Microsoft has stumbled through a series of major cybersecurity failures over the past few years. Experts say the US government’s reliance on its systems means the company continues to get a free pass.

When Microsoft revealed in January that foreign government hackers had once again breached its systems, the news prompted another round of recriminations about the security posture of the world’s largest tech company.

Despite the angst among policymakers, security experts, and competitors, Microsoft faced no consequences for its latest embarrassing failure. The United States government kept buying and using Microsoft products, and senior officials refused to publicly rebuke the tech giant. It was another reminder of how insulated Microsoft has become from virtually any government accountability, even as the Biden administration vows to make powerful tech firms take more responsibility for America’s cyberdefense.

That state of affairs is unlikely to change even in the wake of a new report by the Cyber Safety Review Board (CSRB), a group of government and industry experts, which lambasts Microsoft for failing to prevent one of the worst hacking incidents in the company’s recent history. The report says Microsoft’s “security culture was inadequate and requires an overhaul.”

Microsoft’s almost untouchable position is the result of several intermingling factors. It is by far the US government’s most important technology supplier, powering computers, document drafting, and email conversations everywhere from the Pentagon to the State Department to the FBI. It is a critical partner in the government’s cyberdefense initiatives, with almost unparalleled insights about hackers’ activities and sweeping capabilities to disrupt their operations. And its executives and lobbyists have relentlessly marketed the company as a leading force for a digitally safer world.

These enviable advantages help explain why senior government officials have refused to criticize Microsoft even as Russian and Chinese government-linked hackers have repeatedly breached the company’s computer systems, according to cybersecurity experts, lawmakers, former government officials, and employees of Microsoft’s competitors.

These people—some of whom requested anonymity to candidly discuss the US government and their industry’s undisputed behemoth—argue that the government’s relationship with Microsoft is crippling Washington’s ability to fend off major cyberattacks that jeopardize sensitive data and threaten vital services. To hear them tell it, Microsoft is overdue for oversight.

**A History of Breaches and Controversy**

Microsoft has a long track record of security breaches, but the past few years have been particularly bad for the company.

In 2021, Chinese government hackers discovered and used flaws in Microsoft’s email servers to hack the company’s customers, later releasing the flaws publicly to spark a feeding frenzy of attacks. In 2023, China broke into the email accounts of 22 federal agencies, spying on senior State Department officials and Commerce Secretary Gina Raimondo ahead of multiple US delegation trips to Beijing. Three months ago, Microsoft revealed that Russian government hackers had used a simple trick to access the emails of some Microsoft senior executives, cyber experts, and lawyers. Last month, the company said that attack also compromised some of its source code and “secrets” shared between employees and customers. On Thursday, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed that those customers included federal agencies, and issued an emergency directive warning agencies whose emails were exposed to look for signs that the Russian hackers were attempting to use login credentials contained in those emails.

These incidents occurred as security experts were increasingly criticizing Microsoft for failing to promptly and adequately fix flaws in its products. As by far the biggest technology provider for the US government, Microsoft vulnerabilities account for the lion’s share of both newly discovered and most widely used software flaws. Many experts say Microsoft is refusing to make the necessary cybersecurity improvements to keep up with evolving challenges.

Microsoft hasn’t “adapted their level of security investment and their mindset to fit the threat,” says one prominent cyber policy expert. “It’s a huge fuckup by somebody that has the resources and the internal engineering capacity that Microsoft does.”

The Department of Homeland Security’s CSRB endorsed this view in its new report on the 2023 Chinese intrusion, saying Microsoft exhibited “a corporate culture that deprioritized both enterprise security investments and rigorous risk management.” The report also criticized Microsoft for publishing inaccurate information about the possible causes of the latest Chinese intrusion.

The recent breaches reveal Microsoft’s failure to implement basic security defenses, according to multiple experts.

Adam Meyers, senior vice president of intelligence at the security firm CrowdStrike, points to the Russians’ ability to jump from a testing environment to a production environment. “That should never happen,” he says. Another cyber expert who works at a Microsoft competitor highlighted China’s ability to snoop on multiple agencies’ communications through one intrusion, echoing the CSRB report, which criticized Microsoft’s authentication system for allowing broad access with a single sign-in key.

“You don't hear about these types of breaches coming out of other cloud service providers,” Meyers says.

According to the CSRB report, Microsoft has “not sufficiently prioritized rearchitecting its legacy infrastructure to address the current threat landscape.”

In response to written questions, Microsoft tells WIRED that it’s aggressively improving its security to address recent incidents.

“We are committed to adapting to the evolving threat landscape and partnering across industry and government to defend against these growing and sophisticated global threats,” says Steve Faehl, chief technology officer for Microsoft’s federal security business.

As part of its Secure Future Initiative launched in November, Faehl says, Microsoft has improved its ability to automatically detect and block abuses of employee accounts, begun scanning for more types of sensitive information in network traffic, reduced the access granted by individual authentication keys, and created new authorization requirements for employees seeking to create company accounts.

Microsoft has also redeployed “thousands of engineers” to improve its products and has begun convening senior executives for status updates at least twice weekly, Faehl says.

The new initiative represents Microsoft’s “roadmap and commitments to answer much of what the CSRB report called out as priorities,” Faehl says. Still, Microsoft does not accept that its security culture is broken, as the CSRB report argues. “We very much disagree with this characterization,” Faehl says, “though we do agree that we haven’t been perfect and have work to do.”

**A Security Revenue ‘Addiction’**

Microsoft has earned special enmity from the cybersecurity community for charging its customers extra for better security protections like threat monitoring, antivirus, and user access management. In January 2023, the company touted that its security division had passed $20 billion in annual revenue.

“Microsoft has shifted to looking at cybersecurity as something that's meant to generate revenue for them,” says Juan Andrés Guerrero-Saade, associate vice president of research at security firm SentinelOne. His colleague Alex Stamos recently wrote that Microsoft’s “addiction” to this revenue “has seriously warped their product design decisions.”

These tensions exploded into the open in early 2021, as Congress and the new Biden administration scrambled to understand Russia’s far-reaching SolarWinds hacking campaign.

After breaching government networks through SolarWinds software, Moscow’s operatives fooled Microsoft’s cloud platform into granting them expansive access. Because most agencies weren’t paying for Microsoft’s premium service tier, they didn’t have the network activity logs necessary to detect these intrusions. Lawmakers were outraged that Microsoft was charging the government extra for such a basic feature, and Biden administration officials spent the next two and a half years privately urging Microsoft to make log data free for all customers. Microsoft finally agreed to do so last July—eight days after announcing yet another major hack, this one discovered by an agency paying for log data.

Microsoft won’t say if it plans to make other premium security features free for all of its customers. “We continue to raise the built-in security of our products and services to benefit customers,” Faehl says.

Asked about experts’ arguments that Microsoft’s strategy of profiting off of cybersecurity is incompatible with a security-first mindset, Faehl says, “We would disagree with that characterization.”

**A System That’s Everywhere**

Microsoft’s dominance has prompted concerns that it represents a single point of failure, concentrating America’s technology dependence in such a way that hackers could easily sabotage essential services by targeting one company’s products.

Few services better illustrate the government’s overwhelming dependence on Microsoft—and an area where some experts say a more diversified approach would be safer—than email. A former US cybersecurity official who works at one of Microsoft’s competitors predicts that an attack crippling Microsoft’s email platform would significantly reduce the government’s ability to operate.

Warnings about a Microsoft “monoculture” date back two decades, but the idea is now attracting new attention from policymakers.

“The US government’s dependence on Microsoft poses a serious threat to US national security,” says US senator Ron Wyden. “The government is effectively stuck with the company’s products, despite multiple serious breaches of US government systems by foreign hackers caused by the company’s negligence.”

Last Monday, Wyden announced draft legislation that would set a four-year deadline for the federal government to stop buying collaboration technology like Microsoft Office that critics say doesn’t integrate well with competing services.

Reducing the government’s reliance on a single vendor wouldn’t just benefit the government, experts say. It would also spread the attack risk across more companies, taking some of the pressure off of Microsoft to protect such a vast portfolio of systems. The giant target on Microsoft’s back makes it a magnet for cybercriminals and government hackers, which helps explain its outsize number of breaches.

The government’s reliance on Microsoft also entrenches a sense of familiarity with its products that cements its places in federal networks. While some agencies are exploring alternatives to Microsoft, most of them are sticking with what they know—largely because it’s easier than switching to an alternative platform, the former cyber official says.

Microsoft denies making it difficult for customers to switch to or incorporate competitors’ products. “Our competitors often stoke subjective complaints about ‘compatibility,’” Faehl says, but “we hear this more from the vendors of some third-party products” than from customers trying to use them.

Regardless, experts say, the upshot is clear: The government is dependent on Microsoft, robbing it of the leverage needed to push back on the company’s practices.

**Working the Refs**

Microsoft isn’t counting on its market dominance alone to defang government oversight. Since its antitrust battles with the government in the 1990s, the company has crafted a sophisticated public policy strategy that combines earnest calls to protect cyberspace with omnipresent participation in government initiatives.

“Microsoft is by far the slickest operation out there in tech when it comes to these issues,” says Andrew Grotto, a former senior White House cyber official who now leads Stanford University’s Program on Geopolitics, Technology, and Governance and consults for some of Microsoft’s competitors. “They learned this lesson 25 years ago and have been applying it ever since.”

Microsoft’s threat intelligence team, which knows more about malicious cyber activity than virtually any other company and most governments, regularly publishes research about cyber threats and collaborates with law enforcement on operations to dismantle hackers’ infrastructure. The company also helps fund groups like the CyberPeace Institute, which advocates for a safer internet and helps defend nongovernment organizations from hackers. And it has positioned itself as a helpful partner to policymakers who want to take on cyber issues but don’t know where to start, sometimes providing lawmakers with draft legislative language.

With its market dominance and political savvy, Microsoft has ensured that officials almost never publicly criticize it, experts say.

“The government's uncomfortable saying bad things about Microsoft because they're fully committed to them,” says Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, a think tank.

The Biden administration has spoken grandly about wielding the government’s formidable contracting power to force companies to improve their security. But with Microsoft, that leverage is nonexistent, experts say. “There is no realistic chance that the government will wholesale cancel its contracts with Microsoft,” Paul Rosenzweig, a cyber consultant and former DHS policy official, says in an email.

Microsoft disputes this argument. “The idea that the government is too dependent on Microsoft is at odds with reality,” Faehl says.

The government’s lack of leverage means federal officials never use the kind of blunt language found in the CSRB report when discussing Microsoft, even when they insist on speaking to reporters anonymously. The result is a remarkable display of government deference to Microsoft.

After Chinese hackers broke into government email systems and eluded agencies not paying for Microsoft’s premium security features, a senior official at CISA acknowledged that Microsoft’s business model was “not yielding the sort of security outcomes that we seek,” but they declined to directly rebuke Microsoft, instead sticking to talking points about productive conversations with the company.

In fact, despite Microsoft’s yearslong defiance of CISA’s high-profile push for companies to be “secure by design,” CISA has steadfastly refused to criticize Microsoft’s failures. When Microsoft finally bowed to pressure and made logs free last July, CISA director Jen Easterly said she was “extremely pleased with Microsoft’s decision.”

The former cyber official finds the government’s meekness remarkable. “When their own emails are stolen, they don’t seem to push back on the vendor who is the cause of that.”

The White House’s National Security Council declined to comment for this story. In a statement, Eric Goldstein, CISA’s executive assistant director for cybersecurity, says his agency “has a robust partnership with Microsoft and will continue to collaborate in many areas,” while also continuing to “impress upon all technology companies the urgency of developing products that are secure by design so that consumers can trust the safety and integrity of the technology that they use every day.”

Microsoft’s Faehl says his company is “committed to secure by design and secure by default.”

**Forcing Change**

The CSRB report on Microsoft’s cloud breach calls for dramatic changes to the company’s security culture. According to many experts, it’s time for the government to find its spine and compel those changes.

“Big, powerful companies in general don’t change their behavior unless they’re incentivized to do so,” Stanford University’s Grotto says.

The CSRB report recommends tough new requirements for cloud providers like Microsoft, including periodic security reviews after they receive federal contracts. Experts say those requirements could shift corporate incentives in favor of better security.

Microsoft seems to realize that its recent breaches have sparked a public relations crisis. “We expect and welcome fair scrutiny,” says Faehl. “As an industry leader we must be accountable for the security of our products and services.”

At the same time, he says, Microsoft “wouldn’t mind seeing some scrutiny” of its competitors who “seek to sow fear, uncertainty and doubt about our position as a way to seek advantage for their own products.”

Taking on Microsoft would also be a way for the Biden administration to live up to the principles in its National Cybersecurity Strategy, which prioritizes shifting the burden of cybersecurity onto large, well-resourced tech vendors. “They make the point … that this balance needs to shift,” Grotto says. “The question now is, ‘Okay, what does administration do with that diagnosis?’”

There are signs that the administration is heeding this advice. During a briefing with reporters on Thursday about the possibility that Russian operatives stole government secrets through their latest Microsoft hack, Goldstein said that CISA and other agencies are “are working closely with Microsoft, in alignment with the recommendations of the Cyber Safety Review Board, to drive further progress in Microsoft’s improvement plans with their broader security culture and enterprise.”

In the meantime, experts say, the status quo allows Microsoft to shirk responsibility for problems that it is uniquely capable of resolving.

“No harm comes from doing nothing, at least not to these companies,” Guerrero-Saade of SentinelOne says. “And that’s what’s going to destroy us.”

The US Government Has a Microsoft Problem

Cybersecurity researchers have discovered a "renewed" cyber espionage campaign targeting users in South Asia with the aim of delivering an Apple iOS spyware implant called LightSpy.
"The latest iteration of LightSpy, dubbed 'F_Warehouse,' boasts a modular framework with extensive spying features," the BlackBerry Threat Research and Intelligence Team said in a report published last

Chinese-Linked LightSpy iOS Spyware Targets South Asian iPhone Users

Plus: Apple warns iPhone users about spyware attacks, CISA issues an emergency directive about a Microsoft breach, and a ransomware hacker tangles with an unimpressed HR manager named Beth.

After months of delays, the US House of Representatives voted on Friday to extend a controversial warrantless wiretap program for two years. Known as Section 702, the program authorizes the US government to collect the communications of foreigners overseas. But this collection also includes reams of communications from US citizens, which are stored for years and can later be warrantlessly accessed by the FBI, which has heavily abused the program. An amendment that would require investigators to obtain such a warrant failed to pass.

A group of US lawmakers on Sunday unveiled a proposal that they hope will become the country’s first nationwide privacy law. The American Privacy Rights Act would limit the data that companies can collect and give US residents greater control over the personal information that is collected about them. Passage of such legislation remains far off, however: Congress has attempted to pass a national privacy law for years and has thus far failed to do so.

Absent a US privacy law, you’ll need to take matters into your own hands. DuckDuckGo, the privacy-focused company famous for its search engine, now offers a new product called Privacy Pro that includes a VPN, a tool for having your data removed from people-search websites, and a service for restoring your identity if you fall victim to identity theft. There are also steps you can take to wrench back some of the data used to train generative AI systems. Not all systems out there offer the option to opt out of data collection, but we have a rundown of the ones that do and how to keep your data out of AI models.

Data collection isn’t the only risk associated with AI advancements. AI-generated scam calls are becoming more sophisticated, with cloned voices sounding eerily like the real thing. But there are precautions you can take to protect yourself from getting swindled by someone using AI to sound like a loved one.

Change Healthcare’s ongoing ransomware nightmare appears to have gotten worse. The company was originally targeted by a ransomware gang known as AlphV in February. But after the hackers received a $22 million payment early last month, a rift appeared to grow between AlphV and affiliate hackers, who say AlphV took the money and ran without paying other groups that helped them carry out the attack. Now, another ransomware group, RansomHub, claims it has terabytes of Change Healthcare’s data and is attempting to extort the company. Service disruptions caused by the ransomware attack have impacted healthcare providers and their patients across the US.

That’s not all. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The streaming video service Roku warned customers Friday that 576,000 accounts had been compromised, a breach it discovered in the midst of its investigation of a far smaller-scale intrusion that it dealt with in March. Roku said that rather than actually penetrating Roku’s own network through a security vulnerability, the hackers had carried out a “credential-stuffing” attack in which they tried passwords for users that had leaked elsewhere, thus breaking into accounts where users had reused those passwords. The company noted that in less than 400 cases, hackers had actually exploited their access to make purchases with the hijacked accounts. But the company nonetheless reset users’ passwords and is implementing two-factor authentication on all user accounts.

**Apple Notifies Users of Mercenary Spyware Infections**

Apple sent notices via email to users in 92 countries around the world this week, warning them that they had been targeted by sophisticated “mercenary spyware” and that their devices may be compromised. The notice stressed that the company had “high confidence” in this warning and urged potential hacking victims to take it seriously. In a status page update, it suggested that anyone who receives the warning contact the Digital Security Helpline of the nonprofit Access Now and enable Lockdown Mode for future protection. Apple didn’t offer any information publicly about who the hacking victims are, where they’re located, or who the hackers behind the attacks might be, though in its blog post, it compared the malware to the sophisticated Pegasus spyware sold by the Israeli hacking firm NSO Group. It wrote in its public support post that it’s warned users in a total of 150 countries about similar attacks since 2021.

**CISA Warns Federal Agencies to Look Out for Russian Hackers Stealing Emails**

April continues to be the cruelest month for Microsoft—or perhaps Microsoft’s customers. On the heels of a Cybersecurity Review Board report on Microsoft’s previous breach by Chinese state-sponsored hackers, the Cybersecurity and Infrastructure Security Agency (CISA) published a report this week warning federal agencies that their communications with Microsoft may have been compromised by a group known as APT29, Midnight Blizzard, or Cozy Bear, believed to work on behalf of Russia’s SVR foreign intelligence agency. “Midnight Blizzard’s successful compromise of Microsoft corporate email accounts and the exfiltration of correspondence between agencies and Microsoft presents a grave and unacceptable risk to agencies,” CISA said in the emergency directive. As recently as March, Microsoft said that it was still working to expel the hackers from its network.

**When a Ransomware Hacker Calls a Victim Company’s Front Desk**

As ransomware hackers seek new ways to bully their victims into giving in to their extortion demands, one group tried the novel approach of calling the front desk of the company it had targeted to verbally threaten its staff. Thanks to one HR manager named Beth, that tactic ended up sounding about as threatening as a clip from an episode of _The Office_.

TechCrunch describes a recording of the conversation, which a ransomware group calling itself Dragonforce posted to its dark-web site in a misguided attempt to pressure the victim company to pay. (TechCrunch didn’t identify the victim.) The call starts like any tedious attempt to find the right person after calling a company’s publicly listed phone number, as the hacker waits to speak to someone in “management.”

Eventually, Beth picks up and a somewhat farcical conversation ensues as she asks that the hacker explain the situation. When he threatens to make the company’s stolen data available for “fraudulent activities and for terrorism by criminals,” Beth responds “Oh, ok,” in an altogether unimpressed tone. She then asks if the data will be posted to “Dragonforce.com.” At another point, she notes to the increasingly frustrated hacker that recording their call is illegal in Ohio, and he responds, “Ma’am, I am a hacker. I don’t care about the law.” Finally, Beth refuses to negotiate with the hacker with a “Well, good luck,” to which the hacker responds, “Thank you, take care.”

Roku Breach Hits 567,000 Users

But just how the government differentiates its platform from similar private-sector options remains to be seen.

Source: Bits And Splits via Shutterstock

The US Cybersecurity and Infrastructure Security Agency (CISA) has given organizations a new resource for analyzing suspicious and potentially malicious files, URLs, and IP addresses by making its Malware Next-Gen Analysis platform available to everyone earlier this week.

The question now is how organizations and security researchers will use the platform and what kind of new threat intelligence it will enable beyond what is available via VirusTotal and other malware analysis services.

The Malware Next-Gen platform uses dynamic and static analysis tools to analyze submitted samples and determine if they are malicious. It gives organizations a way to obtain timely and actionable information on new malware samples, such as the functionality and actions a string of code can execute on a victim system, CISA said. Such intelligence can be crucial to enterprise security teams for threat hunting and incident response purposes, the agency noted.

"Our new automated system enables CISA's cybersecurity threat hunting analysts to better analyze, correlate, enrich data, and share cyber threat insights with partners," said Eric Goldstein, CISA's executive assistant director for cybersecurity, in a prepared statement. "It facilitates and supports rapid and effective response to evolving cyber threats, ultimately safeguarding critical systems and infrastructure."

Since CISA rolled out the platform last October, some 400 registered users from various US federal, state, local, tribal, and territorial government agencies have submitted samples for analysis to Malware Next-Gen. Of the more than 1,600 files that users have submitted so far, CISA identified about 200 as suspicious files or URLs.

With CISA's move this week to make the platform available to everyone, any organization, security researcher, or individual can submit malicious files and other artifacts for analysis and reporting. CISA will provide analysis only to registered users on the platform.

Jason Soroko, senior vice president of product at certificate lifecycle management vendor Sectigo, says the promise of CISA's Malware Next-Generation Analysis platform lies in the insight it can potentially provide. "Other systems concentrate on answering the question 'has this been seen before and is it malicious'," he notes. "CISA's approach might end up being prioritized differently to become 'is this sample malicious, what does it do, and has this been seen before'."

Several platforms — VirusTotal is the most widely known — are currently available that use multiple antivirus scanners and static and dynamic analysis tools to analyze files and URLs for malware and other malicious content. Such platforms serve as a sort of centralized resource for known malware samples and associated behavior that security researchers and teams can use to identify and assess risk associated with new malware.

How different CISA's Malware Next-Gen will be from these offerings remains unknown.

"At this time, the US government has not detailed what makes this different from other open source sandbox analysis options that are available," Soroko says. The access that registered users will get to analysis of malware targeted at US government agencies could be valuable, he says. "Getting access to CISA's in-depth analysis would be the reason to participate. It remains to be seen for those of us outside of the US government if this is better or the same as other open source sandbox analysis environments."

**Making a Difference**

Callie Guenther, senior manager, cyber threat research at Critical Start, says it's possible that some organizations might initially be a bit cautious about contributing samples and other artifacts to a government-run platform because of data confidentiality and compliance issues. But the potential upside from a threat intelligence standpoint could encourage participation, Guenther notes. "The decision to share with CISA will likely consider the balance between enhancing collective security and safeguarding sensitive information."

CISA can differentiate its platform and deliver more value by investing in capabilities that enable it to detect sandbox-evading malware samples, says Saumitra Das, vice president of engineering at Qualys. "CISA should try to invest in both AI-based classification of malware samples as well as tamper-resistant dynamic analysis techniques … that could better uncover \[indicators of compromise\]," he says.

A larger focus on malware targeting Linux systems would also be a big improvement, Das says. "A lot of the current focus is on Windows samples from EDR use cases but with \[Kubernetes\] and cloud-native migration happening, Linux malware is on the rise and are quite different in their structure," from Windows malware, he says.

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

CISA's Malware Analysis Platform Could Foster Better Threat Intel

Akamai joins a growing list of security vendors aiming to strengthen companies' DNS defenses.

Source: momius via Adobe Stock Photo

Attacks against the Domain Name System (DNS) are numerous and varied, so organizations have to rely on layers of protective measures, such as traffic monitoring, threat intelligence, and advanced network firewalls, to act in concert. With NXDOMAIN attacks on the rise, organizations need to strengthen their DNS defenses.

With the release of Shield NS53, Akamai joins a growing list of security vendors with DNS tools capable of defending against NXDOMAIN attacks. The new service extends Akamai's Edge DNS technologies in the cloud to on-premises deployments.

In an NXDOMAIN attack — also known as a DNS Water Torture DDoS attack — adversaries overwhelm the DNS server with a large volume of requests for nonexistent (hence the NX prefix) or invalid domains and subdomains. The DNS proxy server uses up most, if not all, of its resources querying the DNS authoritative server, to the point where the server no longer has the capacity to handle any requests, legitimate or bogus. More junk queries hitting the server means more resources — server CPU, network bandwidth, and memory — needed to handle them, and legitimate requests take longer to process. When people can't reach the website because of NXDOMAIN errors, that translates to potentially lost customers, lost revenue, and reputational damage.

NXDOMAIN has been a common attack vector for many years, and is becoming a bigger problem, says Jim Gilbert, Akamai's director of product management. Akamai observed 40% of overall DNS queries for its top 50 financial services customers contained NXDOMAIN records last year.

**Beefing Up DNS Protection**

While it is theoretically possible to defend against DNS attacks by adding more capacity — more resources means it takes larger and longer attacks to knock down the servers — it is not a financially viable or scalable technical approach for most organizations. But they can beef up their DNS protection in other ways.

Enterprise defenders need to make sure they understand their DNS environment. This means documenting where DNS resolvers are currently deployed, how on-premises and cloud resources interact with them, and how they make use of advanced services, such as Anycast, and DNS security protocols.

"There could be good compliance reasons that enterprises want to keep their original DNS assets on premises," says Akamai's Gilbert, noting that Shield NS53 allows enterprises to add protective controls while keeping existing DNS infrastructure intact.

Protecting DNS should also be part of an overall distributed denial-of-service (DDoS) prevention strategy, since many DDoS attacks begin with DNS exploits. Nearly two-thirds of DDoS attacks last year used some form of DNS exploits last year, according to Akamai.

Before purchasing anything, security managers need to understand both the scope and limitations of the potential solution they are evaluating. For example, while Palo Alto's DNS security services cover a wide collection of DNS exploits besides NXDOMAIN, customers get that broad protection only if they have the vendor's next generation firewall and subscribe to its threat prevention service.

DNS defenses should also tie into a robust threat intelligence service so that defenders can identify and respond quickly to potential attacks and reduce false positives. Vendors such as Akamai, Amazon Web Services, Netscout, Palo Alto, and Infoblox operate large telemetry-gathering networks that help their DNS and DDoS protection tools spot an attack.

The Cybersecurity and Infrastructure Security Agency has put together a series of recommended actions that includes adding multifactor authentication to the accounts of their DNS administrators, as well as monitoring certificate logs and investigating any discrepancies.

**About the Author(s)**

Contributing Writer

David Strom is one of the leading experts on network and Internet technologies and has written and spoken extensively on topics such as cybersecurity, VOIP, convergence, email, cloud computing, network management, Internet applications, wireless and Web services for more than 35 years. He was the editor-in-chief of Network Computing print, Digital Landing.com, and Tom's Hardware.com. He has written two computer networking books and appeared on a number of TV and radio shows explaining technology concepts and trends. He regularly blogs at https://blog.strom.com, and is president of David Strom Inc.

New Tool Shields Organizations From NXDOMAIN Attacks

The US House of Representatives voted on Friday to extend the Section 702 spy program. It passed without an amendment that would have required the FBI to obtain a warrant to access Americans’ information.

A controversial US wiretap program days from expiration cleared a major hurdle on its way to being reauthorized.

After months of delays, false starts, and interventions by lawmakers working to preserve and expand the US intelligence community’s spy powers, the House of Representatives voted on Friday to extend Section 702 of the Foreign Intelligence Surveillance Act (FISA) for two years.

Legislation extending the program—controversial for being abused by the government—passed in the House in a 273–147 vote. The Senate has yet to pass its own bill.

Section 702 permits the US government to wiretap communications between Americans and foreigners overseas. Hundreds of millions of calls, texts, and emails are intercepted by government spies each with the “compelled assistance” of US communications providers.

The government may strictly target foreigners believed to possess “foreign intelligence information,” but it also eavesdrops on the conversations of an untold number of Americans each year. (The government claims it is impossible to determine how many Americans get swept up by the program.) The government argues that Americans are not themselves being targeted and thus the wiretaps are legal. Nevertheless, their calls, texts, and emails may be stored by the government for years, and can later be accessed by law enforcement without a judge’s permission.

The House bill also dramatically expands the statutory definition for communication service providers, something FISA experts, including Marc Zwillinger—one of the few people to advise the Foreign Intelligence Surveillance Court (FISC)—have publicly warned against.

“Anti-reformers not only are refusing common-sense reforms to FISA, they’re pushing for a major expansion of warrantless spying on Americans,” US senator Ron Wyden tells WIRED. “Their amendment would force your cable guy to be a government spy and assist in monitoring Americans’ communications without a warrant.”

The FBI’s track record of abusing the program kicked off a rare détente last fall between progressive Democrats and pro-Trump Republicans—both bothered equally by the FBI’s targeting of activists, journalists, and a sitting member of Congress. But in a major victory for the Biden administration, House members voted down an amendment earlier in the day that would’ve imposed new warrant requirements on federal agencies accessing Americans’ 702 data.

“Many members who tanked this vote have long histories of voting for this specific privacy protection,” says Sean Vitka, policy director at the civil-liberties-focused nonprofit Demand Progress, “including former speaker Pelosi, Representative Lieu, and Representative Neguse.”

The warrant amendment was passed earlier this year by the House Judiciary Committee, whose long-held jurisdiction over FISA has been challenged by friends of the intelligence community. Analysis by the Brennan Center this week found that 80 percent of the base text of the FISA reauthorization bill had been authored by intelligence committee members.

“Three million Americans' data was searched in this database of information,” says Representative Jim Jordan, chair of the House Judiciary Committee. “The FBI wasn't even following its own rules when they conducted those searches. That's why we need a warrant.”

Representative Mike Turner, who chairs the House Intelligence Committee, campaigned alongside top spy agency officials for months to defeat the warrant amendment, arguing they’d cost the bureau precious time and impede national security investigations. The communications are legally collected and already in the government's possession, Turner argued; no further approval should be required to inspect them.

“The United States is at its greatest risk of terrorism in more than a decade following the horrific October 7th attack on Israel, and the \[intelligence community\] must focus attention and resources on that threat while continuing to stay ahead of China,” Turner and Jim Himes, the top Democrat on the House Intelligence Committee, said in a joint statement after the vote, adding that 702 remains one of the country's most effective national security tools.

“It allows the United States to counter our adversaries, like China and Russia, thwart potential terrorist attacks from ISIS, Al-Qaeda, Hamas, and Hezbollah, and disrupt international drug cartels who are looking to smuggle fentanyl into our nation,” they said.

The FBI introduced a slate of new internal policies to clamp down on the abuse itself, changes that the Biden administration argues are sufficient to ward off future abuse. Knowingly searching the database for information about Americans requires analysts—who must now submit to annual training sessions—to seek approval from higher up the chain of command than before. Running batch queries targeting Americans’ communications now requires a consultation with a government attorney.

While opposing the search warrants, Turner backed a ban on searches of 702 data for criminal cases that lack any foreign element. While that amendment has been welcomed by members on both sides of the issue, privacy hawks say the ban is not quite the major reform that Turner has proclaimed. Data on the program made public by the FISC suggests the ban will in reality affect less than a handful of cases each year.

Critics of the program say that relying on the FBI to internally police against its own constitutional violations is a tactic that has failed in the past, and that the bureau can no longer be trusted not to spy on Americans without cause.

“Section 702 has been abused under presidents from both political parties, and it has been used to unlawfully surveil the communications of Americans across the political spectrum,” says Kia Hamadanchy, senior policy counsel at the American Civil Liberties Union. “The Senate must add a warrant requirement and rein in this out-of-control government spying.”

Judiciary members had also sought to include an amendment banning the government from buying Americans' geolocation data from private companies. At Turner’s behest, House speaker Mike Johnson killed the amendment earlier in the week.

The US Supreme Court has recognized geolocation data as protected from seizure by the “probable cause” standard. Rather than begin applying for warrants, the government has circumvented the ruling in many cases, buying up GPS data from companies that consumers largely believe are tracking them purely for advertising purposes.

“They’re buying data. That’s what they’re doing,” says Warren Davidson, a Republican congressperson from Ohio. “They’re structuring markets to collect the data and they’re circumventing the Fourth Amendment. We need to turn that off.”

House Votes to Extend—and Expand—a Major US Spy Program

Our collection of the most relevant reporting and industry perspectives for those guiding cybersecurity strategies and focused on SecOps. Also included: facing hard truths in software security, and the latest guidance from the NSA.

Source: Chroma Craft Media Group via Alamy Stock Photo

Welcome to CISO Corner, Dark Reading's weekly digest of articles tailored specifically to security operations readers and security leaders. Every week, we offer articles gleaned from across our news operation, The Edge, DR Technology, DR Global, and our Commentary section. We're committed to bringing you a diverse set of perspectives to support the job of operationalizing cybersecurity strategies, for leaders at organizations of all shapes and sizes.

**In this issue of CISO Corner**

*   The Race for AI-Powered Security Platforms Heats Up
    
*   Why MLBOMs Are Useful for Securing the AI/ML Supply Chain
    
*   The Fight for Cybersecurity Awareness
    
*   Ambitious Training Initiative Taps Talents of Blind and Visually Impaired
    
*   Vietnamese Cybercrime Group CoralRaider Nets Financial Data
    
*   XZ Utils Scare Exposes Hard Truths About Software Security
    
*   NSA Updates Zero-Trust Advice to Reduce Attack Surfaces
    

**The Race for AI-Powered Security Platforms Heats Up**

By Robert Lemos, Contributing Writer, Dark Reading

Microsoft, Google, and Simbian each offers generative AI systems that allow security operations teams to use natural language to automate cybersecurity tasks.

Both Google and Microsoft have committed massive resources to developing generative artificial intelligence (AI) tools for cybersecurity. Security Copilot from Microsoft can find breaches, gather, and analyze data with help from generative AI. Google's Gemini in Security is a similar rival service.

Now a startup has entered the fray, Simbian, with its own system that leverages generative AI as well as large language models (LLMs) to help security teams by automating configuring event management systems (SIEM) or security orchestration, automation, and response (SOAR).

While each offering has its own set of benefits, they all strive to streamline processes for strained cybersecurity teams. The question that has yet to be answered is whether teams will ultimately trust the automated systems to operate as intended.

Read more: The Race for AI-Powered Security Platforms Heats Up

Related: How AI and Automation Can Help Bridge the Cybersecurity Talent Gap

**Why MLBOMs Are Useful for Securing the AI/ML Supply Chain**

Commentary By Diana Kelley, CISO, Protect AI

A machine learning bill of materials (MLBOM) framework can bring transparency, auditability, control, and forensic insight into AI and ML supply chains.

The software bill of materials (SBOM) has become an essential tool for identifying the code that makes up an application, but in the age of artificial intelligence (AI) the SBOM has some limitations in machine learning frameworks.

A machine learning software bill of materials, or MLBOM, could fill the gaps left in a traditional SBOM and add protections to data and assets.

Read More: Why MLBOMs Are Useful for Securing the AI/ML Supply Chain

Related: Where SBOMs Stand Today

**  
The Fight for Cybersecurity Awareness**

Commentary By Erik Gross, CISO, QAD

Investing in cybersecurity skills creates a safer digital world for everyone.

Spreading awareness of risk is the best way to mitigate cybersecurity risk, but the task of constantly training and re-training people on the latest threats can be daunting. The age of artificial intelligence is making it even more difficult.

Building a culture of security is paramount, and it can be achieved with thoughtful cybersecurity training with a focus on a personal approach, storytelling, and helping people feel comfortable talking openly about cybersecurity. Humans are unpredictable, and a cybersecurity training process that accepts that humans are complex creatures have had the most success.

Read More: The Fight for Cybersecurity Awareness

Related: Q&A: The Cybersecurity Training Gap in Industrial Networks

**Ambitious Training Initiative Taps Talents of Blind and Visually Impaired**

By Jennifer Lawinski, Contributing Writer, Dark Reading

Novacoast's Apex Program prepares individuals with visual impairments for cybersecurity careers.

Blind and visually impaired (BVI) people are an untapped talent resource for cybersecurity companies struggling to attract talent. With just a computer outfitted with a screen reader and Braille keyboard, BVI people can become valuable contributors. Two cyber CEOs have launched Apex Program, an online, on-demand course for BVI people who want to break into cybersecurity.

So far, four students have completed the course and one has already landed a job as a SOC 1 Analyst. Now the White House is getting involved, and there's even a short film in the works featuring the Apex Program.

Read More: Ambitious Training Initiative Taps Talents of Blind and Visually Impaired

Related: 3 Ways Businesses Can Overcome the Cybersecurity Skills Shortage

**Vietnamese Cybercrime Group CoralRaider Nets Financial Data**

By Robert Lemos, Contributing Writer, Dark Reading

With a complex attack chain and using Telegram for its command and control, CoralRaider targets victims in Asian countries — and appears to have accidentally infected itself as well.

A newcomer on the Vietnamese cybercrime scene, a group called CoralRaider is making moves — and rookie mistakes like infecting their own systems — along the way.

Security researchers at Cisco Talos have been tracking CoralRaider's activities and found they are motivated by profit, even though the group is having trouble getting their operation off the ground. So far, Cisco Talos analysts haven't seen any indication CoralRaider has yet successfully delivered a payload, but the group is actively working to improve their cybercrime skills.

Read More: Vietnamese Cybercrime Group CoralRaider Nets Financial Data

Related: Ransomware, Junk Bank Accounts: Cyber Threats Proliferate in Vietnam

**  
XZ Utils Scare Exposes Hard Truths About Software Security**

By Jai Vijayan, Contributing Writer, Dark Reading

Much of the open source code embedded in enterprise software stacks comes from small, under-resourced, volunteer-run projects.

The backdoor recently discovered in the XZ Utils tool should be a wake-up call for cyber teams that open source repositories are riddled with vulnerabilities.

These projects are volunteer-run, under-resourced, and unable to keep up with the latest threats. XZ Utils is itself a one-person operation. Enterprises using code from these open sources do so at their own risk.

Organizations are advised to vet their use of code from public repositories and determine whether they have appropriate security controls. Experts also recommend having engineering and cybersecurity teams define processes and roles for onboarding open source code.

Read More: XZ Utils Scare Exposes Hard Truths About Software Security

**NSA Updates Zero-Trust Advice to Reduce Attack Surfaces**

By Dark Reading Staff

Agency encourages broader use of encryption, data-loss prevention, as well as data rights management to safeguard data, networks, and users.

In its ongoing effort to provide both the public, as well as the private, sectors with support in getting on a path to zero trust, the National Security Administration has issued guidance related to data protection, or as NSA categorizes it, the "data pillar." Recommendations from the agency include the use of encryption, tagging, labeling, and more.

Prior to this data security guidance, NSA provided a detailed guide to network macro- and micro-segmentation and its role in building up a zero-trust framework.

Read More: NSA Updates Zero-Trust Advice to Reduce Attack Surfaces

Related: NSA's Zero-Trust Guidelines Focus on Segmentation

CISO Corner: Securing the AI Supply Chain; AI-Powered Security Platforms; Fighting for Cyber Awareness

Change Healthcare ransomware hackers already received a $22 million payment. Now a second group is demanding money, and it has sent WIRED samples of what they claim is the company's stolen data.

For months, Change Healthcare has faced an immensely messy ransomware debacle that has left hundreds of pharmacies and medical practices across the United States unable to process claims. Now, thanks to an apparent dispute within the ransomware criminal ecosystem, it may have just become far messier still.

In March, the ransomware group AlphV, which had claimed credit for encrypting Change Healthcare’s network and threatened to leak reams of the company’s sensitive health care data, received a $22 million payment—evidence, publicly captured on Bitcoin’s blockchain, that Change Healthcare had very likely caved to its tormentors’ ransom demand, though the company has yet to confirm that it paid. But in a new definition of a worst-case ransomware, a _different_ ransomware group claims to be holding Change Healthcare’s stolen data and is demanding a payment of their own.

Since Monday, RansomHub, a relatively new ransomware group, has posted to its dark-web site that it has 4 terabytes of Change Healthcare’s stolen data, which it threatened to sell to the “highest bidder” if Change Healthcare didn’t pay an unspecified ransom. RansomHub tells WIRED it is not affiliated with AlphV and “can’t say” how much it’s demanding as a ransom payment.

RansomHub initially declined to publish or provide WIRED any sample data from that stolen trove to prove its claim. But on Friday, a representative for the group sent WIRED several screenshots of what appeared to be patient records and a data-sharing contract for United Healthcare, which owns Change Healthcare, and Emdeon, which acquired Change Healthcare in 2014 and later took its name.

While WIRED could not fully confirm RansomHub’s claims, the samples suggest that this second extortion attempt against Change Healthcare may be more than an empty threat. “For anyone doubting that we have the data, and to anyone speculating the criticality and the sensitivity of the data, the images should be enough to show the magnitude and importance of the situation and clear the unrealistic and childish theories,” the RansomHub contact tells WIRED in an email.

Change Healthcare didn’t immediately respond to WIRED’s request for comment on RansomHub’s extortion demand.

Brett Callow, a ransomware analyst with security firm Emsisoft, says he believes AlphV did not originally publish any data from the incident, and the origin of RansomHub’s data is unclear. “I obviously don't know whether the data is real—it could have been pulled from elsewhere—but nor do I see anything that indicates it may not be authentic,” he says of the data shared by RansomHub.

Jon DiMaggio, chief security strategist at threat intelligence firm Analyst1, says he believes RansomHub is “telling the truth and does have Change HealthCare’s data,” after reviewing the information sent to WIRED. While RansomHub is a new ransomware threat actor, DiMaggio says, they are quickly “gaining momentum.”

If RansomHub’s claims are real, it will mean that Change Healthcare’s already catastrophic ransomware ordeal has become a kind of cautionary tale about the dangers of trusting ransomware groups to follow through on their promises, even after a ransom is paid. In March, someone who goes by the name “notchy” posted to a Russian cybercriminal forum that AlphV had pocketed that $22 million payment and disappeared without sharing a commission with the “affiliate” hackers who typically partner with ransomware groups and often penetrate victims’ networks on their behalf.

Notchy’s post suggested that Change Healthcare faced an unprecedented situation: It had allegedly already paid a ransom, yet jilted partners of the gang extorting it still felt they were owed money—and still possessed Change Healthcare’s stolen data. RansomHub tells WIRED it is associated with notchy.

Now, RansomHub has claimed “the data remains with the affiliate,” and AlphV did not directly have the data originally. WIRED could not verify these claims. “For everyone speculating and theorizing on the situation, AlphV stole our share of the payment and performed an exit scam,” a RansomHub representative wrote to WIRED. “AlphV performed the exit scam before we get to the data deletion part.”

Callow says the incident reinforces that cybercriminals can’t be trusted to delete data, even when they are paid. For example, when a global law enforcement operation disrupted the notorious LockBit ransomware group, in February, police said they discovered that the cybercriminals still had data that investigators had paid to be deleted.

“Sometimes they use the undeleted data to extort victims for a second time, and the risk of re-extortion will only increase as law enforcement up their disruption efforts and throw the ransomware ecosystem into chaos,” Callow says. “What were always unpredictable outcomes will now be even more unpredictable.”

Similarly, DiMaggio says victims of ransomware attacks need to learn they can’t trust cybercriminals. “Victims need to understand that paying a criminal who promises to delete their data permanently is a myth,” DiMaggio says. “They are paying to have their data taken off the public side of the ransomware attackers data leak site. They should assume it is never actually deleted.”

UnitedHealth Group’s website says it is continuing to “make progress in mitigating the impact” of the attack and expanding financial assistance to health care providers that have been impacted. However, the attack has sent long-lasting ripples across medical facilities in the United States, demonstrating how disruptive ransomware attacks can be and the difficulties in restoring services. Clinicians and patients alike have been impacted, with extra strain being placed upon medical business owners.

On Wednesday, the American Medical Association said “serious disruptions continue” across physician practices. A survey of AMA members, conducted between March 26 and April 3, found 80 percent of clinicians had lost revenue and many are using their own personal finances to cover a practice’s expenses. Medical practitioners responding to the survey said they were heading toward bankruptcy, were struggling to “manage pain care” for cancer patients, and that procedures had been delayed. “Practices will close because of this incident,” Jesse M. Ehrenfeld, the president of the AMA said in a statement, “and patients will lose access to their physicians.”

In a message to WIRED, the RansomHub contact claims—for whatever the word of a ransomware gang is worth—that they are different from other cybercriminals, and if Change Healthcare pays them, they wouldn’t try to extort it again. “We will delete the data,” they write. “This data is a bomb for us. If we can't get payment, we have no choice but to sell it. Of course, if we can reach an agreement, it will be better to delete the data and throw the bomb away.”

Change Healthcare Faces Another Ransomware Threat—and It Looks Credible

Though Federal Civilian Executive Branch (FCEB) agencies are the primary targets, CISA encourages all organizations to up their security, given the high risk.

Source: Wachirawit Lemlerkchai via Alamy Stock Photo

The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive in response on April 11 to Midnight Blizzard, aka Cozy Bear, a Russian state-sponsored threat actor targeting Microsoft email accounts in its latest campaign.

The group is exfiltrating information from Microsoft corporate email systems to gain access to Microsoft customer systems. Microsoft and CISA have already determined which companies' correspondence has been exfiltrated so far and notified them accordingly.

"The initial access vector for the Midnight Blizzard attack was a Microsoft 365 password spray," said John Fokker, head of threat intelligence at Trellix, in an emailed statement. Researchers at Trellix have observed more than 120 of these kind of attacks in the first quarter of the year alone.

CISA's directive initially was issued solely to federal agencies on April 2. It required agencies to observe and analyze Microsoft email accounts to determine if they had been affected, reset compromised credentials, and secure any privileged Microsoft Azure accounts.

These requirements apply only to Federal Civilian Executive Branch (FCEB) agencies, since they seem to be Midnight Blizzard's biggest target. But CISA notes other organizations may also have been contacted and should seek assistance.

"Regardless of direct impact, all organizations are strongly encouraged to apply stringent security measures, including strong passwords, multifactor authentication (MFA), and prohibited sharing of unprotected sensitive information via unsecure channels," CISA said in its statement.

Jen Easterly, CISA's director, also noted that this Microsoft compromise is just the latest malicious cyber activity in the Russian playbook, and that the emergency directive is intended to ensure that the networks and systems of federal civilian agencies are secure.

CISA Issues Emergency Directive After Midnight Blizzard Microsoft Hits

Microsoft, Google, and Simbian each offers generative AI systems that allow security operations teams to use natural language to automate cybersecurity tasks.

Source: Ole.CNX via Shutterstock

When a major vulnerability shakes up the cybersecurity world — such as the recent XZ backdoor or the Log4j2 flaws of 2021 — the first question that most companies ask is, "Are we affected?" In the absence of well-written playbooks, the simple question can require a great deal of effort to answer.

Microsoft and Google are investing heavily in generative artificial intelligence (GenAI) systems that can turn large security questions into concrete actions, assist security operations, and, increasingly, take automated actions. Microsoft offers overworked security operations centers with Security Copilot, a GenAI-based service that can identify breaches, connect threat signals, and analyze data. And Google's Gemini in Security is a collection of security capabilities powered by the company's Gemini GenAI.

Startup Simbian is joining the race with its new GenAI-based platform for helping companies tackle their security operations. Simbian's system combines large language models (LLMs) for summarizing data and understanding native languages, other machine learning models to connect disparate data points, and a software based expert system based on security information culled from the Internet.

Where configuring a security information and event management system (SIEM) or a security orchestration, automation, and response (SOAR) system could take weeks or months, using AI cuts the time to — in some cases — seconds, says Ambuj Kumar, co-founder and CEO of Simbian.

"With Simbian, literally, these things are done in seconds," he says. "You ask a question, you express your goal in natural language, we break into steps code execution, and this is all done automatically. It's self sufficient."

Helping overworked security analysts and incident responders streamline their jobs is a perfect application for the more powerful capabilities of GenAI, says Eric Doerr, vice president of engineering at Google Cloud.

"The opportunity in security is particularly acute given the elevated threat landscape, the well publicized talent gap in cybersecurity professionals, and the toil that is the status quo in most security teams," Doerr says. "Accelerating productivity and driving down mean time to detect, respond, and contain \[or\] mitigate threats through the use of GenAI will enable security teams to catch up and defend their organizations more successfully."

**Different Starting Points, Different 'Advantages'**

Google's advantages in the market are evident. The IT and Internet giant has the budget to stay the course, the technical expertise in machine learning and AI from its DeepMind projects to innovate, and access to a lot of training data — a critical consideration for creating LLMs.

"We have a tremendous amount of proprietary data that we've used to train a custom security LLM — SecLM — which is part of Gemini for Security," Doerr says. "This is the superset of 20 years of Mandiant intelligence, VirusTotal, and more, and we're the only platform that has an open API — part of Gemini for Security — that allows partners and enterprise customers to extend our security solutions and have a single AI that can operate with all the context of the enterprise."

Like Simbian's guidance, Gemini in Security Operations — one capability under the Gemini in Security umbrella — will assist in investigations starting at the end of April, guiding the security analyst and recommending actions from within Chronicle Enterprise.

Simbian uses natural language queries to generate results, so asking, "Are we affected by the XZ vulnerability?" will produce a table of IP addresses of vulnerable applications. The systems also uses curated security knowledge gathered from Internet to create guidebooks for security analysts that show them a script of prompts to give to the system to accomplish a specific task.

"The guidebook is a way of personalizing or creating trusted content," says Simbian's Kumar. "Right now, we are creating the guidebooks, but once ... people just start to use it, then they can create their own."

**Strong ROI Claims for LLMs**

The returns on investment will grow as companies move from a manual process to an assisted process to autonomous activity. Most GenAI-based systems have advanced only to the stage of an assistant or copilot, when it suggests actions or takes only a limited series of actions, after gaining the users permissions.

The real return on investment will come later, Kumar says.

"What we are excited about building is autonomous — autonomous is making decisions on your behalf that are within the scope of guidance you have given it," he says.

Google's Gemini also seems to straddle the gap between an AI assistant and an automated engine. Financial services firm Fiserv is using Gemini in Security Operations for creating detections and playbooks faster and with less effort, and for helping security analysts quickly find answers using natural language search, boosting the productivity of security teams, Doerr says.

Yet trust is still an issue and a hurdle for increased automation, he says. To bolster trust in the system and solutions, Google remains focused on creating explainable AI systems that are transparent in how they come to a decision.

"When you use a natural language input to create a new detection, we show you the detection language syntax and you choose to run that," he says. "This is part of the process of building confidence and context with Gemini for Security."

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Tag

#intel