SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Microsoft Patch Tuesday
Microsoft's Patch Tuesday for October 2024 includes fixes for nearly 120 security issues, including at least two that are being actively exploited. One of the already-exploited vulnerabilities is a high-severity improper neutralization issue in Microsoft Management Console that can be exploited to achieve remote code execution. The second is a moderate severity improper input neutralization vulnerability in Windows MSHTML Platform that could lead to spoofing.
Editor's Notes
Microsoft also released patches for Office, Azure, .Net, OpenSSH for Windows, Power BI, Windows Hyper-V, Mobile Broadband and Visual Studio. In addition to Microsoft's updates, make sure to also deploy the updates to Chrome/Chromium as well as the macOS 15.0.1 update which corrected the flaw affecting security tools on that platform.
Mozilla Updates Firefox to Address Actively Exploited Critical Vulnerability
Mozilla has updated Firefox and Firefox ESR to address a critical use-after-free vulnerability in Animation timelines. Mozilla says the flaw is being actively exploited. The vulnerability is fixed in Firefox 131.0.2, Firefox ESR 115.16.1, and Firefox ESR 128.3.1. The vulnerability has prompted national cybersecurity centers in Canada, Italy, and the Netherlands to issue advisories.
Editor's Notes
- Slide 1 of 2
CVE-2024-9680 has a CVSS score of 9.8. Your standard Firefox deployments have likely already downloaded the update and just need a restart. You'll need to push the updated ESR. Not a bad time to see if you're ready to move from ESR 115 to 128 as your users are likely getting some old/unsupported browser warnings.
- Slide 2 of 2
Use-after-free vulnerabilities often point to poor secure software development practices by developers. What's interesting though is that Firefox has been relatively vulnerability-free these past few years, which speaks to good developer practices. Bottom line: if you're a Firefox user, simply restart your browser to get the latest update.
Slide 1 of 0- Slide 1 of 2
Education Sector 'Inherently Vulnerable' to Cyberattack
Nearly every quality of educational institutions puts them at "compounded" risk for cyberattack, according to an article by Microsoft Threat Intelligence. The breadth of data they process and services they provide; massive diversity in user age, IT literacy, profession, and level of involvement in various digital resources; and links to unsecure personal networks and devices, are only a few of the fundamental security challenges making education the "third-most targeted industry" for cyberattacks. The article also pinpoints the prevalence and ease of QR code phishing, an "openness and lack of controls" in email systems, and the risks of AI's place in school IT. Higher education presents unique "value and vulnerability" to attackers: "university presidents are effectively CEOs of healthcare organizations, housing providers, and large financial organizations," and universities often work with valuable intellectual property and sensitive research materials connected to government and defense applications. The authors note that defense is "more than a technology problem," and recommend "maintaining and scaling core cyberhygiene;" stressing the importance of risk awareness; exercising caution with QR codes; implementing protective domain name service; and educating users of all types while strengthening authentication practices.
Editor's Notes
- Slide 1 of 3
Historically, universities have had a security model designed to enhance seamless collaboration and data exchange, often with a security line around their "business" systems. In addition, education environments have a significant proportion of BYOD devices accessing and processing data. In short, the call is to make current security practices and awareness pervasive across the board. On a positive note, with all the attacks against them, schools are starting to implement their own SOC, often manned by students, which not only helps with the institution's security response, but also provides hands-on training for those entering the workforce.
- Slide 2 of 3
The article isn't surprising, at least not to cybersecurity professionals and the education sector. Let's cut to the chase: implement a cybersecurity program using a well-established framework like NIST CSF, ISO 27001, or CIS Critical Security Controls, and actively monitor your enterprise.
- Slide 3 of 3
During the Clinton administration, Dick Clarke, who was then the National Coordinator for Security, Infrastructure Protection, and Counter-terrorism for the National Security Council, told an audience of 25 college and university presidents that 75 percent of attack traffic could be traced back to open systems on their network and that if they did not fix it the government would. To their credit, the leadership of EDUCAUSE, and the example set by Stan Gatewood at both USC and Georgia, colleges and universities now have closed networks. They may still be targets but at least they are no longer tools of the rogues.
Slide 1 of 0- Slide 1 of 3
The Rest of the Week's News
OpenAI Observes and Bans Threat Actors
An October report from OpenAI details investigators' observation of ChatGPT and other AI tools in use by threat actors, allowing the company to both "disrupt" the activity and gain intelligence about intended techniques and targets. The report is an overview of case studies in which OpenAI models were used, sometimes by suspected state-affiliated hacking groups, for a wide assortment of "activity [that] ranged from debugging malware, to writing articles for websites, to generating content that was posted by fake personas on social media accounts," in many cases with intent to interfere in politics. Threat actors also prompted ChatGPT to suggest phishing lures designed to engage government employees, file names that would pass filters, and information about vulnerabilities in apps and "infrastructure belonging to a prominent car manufacturer.' OpenAI's disruption tactics amounted to banning accounts, monitoring for policy violations, building safeguards into models to refuse certain prompts, and sharing threat information. The company minimizes inherent security risk in the technology -- alleging it provides "shortcuts" rather than "novel capabilities" -- yet emphasizes the need for collaboration and "multi-layered defenses" against malicious use of AI models.
Editor's Notes
- Slide 1 of 2
There is a lot of 'nothing was being done that can't be done on non-AI search engines,' and 'we banned the bad actor accounts' and very little on 'we built safeguards in to prevent/make this harder the next bad actor.' This is very much like the early days of signature-based antiviral and IP address blocking for web security, which always remained reactive and could never keep up with threats.
- Slide 2 of 2
The report makes me wonder what operations by sophisticated actors went undetected. Don't get me wrong, it clearly shows that bad people are using generative AI for malicious purposes, but is that surprising to security professionals? The one positive: as the adversary continues to use genAI tools, the vendors learn and hopefully build better safeguards in their product.
Slide 1 of 0- Slide 1 of 2
CISA's Chief AI Officer: AI Tools Need to be Accompanied by Human Processes
At two recent events in Washington, DC, CISA chief AI officer Lisa Einstein spoke to the need for human processes while using AI tools. At the NVIDIA AI Summit, Einstein said: 'These tools are not magic, they are still imperfect, and they still need to have a human in the loop and need to be used in the context of mature cybersecurity processes.' And at the Recorded Future's Predict 2024 event, she noted: 'AI learns from data, and humans historically are really bad at building security into their code ~ The human processes for all of these security inputs are going to be the most important thing. Your software assurance processes, it's not going to be just fixed with some magical, mystical AI tool.'
Editor's Notes
- Slide 1 of 2
Skynet is still not self-aware, even though it's well past August 29, 1997. Point being that we're still going to be guiding and controlling our use of AI, keeping a hand on the tiller, using our judgement. We know AI accelerates and simplifies many tasks to date, such as creating code or writing a report, and we still need to review that code or writing to ensure it's what we think it is.
- Slide 2 of 2
It's the people. AI does not relieve the users, both individuals and institutions, of the responsibility for the purpose to which the computer is put and all the properties of the results.
Slide 1 of 0- Slide 1 of 2
Fidelity is Notifying 77,000+ Customers of Data Breach
Fidelity has begun notifying more than 77,000 people that an unauthorized third party stole their personal information several weeks ago. The data thief created two accounts and used them to access the information between August 17 and 19. A Fidelity spokesperson said the incident was not a ransomware attack and that no funds were taken.
Editor's Notes
- Slide 1 of 2
Two data breaches in the past six months indicates that Fidelity needs to conduct a complete review of its cybersecurity program. The focus of the review should be on security controls and data retention policies used by third party service providers.
- Slide 2 of 2
While this only affects around 77,000 customers, knowing that doesn't help much if you're a Fidelity customer. Although Fidelity is keeping details close, they are stating customer information was accessed, not customer accounts. Fidelity sent breach notification letters offering 24 months of credit monitoring and identity restoration service to affected customers. While this sorts itself, make sure that your individual Fidelity account has a strong password with multi-factor authentication enabled and review your account for any suspicious activity regularly. At the corporate level, make sure you are following current security best practices.
Slide 1 of 0- Slide 1 of 2
Qualcomm October 2024 Security Bulletin
Qualcomm's October 2024 Security Bulletin includes fixes for 20 vulnerabilities in their chipsets' firmware, including one that is being actively exploited. The high-severity use-after-free flaw in DSP service (CVE-2024-43047) was initially reported in July. The issue was detected by Google Project Zero and by researchers from Amnesty International, which indicates the vulnerability may have been exploited by state-sponsored threat actors and/or commercial surveillance tools. Other vulnerabilities addressed in the October release include a critical input validation flaw in the LAN resource manager (CVE-2024-33066) and two high-severity memory corruption flaws (CVE-2024-23369 and CVE-2024-33065).
Editor's Notes
CVE-2024-43047, CVSS score of 7.8, affects the FASTPRC driver. Due to the known exploits, this is listed in the NIST KEV with a due date of October 29th. The thing is these are embedded chipsets. Qualcomm has provided updates to OEMs, now they need to push the updates to our devices. Keep an eye out for out-of-band updates and make sure they get applied.
Marriott and Starwood Reach Breach Settlements with FTC, US States' AGs
Marriott International and their subsidiary Starwood Hotels have agreed to a proposed consent order that would serve as a settlement for several data breaches that affected more than 344 million people. Within 180 days of the effective date of the order, Marriott and Starwood must 'establish, implement and maintain a comprehensive information security program ('Information Security Program') that protects the security, confidentiality, and integrity of' customer data. In a separate, related action, Marriott has agreed to pay $52 million as part of a settlement with US states' Attorneys General.
Editor's Notes
- Slide 1 of 2
Once again the FTC is telling a business to get their security program in order. This goes back to breaches in 2015 and 2014, including a four-year compromise of the Starwood web servers which was not detected until 2018. Marriott needs to implement mandatory training, multi-factor authentication, and monitoring, and to follow more stringent reporting of future breaches as well as data minimization practices to reduce the impact of future breaches. Not a bad idea to make sure you're not over-collecting PII, that it is well protected, and that you're only storing it for the minimum possible time.
- Slide 2 of 2
Three comments: 1) Marriott International failed in its cybersecurity responsibilities and should be held accountable as they are with this consent order. 2) It is highly likely that Marriott International already has an information security (err cybersecurity) program. As such, they would benefit from reviewing the CIS 'Guide to Defining Reasonable Cybersecurity.' And 3) Is the biennial third-party assessment really of much value? In other words, should Marriott International suffer another breach any time within the next five years, they will be held accountable regardless of the assessment results. Perhaps put that money towards tools and training of the workforce.
Slide 1 of 0- Slide 1 of 2
Internet Archive Suffers Data Breach and DDoS Attack
A breach of the Internet Archive has compromised authentication information, including email addresses, screen names, and password hashes of 31 million users. Shortly after the breach was discovered, the site became the target of distributed denial-of-service (DDoS) attacks. The Internet Archive's founder Brewster Kahle posted on social media that they have disabled the JS library, scrubbed their systems, and are upgrading security.
Editor's Notes
Not a good day for the Internet Archive. Related or otherwise, the breach plus DDoS attack is a frustrating one-two punch. While most of us don't have 31 million user accounts, we need to make sure those accounts are all still active/needed, as well as reviewing our security settings and anti-DDoS provisions. While you're automating your checks, don't forget processes to make sure you're following current security standards as well as incorporating current and emerging threats.