Ivan Ristić

Regulatory compliance? 🙄 I know right? But ensuring that you enforce geographic specific access to certain systems doesn't need to be hard... one simple policy...

2

⚠ More on the Importance of ISO/IEC TS 12791:2024⚠ Many of you saw Adam Leon Smith DEng FBCS's post yesterday commenting on the release of ISO’s new technical specification (TS) document for the treatment of unwanted bias in certain AI systems. I don’t think everyone realizes what a big deal this really is, so today I thought we might explicate it a bit more. The primary goal of ISO/IEC TS 12791:2024 is to offer a structured approach for managing unwanted #bias in machine learning (ML) systems, with a specific focus on classification and regression tasks. It outlines practical methods to identify, assess, and address bias at each stage of the AI lifecycle, ultimately supporting ethical AI practices that yield fair and accurate outcomes. ➡Applicability This specification applies to organizations of all sizes and types that develop, implement, or operate AI systems, particularly those deploying ML models for classification and regression tasks. It’s useful across various verticals where AI-driven decisions impact individuals and groups, such as finance, healthcare, and public services. ➡Technical Aspects 🔶 ISO/IEC TS 12791 outlines methods to address unwanted bias in several AI lifecycle stages: 1. Inception and Stakeholder Identification - Emphasizes understanding diverse stakeholder perspectives, which helps identify and address potential biases early. 2. Design and Development - Provides guidance on selecting features and handling metadata to prevent and mitigate biases. 3. Verification and Validation - Recommends both static and dynamic testing to ensure the AI system performs consistently across diverse groups, supporting fairness and accuracy. 4. Continuous Monitoring and Re-evaluation - Mandates ongoing oversight to detect bias over time, especially when external conditions change. 5. Bias Treatment Techniques - Suggests data and algorithmic adjustments to reduce bias impact, including training adjustments, feature balancing, and use of diverse datasets. ➡ Supporting AI Governance via #ISO42001 For organizations implementing ISO42001 (AIMS), ISO/IEC TS 12791 serves as a key resource to meet your governance requirements related to fairness and non-discrimination in AI. Specifically: ✅Alignment with Risk Management (Clause 6): The standard’s focus on proactive bias identification and mitigation supports ISO42001's risk-based approach by managing bias as a potential risk factor. ✅Transparency and Accountability (Clause 7.5): Documenting bias mitigation steps fulfills ISO42001’s transparency requirements, ensuring that bias-related decisions are recorded and traceable. ✅Stakeholder Engagement (Clause 4.2): By identifying and considering stakeholders impacted by bias, organizations can enhance alignment with ethical AI governance, fostering trust and inclusivity. Special thanks to Deniz Celikkaya for coaching on today's article. A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou 🌐 https://lnkd.in/gFpvrndX

104

6 Comments

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

In my latest blog post, I discuss the role of weak fingerprinting signals in the context of bot and fraud detection. I use the example of language-related signals to illustrate how even signals that may look insignificant can be leveraged to detect inconsistencies introduced by bot frameworks and anti-detect browsers. https://lnkd.in/eZ2hcKeH

35

4 Comments

Proposed Implementer's Draft of OpenID Federation The OpenID Connect working group has started working group last call (WGLC) for a proposed Implementer’s Draft of the OpenID Federation specification. As described in the WGLC message: "OpenID Federation -35 has been published at https://lnkd.in/g-N77DdF and https://lnkd.in/gdv-JTa2. This draft is being proposed as the fourth (and hopefully final) Implementer’s Draft of the specification." An Implementer’s Draft is a stable version of a specification providing intellectual property protections to implementers of the specification. The two-week working group last call ends on Friday, May 31, 2024. Unless reasons are identified during the last call to substantially revise the specification, the 45-day OpenID Foundation-wide review of the specification for approval as an OpenID Implementer’s Draft will shortly follow. Special thanks to all the implementers and deployers who provided feedback to get us to this point! See the post at https://lnkd.in/gmEhYueB. OpenID Foundation Roland Hedberg Giuseppe De Marco Vladimir Dzhuvinov John Bradley Andreas Åkre Solberg #OpenID #Federation

68

5 Comments

The EXPMON Public has reported several Foxit Reader crashes when processing a public PDF sample set. https://lnkd.in/gidnAhMU https://lnkd.in/gCeijxFz https://lnkd.in/grJTxu7b I've manually analyzed them and confirmed they're not zero-day attacks, they're not FPs either. They're even not new Foxit Reader vulns/bugs, as far as I've seen. The crashes could be reproduced in the specific tested Foxit Reader version 2023.2.0.21408 (so not FPs), but not in the latest version. So I'd guess it's a vuln/bug in Foxit Reader just got patched in the last several months. Yeah, sometimes, @EXPMON_ could be used to discover software vulnerabilities (for free), too. You never know what you'd encounter when processing real-world samples! :)

9

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

⚠ Areas of Overlap and Gaps between AICPA SOC2 Trust Services Criteria (TSC) and ISO 42001 - PART 2⚠ -Questions for Realistic Controls Cross Mapping- ❓ Scoping 1. What are the specific AI systems and components within the organization’s scope? 2. What are the boundaries and applicability of the AI management system within the organization? 3. What external and internal issues are relevant to the organization's AI systems? ❓TSCs Included in Scope 1. Which TSC criteria are relevant to the AI systems? (Security, Availability, Processing Integrity, Confidentiality, Privacy) 2. How do the TSC criteria map to the specific AI controls and requirements in ISO 42001? ❓Detailed Cross Mapping Questions 1. Governance and Accountability: ◾How does the organization’s governance structure ensure accountability for AI systems (ISO 42001, Clause 5.1 and AICPA TSC, Common Criteria)? ◾What roles and responsibilities are defined for AI systems, and how do they align with TSC criteria? 2. Risk Management: ◾How are AI risks identified, assessed, and mitigated (ISO 42001, Clause 6.1.2, 6.1.3 and AICPA TSC, Risk Assessment and Mitigation)? ◾How are AI impact assessments integrated into the risk management process? 3. Security and Confidentiality: ◾What controls are in place to ensure the security and confidentiality of AI systems (ISO 42001, Annex A controls and AICPA TSC, Security, Confidentiality)? ◾How is the integrity of AI data and systems maintained? 4. Monitoring and Evaluation: ◾What monitoring and evaluation processes are in place for AI systems (ISO 42001, Clause 9.1 and AICPA TSC, Monitoring of Controls)? ◾How are performance and effectiveness of AI systems measured and reported? 5. Ethics and Fairness: ◾What measures are in place to ensure ethical use and fairness of AI systems (ISO 42001, Annex A controls)? ◾How are bias and ethical considerations integrated into AI system development and deployment? 6. Documentation and Communication: ◾What documentation is maintained for AI systems (ISO 42001, Clause 7.5.1 and AICPA TSC, Information and Communication)? ◾How are AI policies, procedures, and impact assessments documented and communicated? For those of you who currently carry SOC2 attestation that are considering pursuing ISO42001 certification, please know that while the frameworks don't necessarily directly align, you will find ways to repurpose existing controls (administrative and technical) if you ask the right questions in context. As always, if you need help getting started, please reach out! A-LIGN #AICPA #SOC2 #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

14

4 Comments

CMMC Level 2 Assessment Objective: Data in Transit PRACTICE: Organizations must implement cryptographic mechanisms to prevent unauthorized disclosure of controlled unclassified information (CUI) during transmission unless otherwise protected by alternative physical safeguards. ASSESSMENT: The intent of this requirement is to ensure CUI is cryptographically protected during transit, particularly on the internet. The most common way to accomplish this is to establish a transport layer security (TLS) tunnel between the source and destination using the most current version of TLS. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST cryptographic mechanisms or mechanisms supporting or implementing transmission confidentiality. (CMMC Assessment Guide: Level 2 Version 2.11, page 222) #CMMC #DoD #cybersecurity #NIST #InformationSecurity https://bit.ly/45HMpUs

41

Get ready folks! Updated guidance on safeguarding CUI is almost ready for prime time. How are you all doing implementing rev 2 of SP800-171? Rev 3 is different, same number of safeguards as observed in rev 2, but there are significant changes. #somethingnew If you’re an Indiana business Purdue cyberTAP can help, reach out let’s discuss your cybersecurity program. #CUI #CMMC

6

2 Comments

There's a new cyberespionage campaign targeting government agencies in EMEA and Asia by a group called SneakyChef. They use lures that are scanned documents related to government affairs. This campaign uses a wider range of targets and infection techniques than previous ones. Stay vigilant and educate your colleagues about these threats! #cybersecurity #APT #governmentthreats https://lnkd.in/dM9qz5EM

18

This is a fantastic article by John Althouse. It does a deep dive on new security research into TCP Fingerprinting - JA4T. This builds tremendously on the previous research into TLS fingerprinting, JA4, which you now see being implemented in WAF solutions, such as AWS WAF. Fingerprinting TCP allows you to gain visibility into what devices are being used, whether the traffic is proxied, or even what cellular provider the device is on. This will enable firewalls to build more robust logic to protect against TLS as well as non-TLS traffic https://lnkd.in/ehtSxP8d

12

Drinking from the firehose 🚿 🤯 - a quadrant where up and left is where you want to be 😏 As the 2024 #Mitre #MSS results continue to be analysed, an important metric to review is Noise to Signal ratio. Inside of Noise to Signal ratio, it is also important to review atomic detections vs correlated detections, clear context is everything. This measurement is important as it indicates the quality of the product the #MDR team is using, which impacts their ability to meet SLAs - remembering this isn’t a real world scenario. It’s also important to review this ratio if you plan to operate your own internal MDR based on these underlying technologies, are you prepared to handle this many alerts? Blog here from SentinelOne - https://lnkd.in/gi5Dc94R Evan Davidson Gary Gardiner Wayne Phillips Aravind Vasudevan Laurel Martin Tracey Reed Shabeel Shah Pierrick Delcroix Jim Cook Trevor Van Essen *image source, SecurityHQ

78

11 Comments

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

A few recent improvements by the team (🤘) to centrally collect and export forensic data from cloud resources like VMs and Containers, as well as on-premise systems: - Centrally store the evidence as .dd, .e01 or .zip - Download and export to your existing forensic tools - Download files from acquired systems, using “encrypted zip” for suspect files. -- Similar to VirusTotal Intelligence's Download File functionality for those who know it, but for your own data. All part of helping you build a central “Repeatable Investigation Process”

25

3 Comments

ICYMI: The inaugural study on EPSS performance and broader vulnerability exploitation trends published this week. If you've ever wanted data-driven answers to questions like these listed in the ToC shown here, download it today (free, no registration req'd): https://lnkd.in/gBbsgwQM #vulnerabilitymanagement #vulnerabilities #infosec

51

8 Comments

Listening to a great talk on single point of failure supply chain by Tarah Wheeler at the IANS Boston security forum. Great talk and a great introduction to the discussion led later today on this issue. If you are here and want to continue this massively important issue join my session on supply chain at 1:05 PM. I believe this is one of the biggest problems in cybersecurity today. What can you do about it? What are you doing about it? Tarah is bringing up some great points. Have you implemented her suggestions? What have been your challenges? Have you considered the wide variety of sources of supply chain attacks? Software updates are not the only thing you need to worry about. What tools exist to help you defend against these attacks? This was a great introduction to today’s discussion and I hope it helps people consider the severity of this issue. Come to learn and share how you are dealing with supply chain attacks with your peers.

8