Is Elon Musk's "maximum truth-seeking AI" achievable? Overcoming bias in artificial technologies is crucial for cybersecurity, but doing it could be a challenge.

Concerns over bias in emerging artificial intelligence (AI) tools received a fresh airing recently when billionaire Elon Musk talked about his plans to create a "maximum truth-seeking AI" as an alternative to OpenAI's Microsoft-backed ChatGPT and Google's Bard technologies. 

In an interview with Fox News' Tucker Carlson earlier this month, Musk expressed concern over what he described as ChatGPT being trained to lie and to be politically correct, among other things. He described a so-called "TruthGPT" as a third option that would be unlikely "annihilate humans," and would offer the "best path to safety" compared with the other generative AI tools.

Musk has offered no timetable for his planned chatbot. But he has already established a new AI firm called X.AI, and has reportedly begun hiring AI staff from ChatGPT creator OpenAI as well as from Google and its parent, Alphabet.

Meanwhile, of course, AI bias affects cybersecurity risk as well. 

**Surfacing a Familiar Concern**

Musk's comments to Carlson echoed some of the sentiments that he and hundreds of other tech leaders, ethicists, and academicians expressed in an open letter to AI companies in March. The letter urged organizations involved in AI research and development to pause their work for at least six months, so policymakers have an opportunity to put some guardrails around the use of the technology. In making their argument, Musk and the others pointed to the potential for biased AI tools flooding "our information channels with propaganda and untruth" as one of their main concerns.

Suzannah Hicks, data strategist and scientist at the International Association of Privacy Professionals (IAPP) says the fundamental problem with bias in AI and machine learning is that it stems from human decision-making. All AI models learn from extremely large data sets and are not programmed explicitly to respond in specific ways. Typically, bias happens in the data that humans choose to input into the model.

"If biased data is entered into the model, then the output will likely contain bias as well," Hicks says. "Bias can also be introduced through data omission or by data scientists choosing a variable as a proxy for something other than what the data element is," she says. As an example, Hicks points to a machine learning algorithm that might take the number of "clicks" a user makes when browsing Netflix as a proxy for a positive indicator. "I may be clicking on movies to read their description and decide I don’t like it, but the model may misinterpret the click as an indicator of a 'like,'" she says.

Similarly, a lending service that uses AI to determine credit eligibility might end up denying a disproportionately high number of loans to people in a high-crime ZIP code if the ZIP code was part of the data set in the AI tool's learning model. "In this case, the ZIP code is being used as a proxy for human behavior, and by doing so produces a biased result," Hicks says.

Andrew Barratt, vice president at Coalfire, says his own testing of a text-to-image generation tool provided one example of the bias that exists in emerging AI technologies. When he asked the tool to generate a photorealistic image of a happy man enjoying the sun, the tool only generated Caucasian skin tones and features, though the input he provided contained no racial context. He says one concern going forward is that providers of AI platforms seeking to monetize their technologies could introduce bias into their models in a way that is favorable to advertisers or platform providers.

Whenever you monetize a service, you typically want to maximize the monetization potential with any further evolution of that service, says Krishna Vishnubhotla, vice president of product strategy at Zimperium. Often that evolution can start deviating from the original goals or evolution path — a concern that Musk vocalized about ChatGPT in his interview with Carlson. "Herein lies the issue that Elon talks about," Vishnubhotla says.

**Cybersecurity Bias in Artificial Intelligence**

While Musk et al didn't specifically call out the implications of AI bias on cybersecurity, that's been a topic for some time, and it's worth revisiting in the era of ChatGPT. As Aarti Borkar, a former IBM and Microsoft executive and now with a venture capital fund, noted in a groundbreaking column for Fast Company in 2019, with AI becoming a prime security tool, bias is a form of risk.

"When AI models are based on false security assumptions or unconscious biases, they do more than threaten a company’s security posture," Borkar wrote. "AI that is tuned to qualify benign or malicious network traffic based on non-security factors can miss threats, allowing them to waltz into an organization’s network. It can also over-block network traffic, barring what might be business-critical communications."

With ChatGPT being enthusiastically introduced into cybersecurity products, the risk of faulty hidden bias could contribute even more to false positives, abuse of privacy, and cyber defense that has gaping holes. And to boot, cybercriminals could also poison the AI to influence security outcomes.

"If the AI were to be hacked and manipulated to provide information that’s seemingly objective but is actually well-cloaked biased information or a distorted perspective, then the AI could become a dangerous … machine," according to the Harvard Business Review.

So the question becomes whether there really can be completely unbiased AI, and what it would take to get there.

**Eliminating Bias in AI**

The first step to eliminating data bias is to understand the potential for it in AI and machine learning, Hicks says. This means understanding how and what data variables get included in a model.

Many so-called "black-box" models, such as neural networks and decision trees, are designed to independently learn patterns and make decisions based on their data sets. They don't require the user or even the developer to fully understand how it might have arrived at a particular conclusion, she says. 

"AI and machine leaning rely on black-box models a great deal, because they can handle vast amounts of data and produce very accurate results," Hicks notes. "But it’s important to remember they are exactly that — black boxes — and we have no understanding of how they come to the result provided."

The authors of a World Economic Forum blog post last October argued that open source data science (OSDS) — where stakeholders collaborate in a transparent way — might be one way to counter bias in AI. Just as open source software transformed software, OSDS can open up the data and models that AI tools use, the authors said. When data and AI models are open, data scientists would have an opportunity to "identify bugs and inefficiencies, and create alternate models that prioritize various metrics for different use cases," they wrote.

**The EU's Proposed AI Risk Classification Path**

The European Union's proposed Artificial Intelligence Act is taking another approach. It calls for an AI classification system in which AI tools are classified based on the level of risk they present to health, safety, and an individual's fundamental rights. AI technologies that present an unacceptably high risk, such as real-time biometrics ID systems, would be banned. Those deemed as presenting limited or minimal risk, such as video games and spam filters, would be subject to some basic oversight. High-risk AI projects, such as autonomous vehicles, would be subject to rigorous testing requirements and show evidence of adherence to specific data quality standards. Generative AI tools such as ChatGPT would be subject to some of these requirements as well.

**The NIST Approach**

In the US, the National Institute of Standards and Technology (NIST) has recommended that stakeholders broaden the scope of where they look when searching for sources of bias in AI. In addition to machine learning processes and the data used in training AI tools, the industry should consider the societal and human factors, NIST said in a special publication on the need for standards to identify and manage bias in AI. 

"Bias is neither new nor unique to AI and it is not possible to achieve zero risk of bias in an AI system," NIST noted. To mitigate some of the risk, NIST will develop standards for "identifying, understanding, measuring, managing, and reducing bias."

Rethinking Safer AI: Can There Really Be a 'TruthGPT'?

With 60% of organizations taking more than four days to resolve cybersecurity issues, Unit 42’s Global Incident Response Service dramatically reduces time to remediate threats.

**SANTA CLARA, Calif., April 24, 2023 –** Palo Alto Networks (NASDAQ: PANW), the global cybersecurity leader, today announced the expansion of its Unit 42 Digital Forensics and Incident Response Service. The Global Digital Forensics and Incident Response service combines depth of incident response experience with the breadth of AI-powered solutions, including Cortex® XDR® and XpanseTM, and Prisma® Cloud, to equip enterprises to respond immediately and recover faster than most any digital forensics and incident response (DFIR) service in the market.

To help organizations better respond to complex threats, Palo Alto Networks’ unique knowledge of security and a deep understanding of advanced attacker behavior enables Unit 42 to undertake a rigorous investigation with rapid response. According to Wendi Whitmore, senior vice president of Palo Alto Networks Unit 42, “No other security vendor in the industry can match Palo Alto Networks’ telemetry or our breadth of products to stop attacks in real-time. We analyze data from thousands of customers globally, generating over 500 billion daily events. This massive dataset enables responders to contextualize threats and respond effectively. Coupled with our expertise in cloud threats, SOC automation, and network security, this advanced intelligence helps companies recover and emerge stronger than before.”

Unit 42 specializes in cyber DFIR and responds to thousands of customer events annually from ransomware incidents to the rising cloud attacks. Backed by a global team of incident responders, threat intelligence experts, and consultants, Unit 42 has handled some of the largest data breaches in history.

According to the recent Unit 42 Cloud Threat report, more than 60% of organizations take over four days to resolve security issues, while threat actors typically exploit a misconfiguration or vulnerability within hours. Unit 42 recently engaged with a large enterprise customer after a zero-day vulnerability allowed an authentication bypass and remote code execution (RCE) exploit. The threat actor leveraged the vulnerability to drop web shells and launch a crypto miner onto the client's unpatched CRM system hosted on a popular cloud service provider (CSP). Through unauthorized access, the threat actor stole a CSP credential that provided access to sensitive databases, which they made publicly available on the Internet. As part of the investigation, Unit 42 leveraged Cortex XDR to ingest the CSP CloudTrail logs for rapid threat hunting and analysis and Prisma Cloud to assess the client's CSP environment. Using Prisma Cloud, Unit 42 assisted the client in remediating the CSP misconfigurations and implementing security best practices during the incident, in real-time, improving their security posture overall.

**The Unit 42 Digital Forensics and Incident Response Service includes:**

*   Assessments: To evaluate and test controls against real-world threats proactively, Unit 42 offers many assessments, including compromise assessments, ransomware readiness assessments, attack surface assessments, and more. 
*   IR Preparedness: Helping organizations pressure test technical controls, network security, response playbooks, and more. Services include Penetration Testing, Purple Teaming and Tabletop exercises. 
*   Incident Response: Quickly jumpstart an intelligence-led investigation, deploying Palo Alto Networks tools within minutes to contain threats and gather the evidence needed to analyze an incident fully. Unit 42 IR services include cloud incident response, expert malware analysis, and ransomware investigation. 
*   Managed Threat Hunting: Offers round-the-clock monitoring from Unit 42 experts to discover attacks anywhere in an organization. Threat hunters work on an organization’s behalf to discover advanced threats, such as state-sponsored attackers, cybercriminals, malicious insiders, and malware. 
*    Managed Detection and Response: Combines Cortex XDR with Unit 42's industry-leading threat intelligence to offer continuous 24/7 threat detection, investigation and response.

In the Forrester Wave™: Cybersecurity Incident Response Services, Q1 2022 Forrester noted that organizations “…seeking support in preparing for and responding to incidents in sprawling cloud environments should look at Palo Alto Networks.” 

**About Unit 42** 

Palo Alto Networks Unit 42 brings together world-renowned threat researchers, elite incident responders, and expert security consultants to create an intelligence-driven, response-ready organization passionate about helping you proactively manage cyber risk. Together, our team serves as your trusted advisor to help assess and test your security controls against the right threats, transform your security strategy with a threat-informed approach, and respond to incidents in record time so that you get back to business faster. 

Approved by Cybersecurity Insurance Plans Unit 42 is on the approved vendor panel of more than 70 major cybersecurity insurance carriers. If you need to use Unit 42 services in connection with a cyber insurance claim, Unit 42 can honor any applicable preferred panel rate in place with the insurance carrier. For the panel rate to apply, just inform Unit 42 at the time of the request for service. 

Under Attack? Get in touch with the Unit 42 Incident Response team at start.paloaltonetworks.com/contact-unit42.html or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, UK: +44.20.3743.3660, APAC: +65.6983.8730, or Japan: +81.50.1790.0200. 

Follow Palo Alto Networks on Twitter, LinkedIn, Facebook and Instagram. 

**About Palo Alto Networks** 

Palo Alto Networks is the world’s cybersecurity leader. We innovate to outpace cyberthreats, so organizations can embrace technology with confidence. We provide next-gen cybersecurity to thousands of customers globally, across all sectors. Our best-in-class cybersecurity platforms and services are backed by industry-leading threat intelligence and strengthened by state-of-the-art automation. Whether deploying our products to enable the Zero Trust Enterprise, responding to a security incident, or partnering to deliver better security outcomes through a world-class partner ecosystem, we’re committed to helping ensure each day is safer than the one before. It’s what makes us the cybersecurity partner of choice. 

At Palo Alto Networks, we’re committed to bringing together the very best people in service of our mission, so we’re also proud to be the cybersecurity workplace of choice, recognized among Newsweek’s Most Loved Workplaces (2021 and 2022), Comparably Best Companies for Diversity (2021), and HRC Best Places for LGBTQ Equality (2022). For more information, visit www.paloaltonetworks.com. 

Palo Alto Networks, Cortex, Cortex XDR, Cortex Xpanse, Prisma Cloud, Unit 42 and the Palo Alto Networks logo are trademarks of Palo Alto Networks, Inc. in the United States and in jurisdictions throughout the world. All other trademarks, trade names, or service marks used or mentioned herein belong to their respective owners. Any unreleased services or features (and any services or features not generally available to customers) referenced in this or other press releases or public statements are not currently available (or are not yet generally available to customers) and may not be delivered when expected or at all. Customers who purchase Palo Alto Networks applications should make their purchase decisions based on services and features currently generally available.

Palo Alto Networks Takes Aim At Cyberattacks With the Expansion of Unit 42's Digital Forensics & Incident Response Service Globally

Powered by Cribl, a CrowdStrike Falcon Fund partner, and available to CrowdStrike Falcon platform customers.

**AUSTIN, Texas and RSA Conference 2023, SAN FRANCISCO, April 24, 2023** – CrowdStrike (Nasdaq: CRWD) today introduced CrowdStream, powered by open observability company Cribl, which transforms how customers can get any data, from any security or IT source, directly into the CrowdStrike Falcon platform to solve XDR, log management and AI-based analytics challenges in a rapid, cost effective way.

Organizations struggle to get the complete visibility across the security and IT data sources needed to effectively stop increasingly sophisticated adversaries as they move across attack surfaces to breach organizations. Collecting and routing this siloed data is creating a heavy burden of complexity and cost, especially as data volumes continue to exponentially grow across ever-multiplying data sources.

CrowdStream is a new native platform capability that directly connects any data source into the CrowdStrike Falcon platform using Cribl’s observability pipeline technology. By sitting between data sources and their destination, CrowdStream provides an elegant and cost-effective way to get data into the CrowdStrike Falcon platform to greatly accelerate the adoption of XDR and log management, as well as aggregating the required data to train advanced AI/ML models.

CrowdStream transforms an organization’s ability to unify siloed security and IT data by:

• **Easily connect and rout****e** data from any source into the CrowdStrike Falcon platform, accelerating the adoption of XDR and log management by minimizing the complexity and cost of onoboarding data sources.

• **Unify data within the CrowdStrike Falcon platform for insights** and near-instant search at petabyte scale to provide the rich visibility and aggregated telemetry needed to eliminate threats, run deep analytics and hunt for adversaries.

• **Cut log management costs** by sending the right data (and only the right data) to a modern log management solution such as CrowdStrike Falcon LogScale. Recently, a large financial institution switched to CrowdStrike Falcon LogScale and saved at least $5 million dollars over three years in infrastructure and licensing costs.

• **Consolidate** point products by centralizing and normalizing data within the CrowdStrike Falcon platform to continuously address new security and IT use cases with fully integrated capabilities built on a unified data model.

“Cybersecurity is ultimately a data problem. Today’s adversary techniques are growing more sophisticated including the use of initial access, lateral movement, privilege escalation, defense evasion and data extortion. However, organizations are still struggling to effectively and efficiently collect the right data from a variety of security and IT point products they deploy to root out and shut down threats from adversaries,” said Michael Sentonas, president at CrowdStrike. “For organizations to stay ahead of these threats, it is imperative they have real-time visibility and data at their fingertips. We see the CrowdStream technology as a game-changer that significantly improves our customer’s ability to get the right data, from any source, directly into the CrowdStrike Falcon platform to solve the hardest security and IT challenges in an elegant, cost-effective way.”

“Cribl is a proud CrowdStrike Falcon Fund partner, as we were one of CrowdStrike’s first investments. We see this expanded strategic partnership with CrowdStrike as another step to solving the massive data problem that cybersecurity teams face today,” said Clint Sharp, co-founder and CEO, Cribl. “By making the process of data collection for the CrowdStrike Falcon platform easier, CrowdStream will revolutionize the way that organizations quickly gain value from XDR and log management.”

**Additional Resources**

• For more information on CrowdStream, please visit the CrowdStrike blog and Cribl website.

**About Cribl**

Cribl makes open observability a reality for today’s tech professionals. The Cribl product suite defies data gravity with radical levels of choice and control. Wherever the data comes from, wherever it needs to go, Cribl delivers the freedom and flexibility to make choices, not compromises. It’s enterprise software that doesn’t suck, enables tech professionals to do what they need to do, and gives them the ability to say “Yes.” With Cribl, companies have the power to control their data, get more out of existing investments, and shape the observability future. Founded in 2017, Cribl is a remote-first company with an office in San Francisco, CA. For more information, visit www.cribl.io or our LinkedIn, Twitter, or Slack community.

**About CrowdStrike**

CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with one of the world’s most advanced cloud-native platforms for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

CrowdStrike: We stop breaches.

CrowdStrike Introduces CrowdStream to Accelerate and Simplify XDR Adoption

The medical imaging firm's systems were compromised by a threat actor, exposing patients' driver's licenses and other identifying information.

An unauthorized actor gained access to the systems of Shields Health Care Group (SHCG) in March, exposing driver's license numbers as well as other identification information for more than 2.3 million patients, according to the company.

SHCG provides medical imaging services, MRI, and PET/CT scans, for ambulatory surgery centers. The company filed a data breach disclosure with the Maine Attorney General explaining the nature of the cybersecurity incident following its investigation.

"The investigation determined an unknown actor gained access to certain Shields systems from March 7, 2022, to March 21, 2022. Furthermore, the investigation revealed certain data was acquired by the unknown actor within that time frame," the company explained.

The company is sending out notices to those impacted and making identity monitoring services available, according to a sample disclosure letter shared with the Maine AG's office.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Shields Health Breach Exposes 2.3M Users' Data

Kim Jong Un's Swiss Army knife APT continues to spread its tendrils around the world, showing it's not intimidated by the researchers closing in.

Globally, interest has surged around North Korea's Kimsuky advanced persistent threat group (a.k.a. APT43) and its hallmarks. Still, the group is showing no signs of slowing down despite the scrutiny.

Kimsuky is a government-aligned threat actor whose main aim is espionage, often (but not exclusively) in the fields of policy and nuclear weapons research. Its targets have spanned the government, energy, pharmaceutical, and financial sectors, and more beyond that, mostly in countries that the DPRK considers arch-enemies: South Korea, Japan, and the United States.

Kimsuky is by no means a new outfit — CISA has traced the group's activity all the way back to 2012. Interest peaked last month thanks to a report from cybersecurity firm Mandiant, and a Chrome extension-based campaign that led to a joint warning from German and Korean authorities. In a blog published April 20, VirusTotal highlighted a spike in malware lookups associated with Kimsuky, as demonstrated in the graph below.

    

Volume of lookups for Kimsuky malware samples. Source: Virus Total

Many an APT has crumbled under increased scrutiny from researchers and law enforcement. But signs show Kimsuky is unfazed.

"Usually when we publish insights they'll go 'Oh, wow, we're exposed. Time to go underground,'" says Michael Barnhart, principal analyst at Mandiant, of typical APTs.

In Kimsuky's case, however, "no one cares at all. We've seen zero slowdown with this thing."

**What's Going on With Kimsuky?**

Kimsuky has gone through many iterations and evolutions, including an outright split into two subgroups. Its members are most practiced at spear phishing, impersonating members of targeted organizations in phishing emails — often for weeks at a time — in order to get closer to the sensitive information they're after.

The malware they've deployed over the years, however, is far less predictable. They've demonstrated equal capability with malicious browser extensions, remote access Trojans, modular spyware, and more, some of it commercial and some not.

In the blog post, VirusTotal highlighted the APT's propensity for delivering malware via .docx macros. In a few cases, though, the group utilized CVE-2017-0199, a 7.8 high severity-rated arbitrary code execution vulnerability in Windows and Microsoft Office.

With the recent uptick in interest around Kimsuky, VirusTotal has revealed that most uploaded samples are coming from South Korea and the United States. This tracks with the group's history and motives. However, it also has its tendrils in countries one might not immediately associate with North Korean politics, like Italy and Israel.

For example, when it comes to lookups — individuals taking an interest in the samples — the second most volume comes from Turkey. "This may suggest that Turkey is either a victim or a conduit of North Korean cyber attacks," according to the blog post.

    

Kimsuky malware sample lookups by country. Source: VirusTotal

**How to Defend Against Kimsuky**

Because Kimsuky targets organizations across countries and sectors, the range of organizations who need to worry about them is greater than most nation-state APTs.

"So what we've been preaching everywhere," Barnhart says, "is strength in numbers. With all these organizations around the world, it's important that we all talk to each other. It's important that we collaborate. No one should be operating in a silo."

And, he emphasizes, because Kimsuky uses individuals as conduits for greater attacks, everybody has to be on the lookout. "It's important that we all have this baseline of: don't click on links, and use your multi-factor authentication."

With simple safeguards against spear phishing, even North Korean hackers can be thwarted. "From what we're seeing, it does work if you actually take the time to follow your cyber hygiene," Barnhart notes.

North Korea's Kimsuky APT Keeps Growing, Despite Public Outing

An uptick in EvilExtractor activity aims to compromise endpoints to steal browser from targets across Europe and the US, researchers say.

A phishing campaign that launched in March and is actively targeting Microsoft operating system users in Europe and the US is making the rounds, using the EvilExtractor tool as its weapon of choice.

Research this week from FortiGuard Labs details the EvilExtractor attack chain, explaining that it usually starts with a legitimate-seeming Adobe PDF or Dropbox link, which instead deploy a malicious PowerShell when opened or clicked, before eventually leading to the modular EvilExtractor malware.

"Its primary purpose seems to be to steal browser data and information from compromised endpoints, and then upload it to the attacker’s FTP server," FortiGuard Labs researchers wrote.

The report points out that EvilExtractor was first developed by Kodex, which claimed that, despite its obvious name, it's used as an "educational tool,' according to the EvilExtractor report. "However, research conducted by FortiGuard Labs shows cybercriminals are actively using it as an info-stealer."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

'EvilExtractor' All-in-One Stealer Campaign Targets Windows User Data

While Intel is building more hardware protections directly into the chips, enterprises still need a strategy for applying security updates on these components.

Intel is taking a new tack with its latest commercial PC chips announced last month: Instead of touting speed and performance, the company is emphasizing the chip's security features.

The chip giant has been working with security vendors in recent years to implement hardware-level protections on the chips to protect laptops from ransomware and malware attacks. The new 13th Gen Intel Core vPro processors include under-the-hood improvements at the firmware and operating system levels that boost system protection and management, the company says.

Attackers will find it harder to compromise the firmware through hardware exploits because many of the new upgrades are in the chip's firmware and BIOS, and the chip's security layer contains prevention and detection capabilities. For example, there is a better handshake between the firmware and Microsoft's virtualization technology in Windows 11 to prevent intrusions, says Mike Nordquist, vice president and general manager of Intel Business Client Product Planning and Architecture. He notes that Hyper-V on Windows 11 works with vPro to store secrets and credentials in a virtual container.

"If you only have detection, you keep letting everyone in your front door. You are never really going to address the problem. You have to figure out how to close that front door," Nordquist says.

**Secure Enclaves on Chip**

Intel's vPro now provides the hooks for critical applications running on Windows 11 to be encrypted in memory through a feature called Total Memory Encryption-Multi-Key.

Microsoft provides the ability to encrypt storage drives, but it recently added the ability to encrypt data in memory. Intel's newer Core chips, code-named Raptor Lake, come ready for that feature; they have 16 memory slots in which applications can be encrypted, with separate keys needed to unlock the data.

The feature helps prevent side-channel attacks, which typically involve breaking into a chip and stealing unencrypted data from sources that include memory. Hackers would need a key to unlock the data, and isolating applications in 16 different slots makes it an even bigger challenge to steal data.

Applications are encrypted in virtual machines created in the memory slots, and system administrators can enable or disable the feature.

"We're not encrypting the entirety of the memory, because if you don't need to do it, it is basically going to impact performance," says Venky Venkateswaran, director of client product security and virtualization architecture and definition for Intel's Client Computing Group.

A new vPro technology to prevent security threats, TDT (threat detection technology), uses libraries baked into the chips to identify abnormal activity and security threats on a PC. The library assesses telemetry coming from CPUs that may be related to abnormal processing activity as a result of a security breach.

For example, the libraries can tell if a cryptocurrency mining application is calling on an abnormally high number of crypto instructions. That information is sent to security applications, which use that data in their engine to triage and stop threats.

The libraries have models tuned to weed out ransomware and other types of attack.

"We have low-level telemetry and an AI engine of sorts that can weed out the noise ... you don't want to have false positives," Venkateswaran says.

Intel is partnering with several antivirus vendors, including Microsoft, CrowdStrike, Eset, and Check Point Technologies, to integrate TDT features into security software. This way, the vendors get access to hardware telemetry to detect threats in virtual machines. For example, Eset Endpoint Security will be able to detect ransomware through Intel's performance monitoring unit (PMU), which sits underneath applications in the operating system.

**Patching Components**

Intel is working with PC makers to bring a standard methodology to patch PCs, and it is not putting all the eggs in one basket when it comes to securing systems. The focus is on establishing islands of security for different hardware components.

"There's no reason the BIOS needs to be able to have access to the OS memory. There is no value-add in it," Nordquist says. "So we actually deprivileged that at a base level ... and we did an enhanced level where we could really lock it down good. On vPro, that is a little bit better."

Attack vectors for PCs are different from servers and require a different security profile, he says.

"Before, PCs were designed to make sure the OS was protected. What if I want to protect something from the OS? What if I do not trust the hypervisor? I need the next level of security to deal with that," Nordquist says.

**Squashing Chip Bugs**

As a sign that Intel is serious about making hardware security a priority, the company last year awarded $935,751 in bug bounties to security researchers disclosing security flaws in its chips and firmware. The company has paid a total of $4 million since the inception of the program in 2017, according to its most recent annual security research report.

"These firmware updates are usually released on Intel's website, and the device vendor is responsible for distributing them. Some of them can be delivered automatically by Microsoft Windows Update, but only limited vendors can update their devices through it," says Alex Matrosov, founder of Binarly, whose firmware security platform helps people discover and patch hardware vulnerabilities. "CISOs should start paying more attention to threats and device ... security below the operating system. Every mature enterprise organization should invest in firmware security and specifically vulnerability management for their device security pasture."

Intel Prioritizes Security in Latest vPro Chips

Software written or acquired outside of IT's purview is software that IT can't evaluate for security or compliance.

There's no denying that software-as-a-service (SaaS) has entered its golden age. Software tools have now become essential to modern business operations and continuity. However, not enough organizations have implemented the proper procurement processes to ensure they're protecting themselves from potential data breaches and reputational harm.

A critical component contributing to concerns around SaaS management is the rising trend of shadow IT, which is when employees download and use software tools without notifying their internal IT teams. A recent study shows that 77% of IT professionals believe that shadow IT is becoming a major concern in 2023, with more than 65% saying their SaaS tools aren't being approved. On top of the obvious concerns around overspending and the disruptions to operational efficiency, organizations are beginning to struggle with maintaining security as their SaaS usage continues to sprawl.

Unfortunately, ignoring shadow IT is no longer an option for many organizations. Data breaches and other security attacks are costing businesses $4.5 million on average, with many of them taking place due to an expanding software landscape. To combat shadow IT and the high risks that come along with it, organizations must gain greater visibility over their SaaS stacks and institute an effective procurement process when bringing on new software solutions.

**Why Is Shadow IT Such a Liability?**

All issues surrounding shadow IT can be traced back to an organization's lack of visibility. An unmanaged software stack gives IT teams zero insight into how sensitive company information is being used and distributed. Since these tools are not vetted properly and are left unmonitored, the data they store is not adequately protected by most organizations.

This creates the perfect framework for hackers to easily seize important data, such as confidential financial records or personal details. Critical corporate data is at risk because most, if not all, SaaS tools require corporate credentials and access to an organization's internal network. A recent survey by Adaptive Shield and CSA actually shows that in the past year alone, 63% of CISOs have reported security incidents from this type of SaaS misuse.

**The Consequences of No Action**

As stated prior, the recurring theme that many businesses are experiencing with shadow IT is the risk associated with a data breach. However, it is equally important to realize the potential industry scrutiny that businesses face and the penalties they receive from regulators because of sprawling shadow IT. When unapproved software is added to an organization's tech stack, it likely fails to meet compliance standards — such as the General Data Protection Regulation (GDPR), the Federal Information Security Management Act (FISMA) and the Health Insurance Portability and Accountability Act (HIPAA) — that businesses must maintain. For organizations in strict regulatory industries, the consequences of being penalized for compliance failures can cause irreparable reputation damage — a problem that cannot be fixed simply by paying the fee associated with the penalty.

On top of the costs associated with a security failure and the reputational damage a business receives, organizations are also oblivious to the wasted operational dollars spent on applications and tools. Unfortunately, it can be almost impossible for large organizations to uncover all the applications that the company never sanctioned due to complications like rogue subteams, departments self-provisioning their own software, or employees using corporate credentials to access freemium or single-seat tools.

**So How Do We Fix the Shadow IT Dilemma?**

The crucial first step for rectifying an organization's SaaS sprawl and ensuring that shadow IT never puts you in a compromising position is to gain visibility into the existing software stack. Without visibility, an organization will be blind to which tools are being used and won't be able to make informed decisions about centralizing its software. IT teams should focus on bringing their software portfolio's documentation up to speed and making records of application functions, software utilization, the contract/subscription length of each tool, and cost.

Once access for this information is received and properly updated, IT teams can establish which tools are essential and where changes can be made. After cleaning house, businesses can then create a centralized procurement system to ensure that all future purchases are coordinated across departments and that all security measures or compliance standards are continuously being met to prevent security breaches and regulation penalties. Having these records will help organizations easily keep track of all usage, therefore minimizing wasted costs and security failures.

The hardest obstacle for companies feeling the impact of shadow IT and overall SaaS sprawl is to recognize that you have a software management issue and come up with a solution to tackle the problem. Between economic pressure and regulatory scrutiny, organizations no longer have the luxury to ignore the growing concern of shadow IT and the types of software they use.

Shadow IT, SaaS Pose Security Liability for Enterprises

Attackers have their methods timed to the second, and they know they have to get in, do their damage, and get out quickly. CISOs today must detect and block in even less time.

It may not be fair to say that incident response (IR) is the essence of an enterprise's cybersecurity strategy, but it is what everything else is building toward. However, the biggest opponent of IR is not as much attackers as it is time.

The bad guys, often aided by machine learning (especially in state-actor attacks), are ultrafocused. Cyberattackers today have a precise attack plan. Typically, they will be prepared to steal what they are looking for — or to damage systems — in a few minutes and then quickly exit the system.

Although some attackers prefer a stealthy means that installs malware and watches network activity for potentially months, many of the nastiest criminals today use a hit-and-run approach. That means an IR plan must identify what is going on, lock down ultrasensitive systems, and trap the attacker in moments. Speed may not be everything, but it's close.

Complicating the current IR environment is the fact that enterprise threat landscapes have gotten exponentially more complex in recent years, especially in terms of being porous as well as giving bad guys far more places to hide. Beyond the WAN and company systems, there are the shrinking — but still relevant — on-premises systems, a large number of cloud environments (both known and unknown), IoT/IIoT, partners with far greater access, home offices with insecure LANs, vehicle fleets with their own data retention and IP addresses, mobile devices with full credentials (often owned by employees, raising more security concerns), and SaaS apps that are hosted in systems with unknown holes of their own.

With all of that happening, the security operations center (SOC) may have mere minutes to identify and deal with a breach.

The biggest CISO problem with IR is a lack of preparation, and the biggest IR enterprise weakness today is foundational. The best processes for IR begin with readiness via building a solid organizational threat model and reconciling the threat library of things that could adversely affect the company with an alignment to what preventative, detective, and reactive controls are present against the attack surface of that threat model. Employing automation via security orchestration, automation, and response (SOAR) technologies has become highly useful in reducing response times and being able to leverage playbooks that get triggered upon certain defined conditions being met in the technical environment.

**Check the Map**

One of the most critical foundational elements is working from a current, accurate, and comprehensive data map. The problem is that today's environments make having a truly complete data map impossible.

Consider the mobile factor alone. Employees and contractors are constantly creating new intellectual property (a series of emails or texts, for example, between a sales rep and a customer or prospect) via mobile devices and then not syncing that information with centralized systems controlled by IT.

Because it's impossible to protect that which you don't know exists, generating as accurate a data map as possible is critical. It wouldn't hurt to also increase the visibility of all tools, platforms, hardware/devices (especially IoT), and anything else that an attacker could subvert.

Continuous attack surface management (CASM) has been an evolving area of security activities that companies need to mature to ensure that edge devices, particularly those that are IoT devices that may have direct access to the edge gateway, are adequately protected with detective controls.

You need to start with traditional asset management strategies, identifying all components and tracing all assets, regardless of whether they're in a rack somewhere or in a colocation. For too many enterprises, there is no comprehensiveness, no proper governance. They need to match assets and data with each line of business to plot out sustainability for that LOB. They need to figure out everything from IoT devices to third-party vendor software. There are so many things that often exist below the radar. What is the ecosystem for each and every product line?

**The Vertical Dimension**

Beyond that one enterprise, attack surface and the threat landscape must be identified for any verticals where the machine operates and often it has to drill into any and all subindustries. That forces a strict evaluation of what threat intelligence is being used.

For industry/vertical data, that means integrating information sharing and analysis centers (ISACs) along with open source alerts, vendor notifications, the Cybersecurity and Infrastructure Security Agency (CISA) and the (National Vulnerability Database (NVD) and many others, song with internal SIEM data.

But all of that threat intel is powerful before an incident. Once an attack begins and the SOC staff is actively defending itself, threat intel can sometimes prove more of a distraction than a help. It's great before as well as after the attack, but not during.

Companies often undermine their IR speed and effectiveness by not giving the SOC team sufficient access as well as information. For example, audit logs often include the IP addresses of affected devices, but some logs only display an internal NAT address and SOC staff couldn't easily and quickly map public IP addresses to NAT IP addresses. That forced the SOC team — during an emergency — to reach out to the network infrastructure team.

Does the SOC team have access to all cloud environments? Are they listed as contacts for all colocation and cloud support staff?

It is common for security people to use military analogies — especially war references — when describing incident response strategies. Sadly, those analogies are more apt than I'd wish. Attackers today are using top-end machine learning systems and are sometimes financially backed by nation-states. Their systems are often more robust and modern than what enterprises use for defense. That means that today's IR strategies must use the ML tools to keep up. The attackers have their methods timed to the second, and they know they have to get in, do their damage, exfiltrate their files, and get out quickly. CISOs today must detect and block in even less time.

The Tangled Web of IR Strategies

**SANTA CLARA, Calif.****,** **April 20, 2023** **/PRNewswire/ --** Infoblox Inc. the company that delivers a simplified, cloud- enabled networking and security platform for improved performance and protection, today published a threat report blog on a remote access trojan (RAT) toolkit with DNS command and control (C2). The toolkit created an anomalous DNS signature observed in enterprise networks in the U.S., Europe, South America, and Asia across technology, healthcare, energy, financial and other sectors. Some of these communications go to a controller in Russia.

Coined "Decoy Dog," Infoblox's Threat Intelligence Group was the first to discover this toolkit and is collaborating with other security vendors, as well as customers, to disrupt this activity, identify the attack vector, and secure global networks. The critical insight is that DNS anomalies measured over time not only surfaced the RAT, but ultimately tied together seemingly independent C2 communications. A technical analysis of Infoblox's findings is here.

"Decoy Dog is a stark reminder of the importance of having a strong, protective DNS strategy," said Renée Burton, Senior Director of Threat Intelligence for Infoblox. "Infoblox is focused on detecting threats in DNS, disrupting attacks before they start, and allowing customers to focus on their own business." 

As a specialized DNS-based security vendor, Infoblox tracks adversary infrastructure and can see suspicious activity early in the threat lifecycle, where there is "intent to compromise'' and before the actual attack starts. As a normal course of business, any indicators that are deemed suspicious are included in Infoblox's Suspicious domain feeds, direct to customers, to help them preemptively protect themselves against new and emerging threats.

**Threat Discovery, Anatomy & Mitigation:** 

*   Infoblox discovered activity from the remote access trojan (RAT) Pupy active in multiple enterprise networks in early April 2023. This C2 communication went undiscovered since April 2022.
*   The RAT was detected from anomalous DNS activity on limited networks and in network devices such as firewalls; not user devices such as laptops or mobile devices.
*   The RAT creates a footprint in DNS that is extremely hard to detect in isolation but, when analyzed in a global cloud-based protective DNS system like Infoblox's BloxOne® Threat Defense, demonstrates strong outlier behavior. Further it allowed Infoblox to tie the disparate domains together.
*   C2 communications are made over DNS and are based on an open-source RAT called Pupy. While this is an open-source project, it has been consistently associated with nation-state actors.
*   Organizations with protective DNS can mitigate their risk. BloxOne Threat Defense customers are protected from these suspicious domains.
*   In this case, Russian C2 domains were already included in the Suspicious domains feeds in BloxOne Threat Defense (Advanced) back in the fall of 2022. In addition to the Suspicious Domains feed, these domains have now been added to Infoblox's anti-malware feed.
*   Infoblox continues to urge organizations to block the following domains:

*   claudfront.net
*   allowlisted.net
*   atlas-upd.com
*   ads-tm-glb.click
*   cbox4.ignorelist.com
*   hsdps.cc

"While we automatically detect thousands of suspicious domains every day at the DNS level – and with this level of correlation, it's rare to discover these activities all originating from the same toolkit leveraging DNS for command-and-control," added Burton.

The Infoblox team is working around the clock to understand the DNS activity. Complex problems like this one highlight the need for an industry-wide intelligence-in-depth strategy where everyone contributes to understanding the entire scope of a threat.

For the full threat summary titled **"Dog Hunt: Finding Decoy Dog Toolkit via Anomalous DNS Traffic"** click here.

**About Infoblox's Threat Intelligence Group:**

The Threat Intelligence Group at Infoblox is dedicated to creating high fidelity "block-and-forget" domain name service (DNS) intelligence data for use in BloxOne Threat Defense. Core to Infoblox's protection strategy is the identification of suspicious domains. Infoblox's Threat Intelligence Group uses a patented machine learning algorithm to minimize the risk of enterprise outages while enabling maximum coverage of threats. Infoblox identifies suspicious domains through several **custom-built algorithms and DNS based threat hunting**.

The organization focuses on DNS and infrastructure actors. The team can identify suspicious behavior before its impact is known by the adjacent areas of the industry (endpoint, netflow vendors), and can track persistent actors to block their DNS infrastructure before it becomes a problem for our customers. Threat actors often register domains well in advance of using them for attacks, typically 14-120 days in advance, but we have seen domains held dormant for upwards of two years - like this case in point.

**About Infoblox** 

Infoblox unites networking and security to deliver unmatched performance and protection. Trusted by Fortune 100 companies and emerging innovators, we provide real-time visibility and control over who and what connects to your network, so your organization runs faster and stops threats earlier. Visit infoblox.com**, or follow-us on** LinkedIn or Twitter.

Source

DARKReading