The long wait for approval frustrates both companies eager to enter the market with innovative products and patients desperate for a solution to a serious medical condition. The need to accelerate the process is not lost on regulators. The US FDA has set up processes such as Fast Track and Breakthrough Therapy designations to accelerate the clinical trial process for novel drugs that show uniquely desirable therapeutic properties.

The Implications of Using Advances in Physics, Biology, and AI to Their Full Potential

Assuming the pharmaceutical development ecosystem takes full advantage and coordinates the use of advances like those described above, what could medicine achieve?

Adityo Prakash and Tom Cellucci point out some of the implications in their recent article appearing in Homeland Security Today. They approach the subject from the perspective of both industry and national security. Adityo Prakash is the CEO of Verseon. He confounded Verseon to change how the world finds new medicines. Tom Cellucci drove America’s nanotechnology agenda under presidents Clinton and George W. Bush, and he served as the US Federal Government's first-ever Chief Commercialization Officer at the US Department of Homeland Security (DHS) under both the Bush and Obama administrations. Prakash and Cellucci point out that current medicine has so far only uncovered drug candidates that bind 670 of the druggable proteins in the human body. They contend that better methods for finding drug candidates and streamlining required testing will accelerate the march toward being able to address all 10,248 druggable proteins. Once this goal is reached, medicine will be able to intervene with exquisite precision in disease processes that inexorably progress over the human lifespan. Being able to precisely control the entire druggable set of proteins in the human body will also facilitate agile therapeutic development as a first line of defense against new infectious agents that try to enter our cells.

Emerging medical and life science technologies are helping contribute to an inward evolution. Scientists are learning from the exponentially growing data on our health and disease states using data analytics and AI-driven insights generated from such data. They are developing a deeper understanding of the concert of proteins involved in the progression of disease and the best pathways for both treatment and prevention.

Given that most major diseases are associated with aging, regulating the functions of proteins in our bodies will allow medicine to preserve a youthful and disease-free state far longer than is possible today—and eventually even to partially rejuvenate our bodies from the cellular level. These advances may make it possible to turn 80, 90, or even 100 into the new 50. But even before such dramatic increases in human health span happen, progress toward addressing large subsets of the druggable proteome will deliver a steady flow of amazing new drugs. These drugs will treat a great many diseases far better than we can today. Then the 21st century will indeed establish itself as the century of biology.

New Book "Inside Cyber"; a primer/resource for those interested in the impact of emerging tech on security and privacy in our new digital era

(4) New Book "Inside Cyber"; a primer/resource for those interested in the impact of emerging tech on security and privacy in our new digital era | LinkedIn

Dear Friends and Colleagues, today Ia m celebrating the release of my new book with the promo assistance of my American Eskimo dog. I wrote it to be a primer for those with a layperson background on cybersecurity. It also has some good reference value and insights for those who are more deeply involved with cybersecurity and tech such as artificial intelligence, quantum computing, 5G, and IoT. Most of all, it is a book about risk management for our new digital era. I hope you will read it and share feedback! Thanks, and stay safe! Chuck

"Just in time for Cybersecurity Awareness Month, Chuck Brooks announces his new book, Inside Cyber: How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security. The book teaches readers how to navigate the intersection of tech, cybersecurity, and commerce.

"The near future that awaits can be characterized as an era of exponential technological change. It is being catalyzed by enhanced information sharing and the merging of physical and digital systems. The disruptive technological change will impact industries including health and medical care, transportation, energy, construction, finance, commerce, and security. Along with industry, the government is acclimating to the new emerging enterprise technology ecosystem and pursuing programmatic innovation. We are in a state of cyber-flux. Many companies and institutions are moving from legacy systems to cloud, hybrid cloud, and edge platforms to consolidate and secure data. Emerging technologies such as artificial intelligence, quantum computing, and 5G are creating operational shifts that require new cybersecurity strategies and requirements," says Chuck Brooks. New book tackles the impact of emerging technologies on privacy and cybersecurity | Security Info Watch

Chuck Brooks Debuts Book on Privacy & Cyber Impacts of Emerging Tech

by Charles Lyons-Burt

Cybersecurity, News ,Technology

Chuck Brooks Debuts Book on Privacy & Cyber Impacts of Emerging Tech - GovCon Wire

“Inside Cyber: How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security” by Chuck Brooks is a must-read for anyone who wants to understand and take advantage of the next wave of technological progress. Brooks is a well-known executive and adviser who breaks down complicated technological trends into easy-to-understand insights. He does this by providing a deep look at how modern technologies will change business and society in the future—just in time for Cybersecurity Awareness Month.

Brooks is one ofExecutive Mosaic’s esteemed GovCon Experts, an adjunct professor at Georgetown University, a widely recognized thought leader and a subject matter expert for the Cybersecurity and Infrastructure Security Agency’s Space Systems Critical Infrastructure Working Group. We sat down with Brooks ahead of “Inside Cyber’s” Oct. 15 publication to talk about the impetus behind it and why you should check it out. (“Inside Cyber” is available on Amazon now.)

GovConWire: What was the genesis for “Inside Cyber”?

Chuck Brooks: There were several impetuses. I travel and speak globally at conferences. For the past year, artificial intelligence has permeated almost every discussion at events. It is an early topic of the day. Another factor is my course at Georgetown University in the graduate cybersecurity risk management program. Over five years ago I designed a course called “Disruptive Technologies and Organizational Management.” This past year I reviewed the syllabus and had to completely redo the content as the rate of change in technology and in cybersecurity has become almost exponential. My third reason is that I have come to realize that to adapt to the new challenges facing business and security for both security and privacy, there needs to be a resource people can go to explain things in understandable terms. Hence my book!

GCW: What will readers learn as they read your book?

Brooks: They will get clear, easy-to-understand accounts of cutting-edge technologies like AI, blockchain, quantum computing, 5G and Internet of Things, as well as information on how these technologies will impact business operations, efficiency, and security. The reader will discover the ways that fast technological progress can change traditional industries and create new value by learning how to handle the cybersecurity landscape and protect their businesses and personal digital lives against the threats that come with it. I also include a comprehensive risk management strategy for managing cybersecurity risks in the ‘4th Industrial Era.’

People who work in government contracting can also use my book as a guide to make the most of the recent technologies that are changing the sector. I highlighted some of these technologies in a GovCon Expert article. The topics I highlighted in the article included AI, machine learning, cybersecurity, digital transformation, 5G, IoT, quantum and high-performance computing, cloud and edge computing, augmented reality, big data, virtualization, smart cities, wearables, 3D printing and materials science.

GCW: What is your general perspective in the near future for emerging tech and cybersecurity?

Brooks: Rapid technological progress is what the near future holds. Sharing information more easily and combining physical and digital methods are both helping to speed it up. Health and medical care, transportation, energy, building, finance, commerce, and security are just some of the fields that will be affected by the disruptive technological change. Getting used to the new workplace technology ecosystem is something that both businesses and the government are doing. It is like cyber-flux right now. For better data security and to move away from old systems, many businesses and organizations are switching to cloud, hybrid cloud and edge platforms. As innovative technologies like AI, quantum computing and 5G come out, they change how things work, which means that new safety approaches and rules are needed.

GCW: Thank you! Where can readers obtain your book?

Brooks: Readers can order the book from Amazon now. It will be available at Barnes & Noble, Target and other bookstores starting on Oct. 15.

Georgetown Professor Chuck Brooks is the Author of New Book “Inside Cyber How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security”

Georgetown Professor Chuck Brooks is the Author of New Book “Inside Cyber How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security” - HS Today

By Homeland Security Today

Discover how to navigate the intersection of tech, cybersecurity, and commerce.

In an era where technological innovation evolves at an exponential rate, Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security by Chuck Brooks emerges as a critical roadmap for understanding and leveraging the next wave of tech advancements. Brooks, a renowned executive and consultant, breaks down complex technological trends into digestible insights, offering a deep dive into how emerging technologies will shape the future of industry and society.

In the book, you’ll:

Gain clear, accessible explanations of cutting-edge technologies such as AI, blockchain, and quantum computing, and their impact on the business world

Learn how to navigate the cybersecurity landscape, safeguarding your business against the vulnerabilities introduced by rapid technological progress

Uncover the opportunities that technological advancements present for disrupting traditional industries and creating new value

Perfect for entrepreneurs, executives, technology professionals, and anyone interested in the intersection of tech and business, Inside Cyber equips you with the knowledge to lead in the digital age. Embrace the future confidently with this indispensable guide

How to Order:

Book link to order on Amazon: https://a.co/d/cAqjml1

The author is available for media interviews and be contacted at: cb1519@georgetown.edu

 

 

 

- By Chuck Brooks (President, Brooks Consulting International)

Original link of post is here

Dear Friends & Colleagues, October is Cybersecurity Awareness Month. Actually, cybersecurity awareness really needs to be every month! Below is some content for the quest. Also, happy to announce that my book "Inside Cyber" will be arriving at bookstores on October 15. You can also get a copy from the Amazon or Barnes & Noble websites. Thanks, and stay safe! Best, Chuck

Make a Commitment To Be More Cyber-Secure for Cybersecurity Awareness Month

by Chuck Brooks

Commit To Be More Cyber-Secure For Cybersecurity Awareness Month (forbes.com)

Cybersecurity Awareness Month is approaching. Any businesses and organizations, no matter how big or small, can be hacked in today's digital world. That is a fact of our digital lives. However, not enough companies or people prepare to avoid a breach that could significantly impact their operations, brand, reputation, and income streams.

Cyberattacks on all companies, especially small and medium-sized ones, are happening more often, more precisely, and with more complicated methods. An Accenture Cost of Cybercrime Study released not long ago found that 43% of cyberattacks target small companies, but only 14% are ready to defend themselves.

And criminal hackers are doing it more often as internet connectivity grows. They are using machine learning to find holes in the defenses of their targets and to automate their attacks. Enabled by emerging technologies, hackers now operate faster, smarter, and more deadly strikes. They also share tools that are available on the Dark Web as part of their operational strategy. Threat actors include country states, criminal groups, and hacktivists, among others.

It is not always necessary for hackers to use the newest and most advanced software to be successful. Criminal hackers can do it easily. When it comes to online frauds, they usually look for the most vulnerable target at the best time.  A very tough problem is keeping up with the growing complexity of socially engineered threats, especially deep fakes, by threat actors.

Cybersecurity knowledge leads to good risk management

Even though everyone is open to cyberattacks, there are ways to help reduce the danger. Starting with a plan for managing risks and being vigilant is the first step. A comprehensive risk management strategy should also include data privacy, application security,  cyber vulnerability risk assessments, network access configuration, cyber hygiene best practices, use policies and permissions, and education and training,

. That includes people, methods, and tools. Cyber-awareness in simple terms means being alert, finding gaps, evaluating weaknesses, and having plans in place to protect yourself or company.

In today's increasingly unstable digital cyber risk environment, a security plan for managing risk needs to be both all-encompassing and flexible from dangers.

For businesses and groups to be successful, they need to know how to handle risks and understand the distinct types of threats and people who pose those threats. Their information should also include the National Institute of Standards and Technology (NIST) Framework's guiding principle: identify, protect, detect, respond, and recover.

Simple steps can be taken to make cyber-defenses stronger and raise awareness. These include updating and patching vulnerable software must be done regularly. Many businesses and groups are annoyingly slow or even careless when it comes to installing patches that would stop breaches. Given the large amount of malware that is out there and the growing number of attack surfaces, fixing has become particularly important. System and app updates are unnecessary and can be avoided at all costs.

The Importance of Cyber-Hygiene

Being cyber-aware really starts with practicing good cyber-hygiene. Do not click on the Phish! Criminal hackers prefer phishing because it is easy to do and works most of the time. The best advice is to not click on files you do not know anything about. You should pay close attention to website URLs to make sure they are real and not fakes, because hackers use automated phishing tools and good graphics that can look exactly like banks and company logos. Be especially careful of junk that contains fake job offers, bills for things you did not buy, and messages from your company that do not seem to belong. Additionally, it is recommended that you always make sure that email senders are who they say they are and be careful when opening any files.

Additionally, good online hygiene includes using strong passwords and multi-factor authentication that are hard to circumvent through social engineering. In addition, using multiple forms of authentication is a smart move that can help stop attempts that are not as technically advanced.

Training workers to spot malware and phishing attacks is important in today's business world.Good cyber hygiene means string identity access management policies. An administrator should monitor access to sensitive data, and limit information to which they can be accessed only by given permissions.

Any business and individual should also be cognizant of the growing impact of emerging technologies on the digital ecosystem.Artificial intelligence (AI), machine learning, the Internet of Things (IoT), 5G, virtual and augmented reality, and quantum computing are all part of the present cyber-threat and defense scenarios.

AI in particular can enhance the automation tool chest via horizon scanning technologies, analytics, audits, incident alert tools, diagnostics, and even self-repairing software. Real-time analysis and threat identification have now been made possible by AI and ML algorithms. Businesses will increasingly be able to keep an eye on what is happening within their system and identify any unusual behavior. At the same time, they need to be ready to defend against criminal hacker’s adversarial use of AI  to facilitate phishing, discover gaps on networks, and expand polymorphic malware attacks. (please see my new book, Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security Amazon.com: Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security: 9781394254941: Brooks, Chuck: Books

Being resilient requires a plan.Have an incident reaction plan ready in case you are the victim of a breach. That plan should also include the possibility of calling the police to help get the files back and find out who is stealing them.

Protect your devices with anti-malware and anti-ransomware platforms and technologies, like firewalls and email filters, for both businesses and people. Software tools that can find strange things, analyze user behavior, and help stop threats are being made possible by innovative technologies like machine learning (ML) and artificial intelligence (AI). Computers can also use machine learning and artificial intelligence to make their systems safer.

Everyone who uses the internet, including businesses and regular people, should remember to back up any important or private files. Using the right backup methods does not take much time or money, and they can protect your business in case of a breach. The files should also be encrypted in case there is a leak.

Management Security Services (MSS) and Managed Service Providers (MSP) are practical choices for small and medium-sized businesses that do not have enough resources to handle security issues on their own. Monitoring networks, providing necessary cybersecurity tools, and threat assessments are all things that many companies can do. Businesses and industries that do not have (or cannot afford) the internal subject matter knowledge or capabilities to handle increasingly complex breaches can save money by using MSS.

One last thing that needs to be done for risk management is sharing information about threats, especially through public/private cooperation. Sadly, many small and medium-sized businesses do not have the tools and knowledge to deal with the growing number of cyber-threats. In a harsher reality, many underserved communities and small companies do not even know what cyber-threats they face. This kind of sharing will help people who did not know about the latest bugs, malware, phishing attacks, and ransomware stay safe. Governments could also suggest or share cyber defense tools in addition to data to make shields stronger.

Supporting cybersecurity knowledge through Cybersecurity Awareness Month is especially important, but it cannot just happen once a year; it has to be an ongoing effort. Consistent efforts to raise knowledge about cybersecurity are important. Improving cooperation between the government and businesses is the smartest way to help reduce online threats by teaching people who do not know about them.

My New Book!

Available on Amazon at: Amazon.com: Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security: 9781394254941: Brooks, Chuck: Books and at bookstores after October 15

Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security 1st Edition

Discover how to navigate the intersection of tech, cybersecurity, and commerce

In an era where technological innovation evolves at an exponential rate, Inside Cyber: How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security by Chuck Brooks emerges as a critical roadmap for understanding and leveraging the next wave of tech advancements. Brooks, a renowned executive and consultant, breaks down complex technological trends into digestible insights, offering a deep dive into how emerging technologies will shape the future of industry and society.

In the book, you'll:

• Gain clear, accessible explanations of cutting-edge technologies such as AI, blockchain, and quantum computing, and their impact on the business world
• Learn how to navigate the cybersecurity landscape, safeguarding your business against the vulnerabilities introduced by rapid technological progress
• Uncover the opportunities that technological advancements present for disrupting traditional industries and creating new value

Perfect for entrepreneurs, executives, technology professionals, and anyone interested in the intersection of tech and business, Inside Cyber equips you with the knowledge to lead in the digital age. Embrace the future confidently with this indispensable guide.

From Bored Panda

by Chuck Brooks

45 Scammers Who Got ‘Destroyed’ By The People They Were Trying To Rip Off (New Pics) | Bored Panda

There are many scams, but social media and artificial intelligence has exacerbated the scourge of spoofing. Spoofing is when someone says they are you to get private data, accounts, or information. Most of the time, it's done through a phishing email or text message that looks like it came from a trusted source, like Amazon, Microsoft, your bank, or even your place of work.  It's often called "spear phishing" when it's aimed at business leaders. Ominously, ransomware is often downloaded when people fall for a fake. Then the demands come to the victim for payment, often in crypto currencies or prepaid charge cards.

In the past, it was easy to spot spoofs because they often had misspelled words, bad images, and claims that didn't make sense. That's no longer the case thanks to technology and threat players who are smart enough to fool almost anyone. People can spoof emails, websites, texts, and even IP addresses by making fake ones. And worse, generative AI can create deep fakes in video and audio that seem authentic.

Always being on the lookout is the best way to stop and spot spoofs. Make sure it's really the writer before clicking on any links in emails or on websites. In addition, you should get anti-virus and spoof detection software, and you might want to use packet blocking software, which is sold by many companies. Always encrypt your most important and private data, that way if someone steals your identity, the data won't be easy to move.

The goals of spoofing is to exfiltrate data, extort ransoms, or steal Identities.  Identity theft is the fraudulent acquisition and use of a person's private identifying information, usually for financial gain and it is a growing global problem..

The reason for the increased rate of identity fraud is clear. As we become more and more connected, the more visible and vulnerable we become to those who want to hack our accounts and steal our identities. The surface threat landscape has expanded exponentially with smartphones, wearables, and the Internet of Things so there are plenty of targets to phish.

Criminal hacking gangs and fraudsters often use social media to help engineer their phishing and malware attacks. They can garner a great deal of information such as birthdates and personal histories on social media posts to tailor their attacks With the development of machine learning algorithms and artificial intelligence, social engineering attacks have become much more sophisticated as they can more easily seek out vulnerabilities and automate phishing and ransomware attacks on a grand scale.  And when they succeed in stealing identities, the hackers often share them or sell them on the dark web to other criminals.

Below are five suggested actions that I recommend companies and people take to hep ameliorate identity theft:

1) Use multifactor authentication. This is an integral step in preventing identity theft because raises the bar toward stealing your password by requiring two or three steps to access data. Also, you can use biometrics such as facial recognition, an eye scan, or a thumb print to add an additional level of security.

2) Hackers are quite adept at guessing passwords especially when they have insights into where you lived in the past (street names), birthdays and favorite phrases via social engineering on social media. Use strong passwords and change them regularly can also complicate hacker tasks. Also consider a password manager if you use a variety of sites.

3) Maintain a separate computer to do your financial transactions and use it for nothing else. Also, consider using encryption software for valuable data that needs to be secured.

4) It is also prudent to monitor your credit scores, your bank statements, and your social accounts on a regular basis. There are several reputable monitoring organizations that provide account alerts that are very helpful in that awareness quest. The quicker you detect fraud the easier it is to handle the issues associated with identity theft.

5) Finally, if you get breached, have a plan in place to reach out immediately to your key vendors and connections.  If the breach is especially serious, do contact law enforcement authorities as it might be part of a larger criminal enterprise that they should know about.

Theft and use of someone else's private information without their permission, usually to make money, is called identity theft. Identity theft is on the rise, and it's easy to see why. Criminals who want to hack our accounts and steal our identities can see us and find us easier as we become more linked. Smartphones, wearable tech, and the Internet of Things have vastly increased the number of public threats. This means that there are many more people to phish.

Social media is often used by hacking groups and scammers to plan their phishing and malware attacks. On social media posts, they can find out a lot about people, like their birthdates and personal lives, which helps them target specific people. More advanced social engineering attacks are now possible thanks to machine learning algorithms and artificial intelligence. These technologies make it easier to find weaknesses and run large-scale phishing and ransomware attacks automatically. Once hackers get their hands on     someone's identity, they often give it to other crooks or sell it on the dark web.

What I think companies and people should do to help stop identity theft are the following five things:

2) Use more than one way to prove who you are. By making it take two or three steps to get to your data, this is an important step in avoiding identity theft because it makes it harder for someone to steal your password. Besides that, you can add an extra layer of protection with biometrics like a fingerprint, an eye scan, or facial recognition. 2) Hackers can easily figure out passwords if they know things like the street names where you used to live, your birthday from social engineering on social media. Make it harder for hackers by using strong passwords and changing them often. 3) Keep a different computer that you only use for paying bills and conduction financial activities.  And if you need to protect important info, you might want to use encryption software.

4) It's also a good idea to keep an eye on your credit reports, bank statements, and social media accounts on a daily basis. You can get account alerts from a number of trustworthy tracking services, which can help you raise awareness. An easier way to deal with identity theft problems is to catch scams as soon as possible. If your security is broken, you should have a plan for how to contact your important suppliers and contacts right away.

Chuck serves as President and Consultant of Brooks Consulting International with over 25 years of experience in cybersecurity, emerging technologies, marketing, business development, and government relations. He helps Fortune 1000 clients, organizations, small businesses, and start-ups achieve their strategic goals and grow their market share.

Chuck also serves as an Adjunct Professor at Georgetown University in the Cyber Risk Management Program, where he teaches graduate courses on risk management, homeland security, and cybersecurity. He designed the course that he teaches called “Disruptive Technology and Organizational Management” which is a course quite popular with students.

Chuck Brooks has received numerous global accolades for his work and promotion of cybersecurity.  Recently, he was named the top cybersecurity expert to follow on social media, and also as one top cybersecurity leaders for 2024 along with a very select group of industry and government colleagues. He has also been named "Cybersecurity Person of the Year" by Cyber Express, Cybersecurity Marketer of the Year, and a "Top 5 Tech Person to Follow" by LinkedIn” where he has 116,000 followers on his profile. He has 57,000 subscribers to his newsletter "Security and Tech Insights."

As a thought leader, blogger, and event speaker, he has briefed the G20 on energy cybersecurity, The US Embassy to the Holy See and the Vatican on global cybersecurity cooperation. He has served on two National Academy of Science Advisory groups, including one on digitalizing the USAF, and another on securing BioTech.  He has also addressed USTRANSCOM on cybersecurity and serves on an industry/government Working group for DHS CISA focused on security space systems.

Chuck is also a contributor to Forbes, The Washington Post, Dark Reading, Homeland Security Today, Skytop Media, GovCon, Barrons, The Hill, and Federal Times on cybersecurity and emerging technology topics. He has been a leading voice in risk management keynoting dozens of conferences and writing over 350 articles relating to technologies and cybersecurity.

In his career, Chuck has received presidential appointments for executive service by two U.S. presidents and served as the first Director of Legislative Affairs at the DHS Science & Technology Directorate. He has also served in executive roles for companies such as General Dynamics, Rapiscan, and Xerox.

Chuck has an MA from the University of Chicago, a BA from DePauw University, and a certificate in International Law from The Hague Academy of International Law.

GovCon Expert Chuck Brooks Praises DHS Tribal Cybersecurity Grant Program - GovCon Wire

Earlier this Summer, the Department of Homeland Security (DHS), through the Federal Emergency Management Agency (FEMA) and the Cybersecurity and Infrastructure Security Agency (CISA), announced more than $18.2 million in Tribal Cybersecurity Grant Program (TCGP) awards to assist Tribal Nations with managing and reducing systemic cyber risk and threats.

This action was long overdue as Native Americans have been at the forefront in contributions to US national security. Native Americans have served in the U.S. military in every major conflict for 200 years, and at times at a higher rate than any other demographic. This is proportionally more than any other ethnic group and is the highest number of soldiers per person defending the homeland.

“Native Americans have not received enough public recognition for their support of national and homeland security .They have served in every major military conflict since the Revolutionary War. “ In the 20th century, more than 12,000 Native Americans served in World War I, and 10,000 Native women joined the Red Cross.  During World War II, over 44,000 Native Americans – American Indians served, including 800 women.”Understanding America: The Legacy of Native American Military Service - United States Department of State

Today, there are more than 24,000 American Indian and Alaskan Native men and women on active duty, and more than 183,000 veterans identify as American Indian or Alaska Native. Twenty-nine service members of Native American heritage have been awarded the Medal of Honor for valor.

In 2016, I authored an article of Indian Country News, and Homeland Security Today in it I stated that  “the majority of people who live on tribal land are not getting the education and training they need to take advantage of chances in the new digital economy. Numerous factors have led to a lot of young Native Americans living in poverty and with little chance of improving their financial situation. The situation could be improved by investing in and training staff that could provide jobs in cybersecurity and data analytics.

Right now, both the private and public sectors are seriously lacking skilled cybersecurity workers. Industries, universities, Congress, and the federal and state governments should all work hard to train the next generation of cybersecurity experts and data analysts from many of India's impoverished areas. Creating a new sense of economic destiny is possible when you teach useful work skills and match them with chances. Many benefits would come from the government, businesses, and universities investing in a fast-tracked cybersecurity program for Native Americans that includes internships and fellowships to give them real-world experience. Moreover, it would improve the country's ability to find skilled digital workers.

Native Americans have a long history of commitment and service to the United States. Department of Homeland Security (DHS) cooperation with Native Americans has already made a significant difference in keeping our borders safe, especially in remote places where drug smugglers and legal immigrants try to get in. Primarily, DHS's FEMA is working with Native Americans to get ready for situations. According to FEMA's Center for Domestic Preparedness, Native Americans from 23 tribes and 10 states are being trained to help with large-scale disasters caused by nature or human causes.

Government departments like the Department of Homeland Security and others, like the Department of Defense, are looking to hire qualified cybersecurity professionals and analysts. Bringing these Native Americans into the digital economy will only take a coordinated effort and investments in people. This will also improve the safety readiness of both the government and businesses.

A model for this kind of funding already exists in the government. The Cybersecurity Veterans Hiring Pilot program was started by the Department of Homeland Security. The Pilot was meant to support the Department's efforts to hire more cyber professionals and give soldiers more chances to keep working in cybersecurity for the country. Along with the addition of a new trial program, DHS hopes to copy the success of the Native American veteran cybersecurity program. Creating a Native American cybersecurity and digital analytic pipeline would not require a large infrastructure investment, but there are no set program guidelines because this is just an idea.

The parts are already there, and a program could grow out of a clearly defined public-private partnership goal. As the lead for tribal affairs and consultation at the Department of Homeland Security, the Tribal Desk in the Office of Intergovernmental Affairs (IGA) might be a good place to start talking about a possible Native American cybersecurity pilot project.

As an example, caring businesses like Google, Microsoft, Samsung, Apple, and many more could give computers to Indian schools and job training centers. Many groups, including universities, colleges, associations, foundations, and companies, could also help by using the right technology. Individualized classes, run in person or online, could make this possible. Additionally, separate groups could help make the courses needed to get certificates and even degrees in both cybersecurity and data analytics. Additionally, the government could support this work by giving money, internships, fellowships, and security training. By working together and sharing ideas and resources, making a digital job path for Native Americans will be a project that benefits many. As Native Americans have always been patriotic and committed to public service, it is now time to help them learn how to use technology in the modern world.”

Less than a decade later I am excited to see that some of my proposals have come to fruition in rewarding Native Americans for their service and helping prepare and train them to work in digital security as part of the cyber work force.  The Tribal Cybersecurity Grant Program hopefully will make a difference.

The DHS Tribal Grant Program, “in addition to helping Tribal governments address cybersecurity risks and threats to their information systems, TCGP is enabling DHS to provide targeted cybersecurity resources that will improve the security of critical infrastructure and resilience of the services that Tribal governments provide to their members. The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Emergency Management Agency (FEMA) jointly manage the TCGP. CISA provides cybersecurity programmatic subject-matter expertise by defining goals and objectives, reviewing and approving cybersecurity plans establishing measures of effectiveness, and organizing Objective Review Panels to review and score applications.

Digital threats impacting American Indian and Alaska Native tribes are increasing and becoming more complex, and tribal sovereignty creates unique cybersecurity challenges for these communities who for far too long have been underfunded and under-resourced.

DHS respects the sovereignty and self-determination of Tribal governments and recognizes the intent of Congress to provide flexibility to Tribal governments to meet cybersecurity needs across Indian Country through the TCGP. The framework of the program was made as a result of nation-to-nation consultations with tribal representatives across the country and is intended to support tribal cybersecurity resiliency.” Tribal Cybersecurity Grant Program | CISA

- By Chuck Brooks (President, Brooks Consulting International)

Original link of post is here

Cybersecurity expert Chuck Brooks discusses the top five issues in threat detection and how organizations can reduce the risk of cyber-attacks in 2024.

https://search.app/Miwuwt4EtELyDj9F8

Interview by Brian Kelly

I recently sat down with Chuck Brooks, President of Brooks Consulting International, who is a globally recognized thought leader and subject matter expert in the areas of Cybersecurity and Emerging Technologies. We discussed the top five challenges and solutions in threat detection today, and how knowing how to safeguard against them can help organizations mitigate the impact of cyber-attacks.

Brian Kelly: How do threat detection systems like DDoS Protection work?

Chuck Brooks: A distributed denial-of-service (DDoS) attack is an attack in which multiple compromised computer systems attack a target and cause a denial of service. The flood of incoming messages, connection requests, or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems. These attacks are often orchestrated via bots.

A bot defense needs to be able to quickly find data that looks like it came from a known botnet or piece of malware. It also needs to rapidly spot actions that can only be done by software, like getting a lot of requests. Especially if the traffic behaved in a way that wasn't natural, like mouse movements, keystrokes, or visitation trends that weren't normal. An all-around bot defense should also be able to tell if traffic tried to directly access the application interface (API) when it wasn't supposed to or if it tried to stop the signal collection from happening.

Brian Kelly: How is the role of Artificial Intelligence (AI) impacting the cybersecurity space?

Chuck Brooks: AI is a powerful tool for enabling cybersecurity. By prioritizing and acting on data, AI and machine learning (ML) can help make decisions more efficiently. This is especially true for larger, more sophisticated networks with many users and variables.

AI and ML can increase the speed at which new attacks are discovered, draw statistical conclusions, and send that information to endpoint protection systems. You can get real-time data on deviations and other problems using network monitoring and horizon scanning. Continuous diagnostics and forensics analysis are possible for optimal protection, and the defense framework layers (firewalls, payload, endpoint, network, and antivirus) are updated automatically.

Prioritizing and acting on data using AI algorithms can help people make better choices, especially in bigger networks with many users and variables. Locating, sorting, and combining data is a capability for reducing online threats. As a result, predictive analytics can conclude from statistics with fewer resources and send this information to endpoint security platforms.

Generative AI technology can also help write secure code more quickly. Better AI tools, platforms, and technologies can aid writers in composing safer code from the start. This also makes it easier to fix problems as they happen.

AI can also monitor aberrations happening in the network, find new threats without clear signs, and take the right action. In addition, it can be used to connect data from different silos to figure out the types of attacks that are happening and to analyze network risks and weaknesses. As a key part of zero trust cybersecurity, identity, and access management may benefit from AI that checks the validity of data across many distributed systems.

AI can spot things that aren't normal or don’t follow the rules. It can do this by looking at data and files and seeing network activities in real-time to find unapproved connections, unwanted communication attempts, strange or malicious password use, brute force login attempts, strange data transfer, and data exfiltration. Further, AI could significantly change cybersecurity efficiency by automating and orchestrating security. Combining ML and advanced analytics, AI can automate and coordinate many security tasks, such as incident reaction and vulnerability management.

When it comes to adapting to new, sophisticated digital environments, AI and ML become key tools or innovative chess pieces in a cybersecurity strategy game. It will depend on the accuracy, speed, and quality of the algorithms and supporting technologies to stay safe against growing asymmetrical threats.

Also, because there just aren't enough skilled cybersecurity workers, AI can fulfill security tasks that would have been done by adding people in the past. That is a significant benefit.

Brian Kelly: Are there security challenges inherent in using cloud computing?

Chuck Brooks: Both the public and private sectors are quickly moving to cloud and hybrid cloud settings, which is bringing computing closer to the edge. More businesses and government bodies are storing their data in the cloud or a hybrid cloud setup.

The cloud will handle more than 90% of all data handling tasks, according to predictions. Setting up a secure cloud is an important part of protection. As cloud-based services become more common, cybersecurity issues have grown. Issues that businesses must deal with include cloud settings that aren't set up correctly, APIs that aren't safe, and data breaches caused by cloud vulnerabilities.

Rapid migration to the cloud raises new security concerns due to the complicated systems that need to be kept up to date and protected from zero-day threats. Thus, integration should be the main security focus for mixed cloud setups. Achieving integration requires being able to see everything in the environment, including public, private, and on-premises areas. It also requires having the right tools, rules and, in many cases, a managed services partner to make sure that all security standards are met.

Brian Kelly: What are some effective strategies for securing IoT (Internet of Things) devices?

Chuck Brooks: Securing IoT devices is a monumental challenge. The IoT, of course, refers to the emerging connectivity of embedded devices to the internet that are readable, recognizable, locatable, addressable, and/or controllable. That is a big universe of devices. The most at-risk electronics are networked cameras and storage devices, smartphones and tablets, laptops, computers and streaming video devices.

Hackers can potentially obtain data through any IoT-connected device. Many are particularly open to attack, as most of these devices have not had their default passwords changed. People just use them without changing the default passwords, which is an invitation to a data breach. An organization implementing an IoT security framework needs to immediately address how to change the default passwords on purchased, manufactured devices.

There are solutions ranging from homegrown to expert managed service providers with all-in-one solutions for IoT security. They include improving situational awareness, enforcing security policies for technology integration, threat information sharing, and having a cyber resilience strategy are all important parts of a good IoT risk management plan. For example, it should investigate how separating or segmenting IoT devices can lower risk and attack areas. To reach the end goal, solutions and services must be optimized, and the necessary amount of security must be determined.

Brian Kelly: Can you discuss strategies for managing supply chain cybersecurity risks?

Chuck Brooks: Cyber-attackers are always looking for the weakest link in the chain, and reducing the risk of third parties in supply lines is now seen as necessary for cybersecurity. Cyberattacks on supply lines can come from hackers, spies, thieves, or enemies of the country. Most of the time, this is done by breaking into networks with fake or hacked hardware and software, using providers' weak security measures, or using insider threats.

New technologies, like AI and blockchain, are now being used to keep track of, alert, and evaluate supply chain processes. To protect against cyber-threats, you can use Data Loss Prevention (DLP), encryption, log management, identity, access control tools, and SIEM (Security Information and Event Management) platforms. Another specific step companies can take is to audit the security measures that their suppliers and vendors use to ensure that the end-to-end supply chain is secure. The Department of Homeland Security (DHS), the Department of Defense (DOD), and the  White House have all recently implemented supply chain security measures. The Department of Commerce’s NIST (National Institute of Standards and Technology) has suggested a practical one for supply chain security that provides sound guidelines from both government and industry. Brian Kelly: Thanks for your time and your insights today, Chuck.

Chuck Brooks: Thanks Brian, I enjoyed our discussion.

How Spectrum Enterprise can help

Our managed solutions can help IT leaders reduce the burden on their understaffed and overworked teams, by automatically ensuring that your network infrastructure is up-to-date and secure, in accordance with the policies set forth by your organization.

Spectrum Enterprise delivers Enterprise Network Edge over the renowned Fortinet platform. This managed solution delivers complete visibility of security events and threats, network utilization and more through a secure and easy-to-use portal. You can take an active role in managing and controlling the policies of interest and leave the rest to us.

Over 80% of Fortune 500 companies rely on Spectrum Enterprise for technology solutions. Find out more about how Enterprise Network Edge can help you address cybersecurity issues.

My new book: Inside Cyber: How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security 1st Edition

Now available for pre-order on Amazon !

by Chuck Brooks

* Discover how to navigate the intersection of tech, cybersecurity, and commerce

In an era where technological innovation evolves at an exponential rate, Inside Cyber: How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security by Chuck Brooks emerges as a critical roadmap for understanding and leveraging the next wave of tech advancements. Brooks, a renowned executive and consultant, breaks down complex technological trends into digestible insights, offering a deep dive into how emerging technologies will shape the future of industry and society.

In the book, you’ll:

* Gain clear, accessible explanations of cutting-edge technologies such as AI, blockchain, and quantum computing, and their impact on the business world

* Learn how to navigate the cybersecurity landscape, safeguarding your business against the vulnerabilities introduced by rapid technological progress

* Uncover the opportunities that technological advancements present for disrupting traditional industries and creating new value

Perfect for entrepreneurs, executives, technology professionals, and anyone interested in the intersection of tech and business, Inside Cyber equips you with the knowledge to lead in the digital age. Embrace the future confidently with this indispensable guide.

Order here: Amazon.com: Inside Cyber: How AI, 5G, and Quantum Computing Will Transform Privacy and Our Security: 9781394254941: Brooks, Chuck: Books

The Race for Quantum Cybersecurity

by Chuck Brooks

You can access the full magazine here: https://thecyberexpress.com/supply-chain-security-editon/

Supercharging DevOps with AI: The Ultimate Technology Dream Team

AI and DevOps: A Symbiotic Relationship In today’s fast-moving world, creating and updating computer programs quickly is super important for businesses. That’s where DevOps and Artificial Intelligence (AI) come in handy. DevOps is like a team strategy that helps computer programmers and operation folks work better together so they can make software faster and keep them running smoothly. And AI? Think of AI as a really smart helper that can learn and make decisions to take on heavy-duty tasks without much human help.When you mix DevOps and AI, it’s like creating a superhero team for technology. AI can help DevOps by spotting problems before they happen, which means fewer headaches and less downtime for the software. Also, with AI’s help, DevOps teams can manage many different tasks at the same time and make smarter decisions, super fast.For example, AI can look at lots of data to find patterns that might show when something’s about to go wrong. It’s like having a super sense that can smell a problem a mile away! This means that companies can fix issues before they become big dramas, keeping their software running like a dream.Plus, with AI’s ability to learn and adapt, it can help teams become better and more efficient over time. It takes notes on what works best and helps the team get even faster at building and fixing software. It’s always getting smarter and helping the DevOps team do their best work.For those who are interested in how smart technology can make software development zippier and more reliable, have a look at this deep dive into the collaboration between AI and DevOps over here: www.getambassador.io/blog/ai-devops-symbiotic-relationship-deep-dive.For more information on how your organization can accelerate your code modernization, check out the following whitepaper from Copper River at copperrivermc.com/devops/But what if you need some extra help getting started with this power duo of AI and DevOps? That’s where Diversified Outlook Group comes into play. They understand how important it is for businesses to keep up with tech trends and can guide you through the process. Their experts are ready to support you in harnessing the power of AI to boost your DevOps efforts. Reach out to them at support@diversifiedoutlookgroup.com to see how they can help your organization thrive

"The advent of artificial intelligence has many aspects to consider including ethics, regulations, and its many types of applications." ...

Source: BIZCATALYST 360° Artificial Intelligence And Security – Collective Thoughts (bizcatalyst360.com)

Artificial Intelligence and Security – Collective Thoughts

BY Chuck Brooks

I teach a course at Georgetown University’s Cybersecurity Risk Management Program called Disruptive Technologies and Organizational Management. I gain from the give-and-take of my student’s insights. As we are now at the onset of an exponential era of technological growth amplified by artificial intelligence in almost every way and industry vertical.

Regarding cyber risk management, artificial intelligence is a powerful enabler and accelerator for cybersecurity in our networked world.  AI systems are designed to mimic human characteristics and computational abilities in a computer, enabling them to outperform humans in terms of speed and capacity. AI machine learning provides the quickest way to identify new attacks, draw statistical inferences, and provide that information to endpoint protection systems in the context of cybersecurity.

The advent of artificial intelligence has many aspects to consider including ethics, regulations, and its many types of applications. I asked several of my students to share their insights which are featured below.

Student Insights:

• How can safeguards be put on AI to ensure ethics, effective governance, and mitigate bias, and poisoned data?

Safeguarding AI: Ethics, Governance, and Mitigating Risks

Artificial intelligence (AI) offers immense transformative potential, but its unchecked development poses significant risks. Robust safeguards are essential to realize the benefits of AI while minimizing potential harm. Here is how we can approach this multifaceted challenge:

Ethical Frameworks: Industry-wide standards around fairness, transparency, accountability, and non-discrimination are a must. These principles should guide AI design, development, and deployment, ensuring alignment with societal values.

Governance Structures: Independent review boards, bias audits, and accountability can minimize risks. Regulations at the governmental level are also needed to define acceptable uses of AI, enforce standards, and protect individual rights.

Continuous Bias Evaluation: AI systems often learn from real-world data, which can carry deeply ingrained societal biases. Mitigating this requires an initial evaluation, continuous bias auditing, and techniques such as de-biasing algorithms to help train models to be less prone to discriminatory outcomes.

Protection Against Poisoned Data: AI can be manipulated through data poisoning attacks, where bad actors subtly alter training data. Data validation, exposing models to poisoned data sets, and understanding how AI reaches its decision can enhance security.

The Path Forward Collaboration between technology professionals, ethicists, policymakers, and the public is vital to ensuring that AI develops in a way that benefits society as a whole.

By Joshua Cushing https://www.linkedin.com/in/joshuacushing/

• What needs to be in a Risk Management Framework to address the cyber threat of AI?

There needs to be several key components in a Risk Management Framework (RMF) to effectively address the cybersecurity threat of Artificial Intelligence (AI). It should start by identifying risks such as data manipulation, model theft, and malicious attacks. The framework must conduct a risk assessment to assess the probability and impact of these risks focusing on AI’s features like algorithm transparency. In addition, incorporating threat intelligence tailored for AI is crucial for predicting and mitigating threats. The framework should also enforce security measures including encrypting data and limiting access along with security checks to prevent attacks targeting AI systems. Having a response plan specifically designed for AI related breaches will ensure a timely response and containment. Adhering to data protection laws and understanding the ramifications of using AI are equally important. Finally, ongoing training for employees on AI risks in the RMF will help strengthen defenses against evolving AI technologies.

Leonard Field

• How will AI impact cyber threats and cyber defenses?  (i.e. using Generative AI and predictive analytics)

Artificial Intelligence will have a significant impact on the safety of society from a physical and cyber security perspective.  AI will greatly impact the capability of threat detection mechanisms as well as cyber defensive countermeasures through its use of Generative AI and predictive analytics.  The use of Generative AI will allow cyber analysts to rapidly detect and respond to anomalies in their systems due AI ability not only analyze changes in a baseline, but continuously evolve as the landscape changes.  Predictive analytics will be able to assist in this effort by being able to collect and succinctly digest large datasets and identify trends, risks, and patterns that will help analysts in being proactive with the implementation of safeguards that both prevent and deter threat actors.  While capabilities will exist for defensive efforts, there must be an equal understanding that malicious actors will also have this same capability.  Threat agents will use AI in reconnaissance efforts to find vulnerabilities in systems and understand how defensive measures respond to specific intrusion attempts.  The cyber security industry as well as cyber security professionals must continuously analyze and develop tools within the AI space that increase in capacity and capability to mimic the ever-changing landscape.

By Shelley White III www.linkedin.com/in/shelley-white-56a6001a2

• What is Artificial Intelligence Bias?

Regardless of one’s place of origin, inherent bias exists. Bias is not innate but taught. Bias can exist in the forms of race, religion, language, age, culture, or location. Therefore, AI Domain Team members tasked with labeling AI training data or designing AI algorithms for models must come from diverse backgrounds. Artificial Intelligence bias can be implemented purposely or without malice. The outcome of both is an unethical AI model.

By Darryl W. Hicks

• ·How AI will transform the agriculture sector?

The integration of AI and the Internet of Things (IoT) is poised to revolutionize the agriculture sector, offering unprecedented opportunities to enhance efficiency, productivity, and sustainability. Leveraging IoT-enabled monitoring systems, AI algorithms provide farmers with real-time insights into soil conditions, moisture levels, and crop health, enabling data-driven decisions on irrigation, fertilization, and pest control for optimized resource usage and improved yields. Additionally, IoT-equipped wearable sensors and smart collars offer smart livestock management solutions, monitoring the health, behavior, and feeding patterns of animals to detect early signs of illness and enhance animal welfare. Through IoT-based management systems, the entire agricultural supply chain can be streamlined, with AI analytics tracking storage conditions, transportation routes, and product quality to reduce waste and ensure the freshness and safety of agricultural products from farm to market.

Furthermore, AI-driven control systems automate farming operations by leveraging IoT data to regulate irrigation, nutrient management, and crop spraying, while unmanned machinery like drones and robotic tractors perform precision tasks with minimal human intervention, increasing operational efficiency and reducing labor costs. Moreover, UAVs equipped with IoT sensors and AI algorithms monitor crops from above, identifying signs of disease, nutrient deficiencies, and pest infestations to provide actionable insights for targeted interventions, thereby improving crop health and maximizing yields. However, alongside these transformative benefits, the integration of AI and IoT in agriculture presents cybersecurity challenges that must be addressed to ensure the safe and secure adoption of these technologies.

Privacy concerns arise due to the passive nature of IoT data collection, necessitating robust encryption and access controls to safeguard sensitive agricultural data and prevent unauthorized access. Additionally, cybersecurity threats such as ransomware, denial of service (DoS) attacks, and social engineering exploits pose risks to IoT devices in smart farming, highlighting the need for AI-powered cybersecurity solutions to detect and mitigate these threats in real-time. Moreover, supply chain vulnerabilities must be addressed through the implementation of security measures such as blockchain technology and authentication mechanisms to protect against cyber-attacks and data breaches. In conclusion, while AI-driven IoT applications hold immense promise for transforming agriculture, addressing cybersecurity concerns is imperative to ensure their safe and secure adoption in smart farming practices.

References

Barreto, L., & Amaral, A. (2018, September). Smart farming: Cyber security challenges. In 2018 International Conference on Intelligent Systems (IS) (pp. 870-876). IEEE.

Kim, W. S., Lee, W. S., & Kim, Y. J. (2020). A review of the applications of the internet of things (IoT) for agricultural automation. Journal of Biosystems Engineering, 45, 385-400.

Kumar, N., Dahiya, A. K., Kumar, K., & Tanwar, S. (2021, September). Application of IoT in agriculture. In 2021 9th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO) (pp. 1-4). IEEE.

Tao, W., Zhao, L., Wang, G., & Liang, R. (2021). Review of the internet of things communication technologies in smart agriculture and challenges. Computers and Electronics in Agriculture, 189, 106352

By Shavinyaa Vijaykumarr linkedin.com/in/shavinyaa-vijaykumarr-3314922a9

• How will AI transform industries such as healthcare, finance, commerce, transportation, agriculture, space, robotics, and energy?

Artificial Intelligence has the potential to introduce essential contributions to the healthcare sector. This includes administrative processes, such as adherence to compliance standards as well as automation in tasks such as diagnosis and treatment.

By Emanuel Dos Santos https://www.linkedin.com/in/emanuel-dos-santos-506b1b275/

• How can safeguards be put on AI to ensure ethics, effective governance, and mitigate bias, and poisoned data?

Ensuring the safety of artificial intelligence (AI) necessitates a comprehensive strategy, which notably involves government regulation and adherence to industry best practices. The European Parliament’s adoption of the AI Act (AIA) underscores the significant role of external oversight in protecting fundamental rights and addressing ethical advancements in AI (Gasser, 2023). Given the crucial aspects of safeguarding information systems by ensuring confidentiality, integrity, and availability, it is imperative for AI to be trustworthy. This entails being valid and reliable, safe and secure, resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with managed harmful bias (Tabassi, 2023, p. 12). To achieve these characteristics, the AI model must undergo training, receive feedback on ethical dilemmas, and be supervised and rewarded for accurately distinguishing between different types of fairness and implementing them.

References

Gasser, U. (2023). An EU landmark for AI governance. Science, 380(6651), 1203. https://doi.org/10.1126/science.adj1627

Tabassi, E. (2023). Artificial Intelligence Risk Management Framework

(AI RMF 1.0). https://doi.org/10.6028/nist.ai.100-1

By Reginald Kiryowa

• What key elements are necessary to make a framework effective?

The critical aspect of any framework is stakeholder buy-in. A well-thought-out framework backed by solid data and research has a higher chance of success, but even the most well-crafted plan will fail if the people involved do not believe in it. To achieve this, leaders must maintain open communication throughout the implementation process and address any issues that may arise to ensure that stakeholders remain engaged and invested in the plan’s success.

By Hunter Patterson www.linkedin.com/in/hunter-patterson-2315641ba

4 Practical Ways for Businesses to Manage Cyber Risk

by Chuck Brooks

Link: 4 Practical Ways for Businesses to Manage Cyber Risk in 2024 (forbes.com)

Cyberattacks are becoming more common in the digital ecosystems we utilize for both personal and professional reasons. In the past year alone, hundreds of millions of private records from banks, ISPs, and retail establishments have been made available to the public.

The Covid pandemic's impact on work habits may be partly to blame for this rise in violations. The previous few years have seen a sharp shift in work to remote and hybrid workplaces. The evidence indicates that hackers took advantage of the gaps and vulnerabilities in the company's security after accepting this adjustment. The last two years have surpassed all prior records in terms of data lost due to breaches and the sheer volume of cyberattacks on people, corporations, and governments.

Businesses and governments are starting to grasp the seriousness and complexity of these cyber threats. Some of the biggest concerns are ransomware attacks, data breaches, DDoS attacks, misconfiguration, and major IT failures.

The recent wave of major industrial and government cyberattacks serves as an example of the growing threat. The usage of cutting-edge technologies like 5G, AI, and machine learning, as well as growing tactical cooperation among hacker organizations, poses new risks due to their increasingly sophisticated threats.

The reactive mindset has changed as a result of a series of wake-up calls, including significant intrusions by highly skilled threat actors against multiple high-profile targets (including Solar Winds, Colonial Pipeline, OPM, Anthem, Yahoo, and many more). These revelations have exposed a flawed approach to data defense and operating with passive preparedness.

For businesses, there are four basic ways to manage cyber risk in a growing digital threat environment. They include being 1) proactive in security, 2) continuously testing software code and applications, 3) having a risk management and resilience plan, and 4) preparing for the new landscape of emerging technologies.

The Need for Businesses to be Proactive in Security

Being proactive in the ever-evolving digital landscape means doing more than just hiring people and buying new equipment. Creating a cybersecurity framework is also essential since specific circumstances could necessitate the use of biometrics, analytics, encryption, authentication, tactical measures, and ongoing diagnostics and mitigation. Proactive cybersecurity helps to ensure business continuity, to put it briefly.

To maintain continuous business operations, risk assessment and incident handling are the main components of effective methods for minimizing the consequences of cyberattacks. It's critical to keep up with changes in the dangerous landscape and to be ready for anything that might happen. A risk management strategy needs to give top priority to situational awareness assessment, information sharing, and resilience planning.

A proactive cybersecurity commitment requires the completion of a cyber vulnerability risk assessment. This action item is one of the most crucial first steps in cybersecurity best practices. A risk assessment can help you improve overall operational cybersecurity and quickly deploy solutions to protect critical assets from malicious cyber attackers by quickly identifying and prioritizing cyber vulnerabilities.

A comprehensive risk management plan should include cyber-hygiene best practices, instruction, and training; use policies and permissions; network access configuration; code and application testing; device management; application limits; and regular network audits.

A security strategy's specifics can vary based on the circumstances, but the threads that hold it all together are situational awareness and meticulous communication skills for critical communications in an emergency. The United States government and businesses adhere to the National Institute of Standards and Technology's (NIST) slogan, which is "Identify, Protect, Detect, Respond, Recover."

The Importance of Testing Software Code and Applications

Software code testing is a crucial part of information technology product validation. If the testing process is not followed, the final product may include flaws that put a business or organization in danger. One way to ensure the ultimate quality of the goods in software development is to locate and fix errors and misconfigurations. The early detection and correction of flaws and misconfigurations in the software development lifecycle enable planning and cost savings.

Application security testing, which searches for potentially exploitable malware, misconfigurations, or code vulnerabilities in programs and apps, needs to be the first step in that assessment process. Preventiveness and preparedness start with identifying the knowns and unknowns in the code that underpins the different operating networks and applications that will define our digital future.

New code, especially third-party software, needs to be thoroughly identified, assessed, and validated before it is put on the network. The members of your cyber security team should monitor third-party advisory websites such as US-CERT and BugTraq for newly found vulnerabilities.

Even if there is a danger associated with fresh code, many apps and programs may already be operating on antiquated hardware that has security flaws and open doors. Thus, in addition to any new code, legacy code also needs to be checked for patches as part of a vulnerability assessment.

Every program is built on software code, and standards are required to maximize performance and spot flaws. Penetration testing and visibility scanning, which entail confirming and validating the susceptible source code, can accomplish this. The primary objective of the testing and validation techniques is to identify issues before they can contaminate devices and networks.

Software testing, evaluation, and validation are made considerably more difficult by the need to foresee the unknown threats that are typical of cybersecurity breaches, even though the known may be physical. One of these unknowns is locating concealed malware that is outside the reach of sandboxes, signature-based systems, and other behavioral detection methods.

The grim reality is that cyber-breaches are a dynamic threat since criminal hackers are always refining their tactics and skill sets. Cybercriminals these days employ increasingly complex evasion techniques, some of which can even disable malware detection tools. To get past machine learning code and evade anti-malware detection, these thieves usually employ stolen certificates that are sold on the dark web or underground market. Code injection and memory space alteration are used as an exploit kit is injected into the target system. Generative AI is significantly enhancing criminal hacker capabilities in those areas. The government and business sectors must work harder to address and contain cyber threat issues.

Beyond the use of conventional vulnerability scanners and manual penetration testing, testing needs to account for the tactical, behavioral, and ever-more-complex attack surface that hackers are targeting. It also needs to be automated to keep up with the speed at which the ever-evolving cyber world is changing. Developing defensive strategies and anticipating the moves of malicious cybercriminals are prudent measures to improve cybersecurity. It is accomplished through continuous validation testing.

Ongoing behavioral validation testing based on digital and human intelligence inputs makes it possible to close the gap in protection and discovery. Simulation results can be obtained quickly, frequently, and independently of the tester's skill level—a point that may introduce vulnerability.

Having A Plan for Business Continuity and Cyber-Resilience

Remedial measures are essential to continuity since breaches will always happen. To maximize resilience, industry and government entities should set up incident response plans that include mitigation, business continuity planning, and secure backup procedures in case networks and devices are compromised. Training and tabletop exercises can assist in implementing incident response plans in the event of a genuine incident.

Training information security personnel, establishing automated detection and backup systems, and optimizing response processes, cyber-resilience, and company continuity after an intrusion require ongoing development.

Since information sharing keeps the corporate and government sectors updated on the latest ransomware, viruses, malware, phishing, insider threats, and denial of service attacks, it also plays a critical role in resilience and business continuity. Sharing information also results in the creation of working procedures for resilience and lessons learned, which are essential for the success of commerce and the prosecution of cybercrimes.

Meeting The Security Challenges of Emerging Technology

Emerging technology is a tool that both threat actors and cyber-defenders can employ. The current state of cyber threats includes artificial and machine intelligence, quantum computing, the Internet of Things, 5G, virtual and augmented reality, and more.

A possible cybersecurity route that blends machine and artificial intelligence is automation. Artificial intelligence (AI) will significantly speed up security. It will enable real-time analysis and threat identification. Companies will be able to monitor activity within their system and spot any strange activity.

Artificial intelligence (AI) may be used by malevolent hackers to find vulnerabilities and automate phishing attempts, which will jeopardize continuity and resilience if it is not employed, or its implications are not recognized. AI and numerous other cutting-edge technologies will soon drastically change operational models and security. To preserve cyber-resilience and business continuity over the next 10 years, it will be imperative to tackle new and more sophisticated attacks.

Cybersecurity needs to take center stage if businesses are to thrive in today's complicated emerging technology threat environment. Being proactive instead of reactive makes sense for everyone working in the digital environment. Many proven cyber risk management approaches can be used to fortify defenses and plug holes. One theme runs through all risk postures: do not risk becoming complacent in the face of growing cyberthreats and dangers.

3 #Cybersecurity Trends to Watch - #AI #QuantumComputing & #SpaceTech

Avrohom Gottheil @avrohomg

Chuck Brooks highlights how AI aids in threat detection, while quantum computing poses new risks & opportunities. Are you prepared for these trends?

Link: Avrohom Gottheil on X: "3 #Cybersecurity Trends to Watch - #AI #QuantumComputing & #SpaceTech @ChuckDBrooks highlights how AI aids in threat detection, while quantum computing poses new risks & opportunities. Are you prepared for these trends? Reach out to get featured on the #AskTheCEO Podcast! https://t.co/Av1kiILkO8" / X

The Growing Cyber Threat to Industrial OT

Link to podcast: https://www.canva.com/design/DAGKqeyu_ec/vtnURgNtbzgXBR8atKPEqQ/edit

 

- By Chuck Brooks (SME, U.S. Department of Homeland Security)

Original link of post is here

Protecting the frontier of space systems is unquestionably a security priority for governments and industry. Due to our increasing reliance on space, and particularly satellites, for communications, security, intelligence, and business, satellite and space cybersecurity is becoming increasingly important in this new digital era.

In recent years, there has been an increasing number of satellite launches. Currently, thousands of satellites are in low Earth orbit, where they are vulnerable to cyberattacks from both above and below. With the use of satellites to transport data across vast, worldwide distances, many communication networks are currently transitioning from terrestrial (land) based communications to cloud-based communications. Due to the dramatic reduction in launch costs, there are now more satellites in low Earth orbit than ever before. This has increased the number of potential targets for hackers to target, both in space and at control centers located on Earth.

It is anticipated that 25,000 satellites will be launched by 2030, handling more than 500,000 petabytes of data. This underscores the hazards to the economy and data security that come with this increased susceptibility. According to Sam Visner, tech fellow at Aerospace Corporation and the vice chair of the board of directors of the Space Information Sharing and Analysis Center, space systems are essential to almost every critical infrastructure you can think of, including finance, energy, oil and gas, transportation, healthcare, and agriculture.

Countries are depending more and more on space as a mission-critical and developing frontier for information sharing and surveillance. By keeping an eye on adversary threats and geopolitical moves, they also play a crucial role in national security.  In fact, at the beginning of the Russian invasion of Ukraine, an alarming event occurred when an attack occurred that caused disruption to the Ukrainian satellite communications provider ViaSat. And this was not the only cyber-attack targeted satellite incident in recent years.

The national security establishment has recognized that cyber-threats are becoming a greater threat to satellites and communications networks. The US Space Systems Command recently announced beta testing for cybersecurity guidelines regarding commercial satellites in response to those concerns. Because the space business is becoming more and more important to the global economy, the FBI, the National Counterintelligence and Security Center (NCSC), and the Air Force Office of Special Investigations (AFOSI) recently released an advisory warning of cyberattacks on the sector.

In December 2023, in an effort to strengthen mission cybersecurity efforts for both public and private sector space activities, NASA has released the first version of its Space Security Best Practices Guide. The Space System Protection Standard, which encapsulates NASA's ongoing commitment to assisting in the development of precise cybersecurity principles for its space systems, is reflected in the guide. In order to promote the objectives of Space Policy Directive 5, Cybersecurity Principles for Space Systems, the agency created the handbook. 7.22 - Space Security: Best Practices Guide - SW Engineering Handbook Ver D - Global Site (nasa.gov)

A Space Systems Critical Infrastructure Working Group was established by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) last year. The group, which unites stakeholders in the space system's critical infrastructure, is made up of representatives from government and business and functions under the auspices of the Critical Infrastructure Partnership Advisory Council (CIPAC).

I was privileged to be a member of that working group, and soon industry-focused recommendations and initiatives on cybersecurity for space systems will be made available. The role of the working group is especially important as networks are changing from terrestrial (land) based communications to the cloud, taking advantage of satellites to move data over large, international distances. CISA Launches a Space Systems Critical Infrastructure Working Group | CISA

Securing space systems is imperative. Satellite security must be comprehensive covering every facet of both terrestrial and orbiting satellites, including end-user routers and ground communications systems. There is a non-kinetic threat to space assets. Adversaries can interfere with or take down satellites and ground-based equipment using a variety of tactics.  Through Earth-bound entry points, satellite operations can provide cybercriminals with a multitude of hacking avenues. The utilization of long-range telemetry for communication with ground stations is one of the shortcomings of satellite systems. Cybercriminals can access the open protocols used to send the uplinks and downlinks.

The late Paul Ferrillo, Esq., and I wrote a piece for Homeland Security Today titled "Protecting Space-Based Assets from Cyber Threats." Hstoday Protecting Space-Based Assets from Cyber Threats - HS TodayIn that article we provide a non-exhaustive list of security components below that can be used to protect satellites, space-based assets, and ground-based control flight networks.


Below are some of our suggestions that incorporated a variety of government and non-governmental sources:

1. Every satellite is engineered with security from the ground up, not as an afterthought.

2. Identity and access management, or "IAM" - in order to try and prevent unauthorized access to crucial vehicle operations, anyone gaining access to flight control information and surfaces must be recognized and validated by an IAM system that can pass muster on the user using machine learning identifiers.

3. Perform a multi-check for IoT-related devices. Hard-coded passwords shouldn't be permitted on IoT devices; instead, they should be updateable.

4. A strong intrusion detection system (IDS) should be the foundation of a cyber-resilient spacecraft. Continuous monitoring of telemetry, command sequences, command receiver status, shared bus traffic, flight software configuration, and operating states should all be part of the IDS. It should also be able to predict and adjust to counteract evolving hostile activity. Critical spacecraft systems should be able to be switched back to a recognized cyber-safe mode by the IPS and the ground crew. It should be possible to cross-check logs for unusual activities.

5. Supply chain risk management programs must be implemented by spacecraft developers. They have to make sure that every one of their providers follows the agreed-upon chain of custody while handling hardware and software. Aside from being identified and treated differently from noncritical units and subsystems in terms of requirements and rigor, critical units and subsystems should also be built with security in mind. Configuration management and secure software development techniques (DevSecOps) should be used to appropriately vet and handle all software on the spaceship.

6. For cross-validation, command logging and anomaly detection of command sequences should be carried out independently by the spacecraft and the ground. In order to ensure consistency between commands given and received, directives received can be automatically recorded, transmitted to the ground via telemetry, and validated.

7. Measures like signal strength monitoring and guarded transmitters and receivers should be taken to prevent communications jamming and spoofing; links should be encrypted for extra protection.

The topic of  space system security is getting much attention as of late  because of its central importance to our digital ecosystem. An excellent overview of the complexities and issues involved can also be found in an article;  ‘Cybersecurity in Space: A 2024 Perspective” byAvantika Chopra Cybersecurity In Space: A 2024 Perspective (thecyberexpress.com)

Please also see my article in FORBES, “The Urgency to Cyber-Secure Space Assets” The Urgency To Cyber-Secure Space Assets (forbes.com)

And check out “Cybersecurity of Space-Based Assets and Why this is Important” and Atlantic Council Discussion with Dr. David Bray, Dr. William Jeffrey, Chuck Brooks, and Dr. Divya Chander. Cybersecurity of Space-Based Assets and Why this is Important - Atlantic Council

We are depending more and more on space for both security and trade, making it a developing and crucial cybersecurity frontier. It requires the national security establishment's attention and should undoubtedly be included as a top priority when it comes to DHS CISA's critical infrastructure protection. In order to safeguard space assets that are crucial to all domain operations, NASA , DOD, the USAF, and Space Command are also starting programmatic initiatives. There is a pressing need to proceed in a swift, ambitious, and targeted manner.

Chuck Brooks, President of Brooks Consulting International, is a globally recognized thought leader and subject matter expert Cybersecurity and Emerging Technologies. Chuck is also Adjunct Faculty at Georgetown University’s Graduate Cybersecurity Risk Management Program LinkedIn named Chuck as one of “The Top 5 Tech People to Follow on LinkedIn.” He was named as one of the world’s “10 Best Cyber Security and Technology Experts” by Best Rated, Best of The Word in Security” by CISO Platform, and by IFSEC, and Thinkers 360 as the “#2 Global Cybersecurity Influencer. " He was also named one of the Top 5 Executives to Follow on Cybersecurity by Executive Mosaic and serves as a featured GovCon Expert. Chuck is also a Cybersecurity Expert for “The Network” at the Washington Post, Visiting Editor at Homeland Security Today, and a Contributor to FORBES. He has an MA in International relations from the University of Chicago, a BA in Political Science from DePauw University, and a Certificate in International Law from The Hague Academy of International Law.

Check out the Space Comm Expo 6-7 March at Farnborough International Exhibition and Conference Centre

THE UK'S LARGEST SPACE EXPO SERIES (space-comm.co.uk)

Artificial Intelligence, Quantum Computing, and Space are 3 Tech areas to Watch in 2024

by Chuck Brooks

Artificial Intelligence, Quantum Computing, and Space are 3 Tech areas to Watch in 2024 (forbes.com)

Space

A Developing Frontier of Innovation

Our civilization's ability to communicate is becoming more and more reliant on satellites. Countries depend more on space as a mission-critical and developing frontier for information sharing and surveillance. These days, a lot of networks are switching from terrestrial (land-based) communications to cloud-based communications, utilizing satellites to transfer data across long international distances.

Satellite systems entail cyber risk. By keeping an eye on adversarial threats and geopolitical moves, they also play a crucial role in national security. Cyberattacks could target satellites in an attempt to sabotage communications or information streams that are essential for security and trade. In fact, at the beginning of the Russian invasion of Ukraine, an alarming event occurred when an attack occurred that caused disruption to the Ukrainian satellite communications provider ViaSat.

Due to our increasing reliance on space, and particularly satellites, for communications, security, intelligence, and business, satellite and space security is becoming increasingly important in 2024.

Space Systems Predictions:

Samuel S. Visner, Chair, Space Information Sharing and Analysis Center/Tech Fellow, The Aerospace Corporation

“Even as the market for space systems evolve, our dependence on space systems for national and economic security, and for all our critical infrastructures will increase dramatically, a fact not lost on our adversaries, including Russia, which fired its opening "shots" in its invasion of Ukraine by an attack on commercial space systems. We will need to demonstrate and strengthen our leadership in space system technologies, even in new mission areas ranging from space manufacturing to advanced remote sensing, from global 5G networks with direct device-to-satellite connectivity to space mining and renewed exploration. We'll need, too, to demonstrate our commitment and capacity to protect these systems and determination to deter attacks against them.” (19) Samuel Visner | LinkedIn

David Logsdon, Information Technology Industry Council - Senior Director of Space Policy

“In the coming years, there will be a greater focus on tools that can enhance space innovation and cyber secureness such as zero trust, software bill of materials, and secure by design. Special attention should also be paid to the utilization of AI and emerging technologies that will allow the public and private sectors to scale and address cyber concerns effectively.” (19) David Logsdon | LinkedIn

Rich Cooper, Vice President - Strategic Communications & Outreach Space Foundation

"While the global space ecosystem will continue to grow beyond the more than 90 countries with active space operations today, it is the commercial space industry that will drive the game-changing innovations that expand space access and opportunity and deliver even greater benefits for all of us back on Earth.” (19) Rich Cooper | LinkedIn

Chuck Brooks, Brooks Consulting International, Georgetown University

“In the coming year, the security risk management of satellites and space will emerge as a top priority among both the public and private sectors. The economic sustainability of the free world depends on space-based global communications and sensing. Unfortunately, many of the platforms lack adequate protection, and hence, space cybersecurity will play a significant role in protecting key infrastructure. The emerging frontier of Space will need to be a high security priority for 2024.”

Without a doubt, 2024 will be a very interesting and possibly revolutionary year for science and developing technology. We are only at the beginning of our civilization's journey to discover how new applications of technology can impact our way of life in 2024 and beyond. I hope you'll look into this further.

DHS CISA WORKING GROUP

Brooks Consulting International serving as SME

Space is one of the fastest-growing markets of the global economy. The rapid expansion of the space services market and the competitive advantage gained from being a first mover, increases the potential for lax security. It takes a holistic approach to assess risks associated with the space systems enterprise and understand the impacts to all critical infrastructure and National Critical Functions (NCFs), including terrestrial infrastructure as well as on-orbit vehicles that conduct operations in the space environment.

CISA’s Role

CISA works with public and private sector partners to advance space system security and resilience by identifying and assessing risks and expanding industry and international partnerships to ensure the responsible use of space.

Overview

Projections suggest the space economy will more than triple in size in the next decade with an expected value of $1.4 trillion by 2030. As more satellites and satellite systems occupy the near-Earth space domain and as terrestrial systems increasingly rely on space technology, increasing cyber, kinetic, and energy threats to space systems put national security and economies at risk. On September 4, 2020, the Space Policy Directive-5 Cybersecurity Principles for Space Systems (SPD-5), the Nation’s first comprehensive cybersecurity policy for space systems, was signed:

“Space systems enable key functions such as global communications; positioning, navigation and timing; scientific observation; exploration; weather monitoring; and multiple vital national defense applications. These systems, networks, and channels can be vulnerable to malicious activities that can deny, degrade, or disrupt space operations, or even destroy a satellite. It is essential to protect space systems from cyber incidents in order to prevent disruptions to their ability to provide reliable and efficient contributions to the operations of the Nation's critical infrastructure.”

Although SPD-5 remains in effect, it is unclear how many private sector entities will adopt the concepts put forth in the policy. Research indicates that some of the systems currently in orbit were designed with little or no security. However, cyber threats to space enterprise elements cross the spectrum from cyber criminals to advanced persistent threats from nation-states. Nation-states also threaten space vehicles and systems with advanced energy and kinetic weaponry.

Like any system, the space systems enterprise requires evaluation of risk at all levels of its life cycle. From manufacture to final disposition at end-of-life, commercial and government space activities continue to be regulated by multiple government organizations with the regulatory environment evolving as both the military and commercial space landscape continues to grow. The space system enterprise is striving for public-private information sharing around identified vulnerabilities, threat information, space weather, and space intelligence.

DHS Space Policy

Space-based systems play a critical role in securing the homeland security enterprise as Department of Homeland Security (DHS) components and partners rely heavily on space systems to provide information and communications necessary for mission success. The DHS Space Policy (signed April 14, 2022), guides component efforts internally and across the homeland security enterprise.

DHS will assume a leading role in three primary areas: promotion of cybersecurity of space systems, homeland security mission assurance planning and execution, and contingency planning to respond to and recover from potential impacts to the homeland resulting from a denied or degraded space environment.

- By Chuck Brooks (SME, U.S. Department of Homeland Security)

Original link of post is here

Cybercriminals all over the world have leveraged this technology’s increased anonymity to buy and sell illegal goods, services, stolen data, underground infrastructure and force victims to pay ransom. While blockchain analysis enables researchers and law enforcement to glean information from illicit transactions, criminals have countered by adopting the use of cryptomixers to obscure their transactions and further complicate investigations. It has been observed gangs in the cybercriminal underground are increasingly relying on cryptomixing services to obfuscate the origin of their criminal earnings.

What are Cryptomixers ?

Cryptomixers are often stand-alone services that are available to the general public via the open internet. They often use anonymous means of communication and do not keep logs of customer transactions, which given the push by law enforcement for crypto exchanges to incorporate financial compliance laws into their operations, makes cryptomixers a useful tool for criminals.

How Mixers Work ?

Mixers work by allowing threat actors to send a sum of cryptocurrency, usually bitcoin, to a wallet address the mixing service operator owns. This sum joins a pool of the service provider’s own bitcoins, as well as other cybercriminals using the service. The initial threat actor’s cryptocurrency joins the back of the “chain” and the threat actor receives a unique reference number known as a “mixing code” for deposited funds. This code ensures the actor does not get back their own “dirty” funds that theoretically could be linked to their operations. The threat actor then receives the same sum of bitcoins from the mixer’s pool, muddled using the service’s proprietary algorithm, minus a service fee. For added anonymity, the threat actor can choose to send this new “clean” sum of bitcoins to numerous wallet addresses to further obfuscate the trail of the illicit funds. This makes it more difficult for law enforcement to associate the original “dirty” cryptocurrency with the threat actor.

POPULAR CRYPTOMIXERS

While the act of “mixing” cryptocurrency is not itself an illegal practice, these platforms aren’t widely used by the vast majority of crypto-enthusiasts. Most users do not need the extra level of privacy nor want to lose crypto to the service fees that come with mixing cryptocurrency. The cryptomixers that were observed all had well-established presences on multiple, well-known cybercrime forums. All of the mixers had professional-looking sites, likely serving as an attempt to make their operations appear more legitimate and attract a wider range of clients. None of the providers advertised their roles in money laundering, instead preferring to suggest their sites serve businesses using cryptocurrencies and individuals interested in protecting their privacy.

Among the most popular mixers observed are:

• Absolutio  

• AudiA6

• Blender

• Mix-BTC

• Helix

All the mixers observed were operational on the clear web and Tor network except mix-btc, which was only available on the open internet. All four providers offered their services in English, with Absolutio, AudiA6 and mix-btc also featuring Russian-language versions of their sites. All four mixers offered services for Bitcoin, while others also offered mixing services for Bitcoin Cash, Bitcoin SV, Dash, Ethereum, Ethereum Classic, Litecoin, Monero and Tether cryptocurrencies.

All the mixers listed a minimum balance for mixing services, which varied from 0.001 bitcoin (about US $60) for Blender to 0.006 bitcoin (about US $375) for mix-btc. Maximum amounts varied significantly, with Absolutio limited to 2 bitcoins (about US $125,700), Audi A6 to 27 bitcoins (about US $1.7 million) and Blender to 2,600 bitcoins (about US $163 million). Mix-btc did not specify an upper limit for transactions.

Additionally, all four mixers charge transaction fees, collected as a percentage of the total amount of cryptocurrency to be mixed. Some services allow users to choose a “dynamic” service fee, which is most likely done to complicate investigations into illicit cryptocurrency funds by altering the amount being laundered at different stages of the process, making it more difficult to tie the funds to a specific crime or individual. The fees are the following:

• Absolutio: ​​Users select “dynamic” service fees, falls between 1 percent to 30 percent

• AudiA6: Flat service fee between 3 percent and 5.5 percent

• Blender: Users select “dynamic” service fee, falls between 0.6 and 2.5 percent

• Mix-BTC: Flat service fee between 3 percent and 5.5 percent, additional charges depending on the volatility of bitcoin price

While these mixers do not share their wallet addresses publicly, Intel 471 found a wallet that was used by Blender from June 2020 to July 2020, handling bitcoin transactions in excess of 54 bitcoins (about US $3.4 million). Assuming an average transaction fee of 1.6 percent, this wallet could have received fees in excess of US $50,000 during that time period.

EVEN MORE “PRIVACY”

With RaaS groups wanting as many ways as possible to keep a low profile, some developers decided to integrate cryptocurrency mixing services in their administrative panel instead of relying on the web-based options. The developers behind Avaddon, DarkSide 2.0 (also known as BlackMatter) and REvil likely integrated the BitMix cryptocurrency mixer to facilitate the laundering of ransom payments for program affiliates. Additionally, BitMix itself operated an affiliate-type program in which registered partners received 50 percent of fees charged for mixing funds. This meant any RaaS groups engaged in this partnership would receive 50 percent of the commission BitMix charged ransomware affiliates With BitMix commissions reaching as much as 4 percent, the affiliate program presents an appealing prospect to RaaS groups.

Action against Cryptomixers

Larry Dean Harmon, founder of Helix and Coin Ninja, has been fined $60 million for being involved in money laundering. He is among the first mixing services operator in the crypto industry, but the Financial Crimes Enforcement Network announced its involvement in money laundering on Monday. The founder has faced continued criminal charges and is now fined for breaching the Bank Secrecy Act (BSA). Larry was arrested in February for operating mixers that the prosecutors allege constitute unauthorized money services companies. The charges against Harmon indicate that he has laundered more than $300 million in Bitcoin.

CONCLUSION

Cryptomixers are a linchpin in ransomware schemes. Through these services, threat actors can achieve their end goal of cashing out and keeping the criminal underground liquid through the trade of illicit goods and services. A thorough understanding of the operational underpinnings of these mixing services is key to comprehending how criminals are laundering the money they earn from their crimes. It’s important to understand how all facets of a ransomware operation works if civil society is to stop the losses inflicted by these schemes.

- By Adv (Dr.) Prashant Mali 

Original link of post is here

We are hosting an exclusive "Best of the World" Talks session on "The CISO’s Journey: From Expert to Leader" featuring David B. Cross (SVP & CISO at Oracle), Bikash Barai (Co-founder of CISO Platform & FireCompass) & David Randleman (Field CISO at FireCompass).

The journey from cybersecurity expert to strategic leader is a transformative one for CISOs. This session delves into the stages of a CISO’s evolution, the balance between technical expertise and leadership, the unique value veterans bring to cybersecurity, and strategies to stay ahead of emerging attack techniques in an ever-changing threat landscape.

Key Discussion Points: 

• Career Evolution: Insights into the journey to becoming a CISO at Oracle and defining career moments.
• Success Metrics: Industry trends shaping how CISOs measure success.
• Veterans’ Role: The impact of veterans’ skills and clearances in cybersecurity hiring.
• Mental Health & Pop Culture: Managing stress as a CISO and pop culture’s take on cybersecurity.

Date: 12th Dec, 2024 (Thursday)
Time: 8:00 AM PST | 9:30 PM IST

Join us live or register to receive the session recording if the timing doesn’t suit your timezone.

>> Register here

You can buy ransomware for as little as $66, or hire a threat actor for $250. And if you look hard enough, you can even get a phishing kit for free on underground forums. Although these illicit methods may not be expensive, the damage they inflict can be substantial.

Phishing has become more popular than ever. Bhagwat Karad, the minister of state for finance reported to Indian parliament, that more than 50,000 (50,242) cases of cyber frauds, banking frauds using internet banking, ATM-Debit and Credit Cards were registered in the first nine months of the current fiscal year, citing RBI data (April-December 2021 period). During the nine-month period, the victims of these frauds lost a total of nearly Rs 167 crore.

According to the FBI’s Internet Crime Complaint Center, the number of phishing complaints more than doubled in 2020 to 241,342 cases compared to the prior year. From there, attacks doubled again as phishing reached a monthly record in Q3 2021, according to a recent report from the Anti-Phishing Working Group (APWG). The total number of incidents (reported & unreported) must be higher. A record 2 million phishing sites were reported in 2020, the most in a decade. This comes as no surprise, as phishing kits are cheap and easy available.

What is a Phishing Kit

Phishing kits are .zip files with all the scripts required to deploy an attack. These kits enable anyone with minimal programming skills to unleash massive ransomware campaigns. In 2019, the average price of a phishing kit was $304, with the prices ranging between $20 and $880. 

Recently, Microsoft discovered a campaign that used 300,000 newly created and unique phishing subdomains in one massive run. Microsoft also identified a phishing-as-a-service organization known as BulletProofLink. It resembled any other software-as-a-service brand, with tiered service levels, email and website templates, hosting, a newsletter and even 10% off your first order.

Meanwhile, even attackers get targeted. Some phish kits have been unlocked and posted for free on dark web forums. 

What is the Cost of a Ransomware Attack

On the other hand, suffering attacks is expensive. According to the IBM Cost of a Data Breach report, in 2021 the average cost of a ransomware attack totaled $4.62 million (not including the ransom, if paid). Compare that to the $66 attackers can pay for a ransomware kit.

Alert

Before you think to become cyber criminal, be aware that the cyberlaw is also catching up. There’s even some evidence that the police can now track and recover funds paid for in cryptocurrency. many cryptocurrency cases in India were detected and cyber expert fraudsters were arrested including ex police officers.Also remember, WHILE CYBERCRIME is largely measured in financial terms it is the psychological trauma that hurts victims the most when they are blamed by their family members or society in general for falling victim to the attack/scam.

- By Adv (Dr.) Prashant Mali 

Original link of post is here

Basic structure of legal argument

1. If conditions A, B and C are satisfied, then legal consequences X, Y and Z follow. (Major premise: legal rule)
2. Conditions A, B and C are satisfied (or not). (Minor Premise: the facts of the case)
3. Therefore, legal consequences X, Y and Z do (or do not) follow. (Conclusion: legal judgment in the case).

As I mentioned in part one, the first premise of this argument structure tends to get most of the attention in law schools. The second premise — establishing the actual facts of the case — tends to get rather less attention. This is unfortunate for at least three reasons.

First, in practice, establishing the facts of a case is often the most challenging aspect of a lawyer’s job. Lawyers have to interview clients to get their side of the story. They have to liaise with other potential witnesses to confirm (or disconfirm) this story. Sometimes they will need to elicit expert opinion, examine the locus in quo (scene of the crime/events) and any physical evidence, and so on. This can be a time-consuming and confusing process. What if the witness accounts vary? What if you have two experts with different opinions? Where does the truth lie?

Second, in practice, establishing the facts is often critical to winning a case. In most day-to-day legal disputes, the applicable legal rules are not in issue. The law is relatively clearcut. It’s only at the appeal court level that legal rules tend to be in dispute. Cases get appealed primarily because there is some disagreement over the applicable law. It is rare for appeal courts to reconsider the facts of case. So, in the vast majority of trials, it is establishing the facts that is crucial. Take, for example, a murder trial. The legal rules that govern murder cases are reasonably well-settled: to be guilty of murder one party must cause the death of another and must do this with intent to kill or cause grievous bodily harm. At trial, the critical issue is proving whether the accused party did in fact cause the death of another and whether they had the requisite intent to do so. If the accused accepts that they did, they might try to argue that they have a defence available to them such as self-defence or insanity. If they do, then it will need to be proven that they acted in self defence or met the requirements for legal insanity. It’s all really about the facts.

Third, the legal system has an unusual method of proving facts. This is particularly true in common law, adversarial systems (which is the type of legal system with which I am most familiar). Courts do not employ the best possible method of fact-finding. Instead, they adopt a rule-governed procedure for establishing facts that tries to balance the rights of the parties to the case against both administrative efficiency and the need to know the truth. There is a whole body of law — Evidence Law — dedicated to the arcana of legal proof. It’s both an interesting and perplexing field of inquiry — one that has both intrigued and excited commentators for centuries.

I cannot do justice to all the complexities of proving facts in what follows. Instead, I will offer a brief overview of some of the more important aspects of this process. I’ll start with a description of the key features of the legal method for proving facts. I’ll then discuss an analytical technique that people might find useful when trying to defend or critique the second premise of legal argument. I’ll use the infamous OJ Simpson trial to illustrate this technique. I’ll follow this up with a list of common errors that arise when trying to prove facts in law (the so-called ‘prosecutor’s fallacy’ being the most important). And I’ll conclude by outlining some critiques of the adversarial method of proving facts.

1. Key Features of Legal Proof

As mentioned, the legal method of proving facts is unusual. It’s not like science, or history, or any other field of empirical inquiry. I can think of no better way of highlighting this than to simply list some key features of the system. Some of these are more unusual than others.

Legal fact-finding is primarily retrospective: Lawyers and judges are usually trying to find out what happened in the past in order to figure out whether a legal rule does or does not apply to that past event. Sometimes, they engage in predictive inquiries. For example, policy-based arguments in law are often premised on the predicted consequences of following a certain legal rule. Similarly, some kinds of legal hearing, such as probation hearings or preventive detention hearings, are premised on predictions. Still, for the most part, legal fact-finding is aimed at past events. Did the accused murder the deceased? Did my client really say ‘X’ during the contractual negotiations? And so on.

Legal fact-finding is norm-directed:Lawyers and judges are not trying to find out exactly what happened in the past. Their goal is not to establish what the truth is. Their goal is to determine whether certain conditions — as set down in a particular legal rule — have been satisfied. So the fact-finding mission is always directed by the conditions set down in the relevant legal norm. Sometimes lawyers might engage in a more general form of fact-finding. For instance, if you are not sure whether your client has a good case to make, you might like to engage in a very expansive inquiry into past events to see if something stands out, but for the most part the inquiry is a narrow one, dictated by the conditions in the legal rule. At trial, this narrowness becomes particularly important as you are only allowed to introduce evidence that is relevant,/i> to the case at hand. You can’t go fishing for evidence that might be relevant and you can’t pursue tangential factual issues that are not relevant to the case simply to confuse jurors or judges. You have to stick to proving or disputing the conditions set down in the legal rule.

Legal fact-finding is adversarial (in common law systems): Lawyers defend different sides of a legal dispute. Under professional codes of ethics, they are supposed to do this zealously. Judges and juries listen to their arguments. This can result in a highly polarised and sometimes confusing fact-finding process. Lawyers will look for evidence that supports their side of the case and dismiss evidence that does not. They will call expert witnesses that support their view and not the other side’s. This is justified on the grounds that the truth may emerge when we triangulate from these biased perspectives but, as I will point out later on, this is something for which many commentators critique the adversarial system. There is a different approach in non-adversarial system. For instance, in France judges play a key role in investigating the facts of a case. At trial, they are the ones that question witnesses and elicit testimony. The lawyers take a backseat. Sometimes this is defended on the grounds that it results in a more dispassionate and less biased form of inquiry but this is debatable given the political and social role of such judges, and the fact that everyone has some biases of their own. Indeed, the inquisitorial system may amplify the biases of a single person.

Legal fact-finding is heavily testimony-dependent: Whenever a lawyer is trying to prove a fact at trial, they have to get a witness to testify to this fact. This can include eyewitnesses (people who witnessed the events at issue in the trial) or expert witnesses (people who investigated physical or forensic evidence that is relevant to the case). The dependence on testimony can be hard for people to wrap their heads around. Although physical evidence (e.g. written documents, murder weapons, blood-spattered clothes etc) is often very important in legal fact-finding, you cannot present it by itself. You typically have to get a witness to testify as to the details of that evidence (confirming that it has not been tampered with etc).

Legal Fact-Finding is probabilistic: Nothing is ever certain in life but this is particularly true in law. Lawyers and judges are not looking for irrefutable proof of certain facts. They are, instead, looking for proof that meets a certain standard. In civil (non-criminal trials), facts must be proved ‘on the balance of probabilities’, i.e. they must be more probable than not. In criminal trials, they must be proved ‘beyond reasonable doubt’. What this means, in statistical terms, is unclear. The term ‘reasonable doubt’ is vague. Some people might view it as proving someting is 75% likely to have occurred; others may view it as 90%+. There are some interesting studies on this (LINK). They are not important right now. The important point is that legal proof is probabilistic and so, in order to be rationally warranted, legal fact-finders ought to follow the basic principles of probability theory when conducting their inquiries. This doesn’t mean they have to be numerical and precise in their approach, but simply that they should adopt a mode of reasoning about facts that is consistent with the probability calculus. I’ll discuss this in more detail below.

Legal fact-finding is guided by presumptions and burdens of proof (in an adversarial system): Sometimes certain facts do not have to be proved; they are simply presumed to be true. Some of these presumptions are rebuttable — i.e. evidence can be introduced to suggest that what was presumed to be true is not, in fact, true — sometimes they are not. The best known presumption in law is, of course, the presumption of innocence in criminal law. All criminal defendants are presumed to be innocent at the outset of a trial. It is then up to the prosecution to prove that this presumption is false. This relates to the burden of proof. Ordinarily, it is up to the person bringing the case — the prosecution in a criminal trial or the plaintiff in a civil trial — to prove that the conditions specified by the governing legal rule have been satisfied. Sometimes, the burden of proof shifts to the other side. For instance, if a defendant in a criminal trial alleges that they have a defence to the charge, it can be up to them to prove that this is so, depending on the defence.

Legal fact-finding is constrained by exclusionary rules of evidence:Lawyers cannot introduce any and all evidence that might help them to prove their case. There are rules that exclude certain kinds of evidence. For example, many people have heard of the so-called rule against hearsay evidence. It is a subtle exclusionary rule. One witness cannot testify to the truth of what another person may have said. In other words, they can testify to what they may have heard, but they cannot claim or suggest that what they heard was accurate or true. There are many other kinds of exclusionary rule. In a criminal trial, the prosecution cannot, ordinarily, provide evidence regarding someone’s past criminal convictions (bad character evidence), nor can they produce evidence that was in violation of someone’s legal rights (illegally obtained evidence). Historically, many of these rules were strict. More recently, exceptions have been introduced. For example, in Ireland there used to be a very strict rule against the use of unconstitutionally obtained evidence; more recently this rule has been relaxed (or “clarified”) to allow such evidence if it was obtained inadvertently. In addition to all this, there are many formal rules regarding the procurement and handling of forensic evidence (e.g. DNA, fingerprints and blood samples). If those formal rules are breached, then the evidence may be excluded from trial, even if it is relevant. There is often a good policy-reason for these exclusions.

Those are some of the key features of legal fact-finding, at least in common law adversarial systems. Collectively, they mean that defending the second premise of a legal argument can be quite a challenge as you not only have to seek the truth but you have to do so in a constrained and, in some sense, unnatural way.

- By Adv (Dr.) Prashant Mali 

Original link of post is here

1. Art 21 of the Constitution guarantees fundamental right to life and personal liberty. This article of Constitution has been interpreted by the Judiciary with widest amplitude so as to include several other rights such as right to food and shelter, and other rights and most importantly the right to fair trial which includes the right to fair investigation. In Anbaizhagan’s case, the apex court observed that, ‘if the criminal trial is not free and fair and not free from bias the judicial fairness and the criminal justice system would be at stake, shaking the confidence of the public in the system and woe would be the rule of law’,1 Trial should be fair to all concerned and ‘denial of fair trial is as much an injustice to the accused as is to the victim and the society.2

2. The right to fair trial includes ‘Fair Investigation’,3 Fair trial and fair investigation are pre-requisites to get justice which the parties deserve as per law, and one without the other cannot yield to fair justice. A victim of a crime is entitled to fair investigation4 and if required the case can be entrusted to a specialized agency like CBI and the courts have enough power to do complete justice to the
parties by giving appropriate directions.

3. The investigating authorities have been empowered to submit a report to the magistrate that there is no evidence or reasonable grounds or suspicion to justify the forwarding of the accused to the Magistrate and to release the accused from the custody on his executing a bond with or without surety, as the police officer direct, to appear, if and when so required, before a Magistrate empowered to take cognizance of the offence on a police report and to try the accused or commit for trial.5 The 41st report of the Indian Law Commission recommended that an accused person must get a fair trial in accordance with the principles of natural justice, efforts must be made to avoid delay in investigation and trial and the procedures should aim at ensuring fair deal to the poorer sections of the society.6 The report under Sec 169 Cr Pc is referred to as a ‘closure report’. The Magistrate however, can direct the police to make further investigation. The scope of the power to direct further investigation when the police report states that there is no evidence to proceed further, and really there is no evidence in the case at all, whether it would be an order which can be justified or held valid needs examination.



4. In a case where the Director-General of Anti-Corruption Bureau gave an order and a report under Sec 169 Cr Pc and it was a ‘speaking order’ containing reasons that there is absolutely no evidence to prosecute the accused, the direction given by the Magistrate when the case itself does not contain any evidence to proceed further, the direction of the court has to be viewed as bad in law. This view finds support when there is a finding by Lokayukta that there is no material against the accused. As the apex court ruled that a reference is made to the investigating officer or the courts to Section 169 Cr Pc, the same has to be read as a reference to Sec 173 Cr Pc.7

5. The power of the court to take cognizance of a case, it is to examine whether there is sufficient ground for taking judicial notice of the offence in order to initiate further proceedings. The apex court examined this issue in Chief Enforcement Officer’s case8 and stated thus:-
“The expression ‘cognizance’ has not been defined in the code. But the word ‘cognizance’ is of indefinite import. It has no esoteric or mystic significance in criminal law. It merely means ‘become aware of’ and when used with reference to a court or a Judge, it connotes ‘to take notice of judicially’. It indicates the point when a court or a Magistrate takes judicial notice of an offence with a view to initiating proceedings in respect of such offences said to have been committed by someone”


.
It was further elucidated thus:-9

i) Taking cognizance does not involve any formal action of any kind;

ii) It occurs as soon as the Magistrate applies his mind to the suspected commission of an offence;

iii) It is prior to the commencement of criminal proceedings;

iv) It is an indispensable requisite for holding a valid trial;

v) Cognizance is taken of an offence and not an offender;

vi) Whether the Magistrate has taken cognizance of an offence or not depends on the facts and circumstances of each case, as no universal application rule can be laid down;

vii) Under Sec 190 of Cr Pc, it is the application of the Judicial mind to the averments in the complaints that constitutes ‘cognizance’;

viii) The Magistrate has to consider whether there is sufficient ground for proceeding further and not sufficient ground for conviction, as the sufficient ground for conviction can be
considered only at the trial;

ix) If there is sufficient ground for proceedings, then the Magistrate can issue the process under Sec 204 Cr Pc.10 The Magistrate has the undoubted discretion, to be judicially exercised in determining whether there is a prime-facie case to take cognizance11 and

x) Despite a report of the police that no case is made out, the Magistrate can reject the report and take cognizance and to order further investigation under Sec 173 (8) Cr Pc.

6. The main object for taking cognizance is to commence proceedings against the accused. At this stage of cognizance, court is concerned with the involvement of the person and not of his innocence. When there is no material to proceed, there is no point in taking cognizance and proceeding further. The prosecution becomes futile exercise when the materials available do not show an offence is committed. The apex court observed thus:-

i) Summoning of an accused in a criminal case is a serious matter. Criminal law cannot be set in motion as a matter of course;12

ii) The process of criminal court shall not be permitted to be used as a weapon of harassment. Once it is found that there is no material on record to connect an accused with the crime, there is no meaning in prosecuting him. It would be a sheer waste of public time and money to permit such proceedings to continue against such a person;13

iii) Unmerited and undeserved prosecution is an infringement of the guarantee under Art 21 of the Constitution;14 and

iv) No court can issue a positive direction to an authority to give sanction for prosecution, when there is a police report that no case is made out to prosecute, unless the court finds otherwise.15 Criminal law should not be used for vexatious prosecution. (In case where sanction is required to prosecute such as for offences under the Prevention of Corruption Act etc.

7. Thus, the fair investigation requires that the police should thoroughly examine the entire evidence to find out whether any prime-facie is made out against the accused. If no case is made out, there should be a closure report under Sec 169 which will be regarded as a report under Sec 173 Cr Pc.

It is again the duty of the Magistrate to find out whether there is any material on record to proceed against the accused. If there is no material to proceed further, there is no point in taking cognizance. In other words, the fair investigation and trials need the protection of an accused from unwanted and vexatious prosecutions to avoid harassment to persons concerned.

References:

1 AIR 2004 SC P.524.

2 Best Bakery Case, for details refer to AIR 2004 SC P.3114.

3 Kalyani Baskar Vs. M.S.Sampoornam, (2007)2 SCC P.259.

4 Nirmal Singh Kahlon’s case, AIR 2006 SC P.1367.

5 See for details Sec 169 of the Criminal Procedure Code, 1973.

6 See for details report submitted in September, 1969.

7 Sanjay Sinh Ram Rao Chavan Vs. Dattatray Gulab Rao Phalke (2015)3 SCC P.126 at P.133

8 (2008)3 SCC P.492 at P.499.

9 Ibid, See para 20.

10 The expression Cr PC has been used for the Criminal Procedure Code, 1973 throughout this study.

11 See for details Nagawwa Vs. Veeranna Shivaligappa Konjaligi (1976)3 SCC P.736.

12 Pepsi Foods Ltd., Vst. Judicial Magistrate (1998)3 SCC P.749 Para 28.

13 State of Karnatak Vs. Muniswamy (1977)2 SCC P.699 At P.803 Para 8.

14 State of Bihar Vs. P.P.Sharma, (1992) Supp (1) SCC P.222 at P.265 Para 60.

15 Mansukhlal Vithaldas Chauhan Vs. State of Gujarath (1997)7 SCC P.622 at P.635 Para 32.

- By Adv (Dr.) Prashant Mali 

Original link of post is here

Learn Modern SOC and D&R practices for free from Google! Yes, really! That’s the message. Join *hundreds* of others who already signed up!

Now, with full details….

After some ungodly amount of work, the original ASO crew (but really Iman!) put together an epic Modern Security Operations training, now launched at Coursera at no cost.

“Today, Google Cloud is excited to announce the launch of the Modern SecOps (MSO) course, a six-week, platform-agnostic education program designed to equip security professionals with the latest skills and knowledge to help modernize their security operations, based on our Autonomic Security Operations framework and Continuous Detection / Continuous Response (CD/CR) methodology. “ (launch blog)

What’s in the class? Here is an outline!

 

(src: MSO class)

So, in simple words:

• No, taking the class won’t make your SOC like our D&R teams (example), just as reading the ASO paper won’t do it.
  
  
• However, you will learn how we think modern D&R needs to be run, whether you call it a SOC or not! A version of what works for us and quite a few others.

 

(src: MSO class)

• Also, no, we won’t try to sell you any tools (promise!) — we do have them!
  
  
• And, yes, this is still the original ASO thinking, just renamed MSO (long story…)
  
  
• But we will also teach you how to not be a hero :-)

 

(src: MSO class)

Anyhow, enough rambling! Go take this class!

P.S. There is also a video of me talking about the awesomeness of ASO somewhere in there, find it! :-)

Related:

• MSO class on Coursera
  
  
• “Learn how to transform your security operations with our new Modern SecOps Masterclass” official launch blog
  
  
• “WTH is Modern SOC, Part 1” blog
  
  
• “Baby ASO: A Minimal Viable Transformation for Your SOC” blog
  
  
• “New Paper: “Autonomic Security Operations — 10X Transformation of the Security Operations Center” blog (the original ASO paper)
  
  
• “Achieving Autonomic Security Operations: Why metrics matter (but not how you think)” blog

- By Anton Chuvakin (Ex-Gartner VP Research; Head Security Google Cloud)

Original link of post is here

Do I go to my Cloud Service Provider (CSP) for cloud security tooling or to a third party vendor?

Who will secure my cloud use, a CSP or a focused specialty vendor?

Who is my primary cloud security tools provider?

This question asked in many ways has haunted me since my analyst days, and I’ve been itching for a good, fiery debate on this. So, we did this on our Cloud Security Podcast by Google where the co-hosts divided the positions, researched the arguments in advance of the debate and then just … WENT AT EACH OTHER :-)

The results were so fun and interesting that this blog was born!

The Case for Third-Party Vendor Tooling

These arguments hinge on three primary concerns: trust, consistency, and innovation.

Some observers also highlight the theoretical conflict of interest when a CSP is responsible for both building and securing the cloud (no idea why people say this, as IMHO there is no conflict here). This side also stressed the importance of consistency across multi-cloud environments and argued that dedicated security vendors are more likely to innovate more rapidly. They also may address client needs faster, especially narrow vertical needs.

• You just can’t trust the cloud builder to secure their own stuff (or “letting the cat guard the cream” as somebody weirdly opined on social media). Third-party vendors promise unbiased security analysis and can uncover security issues that CSPs might deprioritize, benefiting the broader public and individual users. This separation of duties suggests a more objective evaluation of cloud security.
  
  
• Consistency is super critical for multicloud. Third-party tools provide a consistent security framework across multiple cloud platforms. This simplifies management and reduces the need for specialized knowledge in each CSP’s unique security offerings.
  
  
• Startups just build better tools; this is their focus and sole mission; CSPs suffer from “security from a big company” syndrome, being slow and political. Third-party vendors, whose core business is security, are more likely to develop innovative and effective security solutions compared to CSPs, who may view security as a secondary concern.
  
  
• Auxiliary argument: Would you ever trust the CSP to secure the network/environment that belongs to their competitor?

The Case for CSP-Native

These arguments hinged on three primary concerns: deep platform knowledge, built-in security, and seamless stack.

Deep platform knowledge that CSPs possess suggests both robust and “automatic”, default security. The seamlessness of CSP-native tools and the vast (we mean it, BTW!) resources that CSPs dedicate to security also play a key role. CSPs are very well positioned to keep pace with the rapid evolution of cloud services, and secure them as they are built.

• CSP knows the platform and cloud in general best, can use unlisted or poorly documented capabilities to secure the cloud. Security deeply integrated into the platform is “more secure”, and also better linked with asset tracking, and other IT ops / DevOps capabilities. This deep knowledge translates into superior security capabilities, both practical and conceptual.
  
  
• Built-in beats bolt-on, with fewer seams to break and break through. CSP-native tools offer seamless integration with other services, streamlining workflows, and reducing the risk of security gaps that can arise from stitching together disparate tools. This results in a simpler and more manageable security stack. Recent breaches highlight the risks associated with these integration points, underscoring the advantage of built-in security.
  
  
• Using native tools reduces the number of third-party vendors and solutions you need to manage, leading to a simpler security stack and less administrative overhead. When cloud platforms and security tools share the same foundation, operational teams benefit from streamlined access and workflows.
  
  
• Auxiliary argument: CSP keeps pace with securing new services as they are being launched. And there are a lot of cloud services being launched.

The Verdict

• “It depends” wins! It really does. No, we are not hedging or fudging. Are you disappointed?
  
  
• To make it practical, we need to answer “depends on what?” Organizational realities: how you use cloud, what cloud, how many clouds, what is your threat model, etc.
  
  
• None of the arguments from either side include a “killer” or a clincher argument that stops the debate and hands the victory to one side.
  
  
• Often starting with CSP-native tools and then supplementing with third-party solutions to address any gaps (if any) is the way to go (this also was Gartner advice in my days, BTW)

Listen to the audio version (better jokes!). And, yes, do read “Snow Crash” if you somehow failed to, before.

Resources:

• EP186 Cloud Security Tools: Trust the Cloud Provider or Go Third-Party? An Epic Debate, Anton vs Tim
  
  
• EP74 Who Will Solve Cloud Security: A View from Google Investment Side
  
  
• EP22 Securing Multi-Cloud from a CISO Perspective, Part 3
  
  
• EP176 Google on Google Cloud: How Google Secures Its Own Cloud Use
  
  
• “Use Cloud Securely? What Does This Even Mean?!”

- By Anton Chuvakin (Ex-Gartner VP Research; Head Security Google Cloud)

Original link of post is here

So some of you are thinking “ewwww … another security transformation paper” and this is understandable. A lot of people (and now … a lot of robots too) have written vague, hand-wavy “leadership” papers on how to transform security, include security into digital transformation or move to the cloud (now with GenAI!) the “right” way, while reaping all the benefits and suffering none of the costs. Because tote leadership!

This is not one of those, promise! Why not? Because our new paper helps answer two real — and really hard — questions:

#1 Based on the experience of others, what does a “modern” or transformed organization’s security capability look like?

#2 Given what you have today, how to transition from whatever you have to what we discussed in #1 above?

I bet you’d agree that this is really tricky. Hence our paper!

Let’s start with my favorite insights and surprises below (and, yes, Gemini via Gems had a “hand” in this, curation though is very human):

• The Primacy of Organizational Transformation: The guide emphasizes that digital transformation is not solely — or even largely — about technology adoption, but fundamentally about transforming the organization, its operations, its team structure and its culture. This may surprise security leaders from traditional organizations who might primarily focus on technical solutions and “let’s just get new tools!”
  
  
• The OOT (Organization, Operations, Technology) Approach: The guide advocates for prioritizing organizational and operational changes before finalizing technology decisions. This may challenge the conventional approach in traditional organizations where technology choices often precede organizational adaptation.
  
  

 

Roadmap of how “classic” teams fuse into modern ones

• The Significance of a Generative Culture: The guide stresses the critical role of a generative culture in achieving successful transformation. Cultivating a generative culture is essential for fostering adaptability and thus ultimately for modernizing security. Such a culture, characterized by high trust, information flow, and shared responsibility, may be a departure from the hierarchical and siloed structures prevalent in traditional organizations.
  
  
• The Distribution of Security Responsibilities: We propose a shift away from centralized security functions towards a model where product teams assume greater ownership of security throughout the development lifecycle. The distributed responsibility model emphasizes empowering product teams to build security into their applications from the outset. This may surprise — and upset — security leaders accustomed to a centralized security model.
  
  
• The Difficulty of Letting Go: We remind everybody that moving away from legacy processes and controls can be unexpectedly challenging, even painful. Teams may be attached to familiar processes or resistant to change, even if it leads to visibly greater efficiency and security. Security leaders might be surprised by the internal resistance they encounter when trying to implement new ways of working.
  
  

 

Transform process we use

As usual, my favorite quotes from the paper:

• “As we’ve helped more security teams make the move to the cloud, we’ve identified nuanced challenges that they face — namely those related to team structure, changing business operations, and establishing culture — that are critical to their success”
  
  
• “Where do we start when we talk about transforming the cybersecurity organization within a company that’s historically delivered security to on-premise systems within a highly centralized function? Ideally, we think this conversation should start with defining security goals framed in business outcomes like capabilities, velocity, quality, cost, and risk.”
  
  
• “You’ll find many opinions about how cybersecurity enables a successful digital transformation, but most observers are unaware of the complexity involved in effectively collaborating and sharing responsibilities, skills, tooling, and other capabilities with fast-moving product-based teams who own the full set of responsibilities — including cybersecurity — for the applications they build and run.”
  
  
• “Moving away from the toil often associated with securing on-premise systems can be challenging for unexpected reasons. We think security in the cloud is a better future that can be difficult to imagine without inspiration and intentional culture development. ” [A.C. — this is not some snide remark about ‘server huggers’ but a very human tendency to like whatever they invested their blood and soul into…]
  
  
• “Our first step in helping customers work through transition to the cloud and more modern ways to work starts with backing away from the belief that it’s the technology that’s transforming.” [A.C. — my fave example is here]

Now, go and read our new paper!

P.S. “Anton, but I like SOC papers, can I haz moar? — Yes, there is one coming in a few weeks! Part 4.5 of our glamorous SOC of the Future series”

Related:

• “CISO’s Guide to Cloud Security Transformation” paper (2021)
  
  
• Moving shields into position: How you can organize security to boost digital transformation (official launch blog for the same paper)
  
  
• How CISOs need to adapt their mental models for cloud security
  
  
• For a successful cloud transformation, change your culture first

- By Anton Chuvakin (Ex-Gartner VP Research; Head Security Google Cloud)

Original link of post is here