SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
UK Water Utility Cyberattacks
According to information obtained from the UK's Drinking Water Inspectorate (DWI), drinking water suppliers have reported five cyberattacks since the beginning of 2024. In all, DWI has received 15 reports under Network and Information Systems (NIS) Regulations from suppliers since January 1, 2024. Of those, 10 were deemed not to be cyber-related; the other five were classified as "out-of-NIS-scope systems." Current NIS rules require formal reporting of cyber incidents that disrupt essential services; therefore, the detection of an intruder's presence on an IT system does not fall under the mandatory reporting guidelines. When the UK's Cyber Security and Resilience Bill is introduced in Parliament later this year, the high threshold for mandatory reporting is expected to be amended. Recorded Future News obtained the incident data from DWI under freedom of information laws.
Editor's Notes
- Slide 1 of 4
This story highlights a real gap between what is *technically* required and what is *actually* needed to stay safe. Today utilities only have to report cyber incidents if they interrupt service, but that means a lot of early warning signs never get shared. Hackers don’t usually start by turning off the water first; instead they poke around and learn about the target system. Catching and reporting those smaller intrusions could help everyone learn and prepare before the big one hits. The UK’s upcoming rule changes might finally start to close that gap.
- Slide 2 of 4
When it comes to required reporting, make sure you’re on the same page about what is and isn’t in scope. In this case the reporting of out of scope systems aids understanding the scope of the threat. Britain’s National Cyber Security Center reminds operators to protect against the mundane rather than exotic attacks. Focus on the basics first: segmentation, media control, MFA and best practices.
- Slide 3 of 4
All forms of critical infrastructure will continue to be targeted, some inadvertently, some deliberately. Regardless of any future legislation, government has to make the protection and resiliency of critical infrastructure a priority, mandating such to critical infrastructure providers. We’ve had enough near misses; the time to act is now.
- Slide 4 of 4
In the US we have thousands of water systems with no common regulatory authority. We need risk management that accounts for the consequences of the loss of water supply. Just for example, few hospitals can operate for more than an hour or two without external water supply.
Slide 1 of 0- Slide 1 of 4
European Commission is Funding Projects Focused on Grid Resilience; UDS Grid Operators Urged to "Unify" Physical and Cyber Security
The European Commission is focusing on improving power grid resilience, funding several projects including the eFORT framework, which is being developed by researchers at Netherlands Organisation for Applied Scientific Research (TNO) and the Delft University of Technology (TU Delft). According to the project's website, "eFORT will increase power system stability by developing technologies for identifying, preventing, and mitigating risks and vulnerabilities." TNO has also developed SOARCA, "an open-source tool that allows organisations to experiment with advanced technology to automatically repel cyber attacks, based on shareable security playbooks." The EU power grid is interconnected, with issues in one country easily leading to problems in others. For example, in April 2025, a series of cascading failures left Spain, Portugal, and parts of France without electricity, reminiscent of the 2015 Ukrainian power grid outage caused by a cyberattack. Additionally, power plant IT infrastructure is a unique assemblage of software, hardware, and operating systems from a variety of vendors who may be resistant to having cybersecurity professionals dig too deeply. In a separate, related story, power grid operators in the USD are increasingly being urged "to unify their cybersecurity and physical security strategies."
Editor's Notes
- Slide 1 of 2
Don’t forget about physical security when implementing and testing controls. I’m reminded of the power company that had an old control system in a remote shed which had been added to the corporate fiber backbone (for convenience) without ensuring the door locks were functional and appropriate.
- Slide 2 of 2
Europe’s new grid resilience projects show that the problem isn’t just about stopping hackers, it’s about keeping the lights on as power control systems become more connected and dependent on adjacent systems. The real issue is that many power systems still rely on older mismatched technology that was never designed to resist today’s advanced threats. Efforts like eFORT and SOARCA are steps toward automating defense, but the bigger challenge is cultural: convincing engineers, grid operators, and IT teams to work as one. Cyber and physical security teams must work together, because in a modern electrical grid, an attack on one side almost always affects the other.
Slide 1 of 0- Slide 1 of 2
South Dakota State Data Center Disruptions Traced to Mislabeled Wiring
Last week, South Dakota's Bureau of Information and Telecommunications Commissioner, Mark Wixon, testified before the state legislature’s Government Operations and Audit Committee about an August 2025 disruption of South Dakota's state government IT infrastructure. The incident began during the replacement of an uninterruptible power supply at the South Dakota State Data Center. The device tripped the data center's main breaker several times, ultimately damaging the device and necessitating its replacement. However, some switches were mislabeled, leading electricians to believe they were connected to that main breaker when they were in fact connected to a different breaker. The South Dakota Searchlight writes that "the mislabeling ultimately led to the torching of a critical, $80,000 network traffic controller switch and its backup." And the Aberdeen Insider notes that "Unbeknownst to electricians, multiple breakers were drawing power from the same source, causing surges that destroyed other equipment — including industrial-grade router systems that supply the state network used by the Department of Public Safety’s motor vehicles division, the Department of Revenue’s tax portal, and labor office services."
Editor's Notes
- Slide 1 of 3
We’ve all had multiple contractors working in our data centers, and power routing and requirements have changed since they were designed. In some cases, this is many updates ago. The question is: have you performed an independent validation/check of the work done? That’s likely cheaper than an outage or repair. Verify your as-built, labels, and documentation match. Recreate any of these if missing or in error.
- Slide 2 of 3
If you have done anything in IT long enough, you have been in those data centers with the amazing spaghetti wires in which any type of disconnect from a switch port means that switch port is gone to the wire gods. It could be so much worse: didn’t South Korea just have a mystery battery fire and have their data center burn down?
- Slide 3 of 3
Not your traditional cybersecurity incident by far. Doubtful that anyone would have scripted this as part of a periodic cybersecurity table-top exercise. The incident does serve as a good reminder that all aspects of physical security are equally important as part of one’s resiliency planning.
Slide 1 of 0- Slide 1 of 3
The Rest of the Week's News
Japan's OT Security Guidance for Semiconductor Manufacturers
Japan's Ministry of Economy, Trade and Industry has published Operational Technology (OT) security guidance for semiconductor manufacturers. The document states that because "[a] comprehensive framework for promoting security measures across the entire semiconductor industry has not yet been established in Japan ... it is urgent to present guidelines for factory security measures by taking into account the status of security measures being implemented within the domestic semiconductor industry and other relevant factors, while maintaining consistency with various security standards that have been established for the global semiconductor industry." The document references SEMI's E187 and E188 standards, which address incorporating security into the development phase of new semiconductor manufacturing equipment and extending security to existing semiconductor manufacturing equipment. The Japanese guidance also references the US National Institute of Standards and Technology's (NIST's) Cybersecurity Framework Version 2.0 Semiconductor Manufacturing Profile, which "identifies five primary business and mission objectives for the semiconductor manufacturing sector": maintain environmental safety; maintain human safety; maintain production goals; maintain semiconductor quality; and protect sensitive information.
Editor's Notes
Where you have a choice, use a relevant standard you understand and that fits the scope of your system and abilities. Double down on one your regulator will accept. Talk to your peers about what they use, replicating rather than building controls from scratch. Leverage available current templates.
Australian Signals Directorate Warns of BADCANDY Webshell on Vulnerable Cisco IOS XE Devices
The Australian Signals Directorate (ASD) has published an advisory warning that "Cyber actors are installing an implant dubbed ‘BADCANDY’ on Cisco IOS XE devices that are vulnerable to CVE-2023-20198." While BADCANDY itself does not maintain persistence following reboots, if threat actors have obtained account credentials or other forms of authentication, they can still have access to the affected device or network. Variations of the attack have been detected as far back as 2023. Cisco released a software update to address the critical (CVSS 10.0) vulnerability in 2023; the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to the Known Exploited Vulnerabilities catalog on October 16, 2023, with a four-day mitigation window for Federal Civilian Executive Branch (FCEB) agencies.
Editor's Notes
- Slide 1 of 3
Given the time of year, this trick is no treat. While the flaw can be remotely exploited without authentication, you still need to check for unauthorized accounts, particularly those starting with “Cisco.” Make sure you’ve patched your IOS XE devices and are limiting access to the Web UI, ideally never from the internet.
- Slide 2 of 3
It’s disappointing that the Australian government has to issue an advisory for a vulnerability that was disclosed with a patch made available back in 2023. It speaks volumes about the state of cyber hygiene.
- Slide 3 of 3
While inefficient, patching may still be effective for the enterprise, but not for the population. There will always be devices that are not patched.
Slide 1 of 0- Slide 1 of 3
Vulnerabilities in Monitoring Software from IBM and Nagios
A pair of vulnerabilities in the KT1 component of ITM/ITCAM Agents IBM Tivoli Monitoring could be exploited by "remote attacker to traverse directories on the system [through maliciously-crafted URLs and] view, overwrite, or append to arbitrary files on the system." There is not a patch for these issues. Instead, admins need to configure the agents "to use only TLS for communication." Nagios released Nagios XI version 2026R1 in late September 2025; the update includes fixes for three critical OS command injection vulnerabilities. CVE-2025-34134 affects in the Business Process Intelligence (BPI) component; "successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain further control of the underlying host operating system." CVE-2025-34284 affects the WinRM plugin; "successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to modify configuration, exfiltrate data, disrupt monitoring operations, or execute commands on the underlying host operating system." CVE-2025-34286 affects the Core Config Manager (CCM) Run Check command; "successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain control of the underlying host operating system."
Editor's Notes
- Slide 1 of 3
The exploit requires an authenticated user to be successful, but don’t rely on that being a high bar. Nagios IX version 2026R1 was released in September, but the CVEs were only just published, so don’t panic, just get the update going. Fixing the IBM Tivoli KT1 flaw requires you to follow the IBM security advisory to convert communication to TLS only. You need IBM support credentials with appropriate access to read the remediation bulletin.
- Slide 2 of 3
Uh oh. Is there blood in the water with Monitor Software? I feel like there may be gremlins in some of the older Software Monitoring Solutions. Heck, it may exist in some of the more modern monitoring solutions. Will we be seeing a flurry of research around this? It almost the end of 2025, maybe 2026 will see the increase in these types of vulnerabilities.
- Slide 3 of 3
Given the power of modern processors and the current threat level, most communications should be encrypted by default.
Slide 1 of 0- Slide 1 of 3
Data Breach Observatory Launched by Proton
On Thursday, October 30, 2025, privacy-focused software company Proton AG launched the Data Breach Observatory, an online public catalog of major data breaches. Proton created the project in the interest of responsible transparency and awareness, citing risks to consumers and smaller businesses when inconsistent self-reporting means breaches may go undisclosed, hidden, or ignored. Constella Intelligence is collaborating with Proton on the Observatory, conducting research and near-real-time monitoring of the dark web for leaks. Eamonn Maguire, Proton's director of engineering, AI & ML, told The Register, "We're not simply republishing what criminals claim; we're applying validation layers before disclosure," stating that "a number of processes" will analyze and cross-reference findings; aggregated compilations will be passed over in favor of single-source information, and additional sources include "GDPR notifications, researchers, threat intelligence feeds, and journalistic investigations." So far, the Observatory has identified "794 breaches from identifiable sources, with more than 300 million records exposed," over 70 percent of which were small and medium-sized businesses, primarily in retail, technology, and media/entertainment sectors. 90 percent of breaches contained names and emails, 72 percent contained contact information, 49 percent contained passwords, and 24 percent contained IDs, health records, and other personally identifiable information (PII). Breaches in the Observatory are searchable by date, size, type and sensitivity of data, country, company, industry, and company size. Proton will "always inform [an] affected organization in advance of the information being published" to ensure organizations can protect themselves.
Editor's Notes
- Slide 1 of 2
Proton’s value add on dark web breach discovery is validation of breaches beyond just ingesting data from the dark web. This service is targeted to small businesses who are the top targets for breaches and typically don’t have access to or budget for the larger threat feeds and supporting analytics.
- Slide 2 of 2
So far, many companies feel their best option in case of a compromise is to ignore it. The chances of getting called out for the compromise or incurring any fines are rather small. As a result, the probability of compromise is often vastly underestimated, leading to misguided security investments. Maybe initiatives like this can lead to a little bit more accountability.
Slide 1 of 0- Slide 1 of 2
Denmark Steps Away from Chat Control
Denmark has withdrawn a bill that would have required service providers to scan all electronic communications, including those exchanged on end-to-end encrypted platforms, like WhatsApp. Dubbed Chat Control, the bill's stated goal was to reduce the trafficking of child abuse content. The European Commission introduced the bill in 2022. Denmark currently holds the Presidency of the Council of the European Union EU Council until the end of this calendar year. Denmark's Justice Minister says the country will support a voluntary measure for service providers to search for offending content. On October 8, Germany said it would not support the legislation. Poland and the Netherlands have also opposed the measure; France and Ireland support Chat Control.
Editor's Notes
- Slide 1 of 3
This is a step in the right direction. One hopes they and others similarly inclined realize the futility of a limited-scope encryption back door. Most likely countries that require such mechanisms will find the apps no longer work there rather than having delivery of the capability.
- Slide 2 of 3
In the past several years, email and chat service providers have moved to end-to-end encryption and don’t have the ability to scan for objectionable material. A bill like this would require the ability to decrypt any and all communications. Should the right to privacy of all Europeans, and potentially all users of these sorts of free services, be put at risk?
- Slide 3 of 3
We have so little actual privacy at this point with devices; adding another layer of decryption would be such a difficult thing. Let’s be clear, this stuff that they are dealing with is abhorrent. The problem is once you introduce decrypt ability to a platform it becomes a vector for the other actors to silence. Unfortunately, the rule of law is vastly different government to government. I have been on each side of this fence and I’m torn with “what is the right answer,” but what I always come back to is that introducing a crypto backdoor is not the answer.
Slide 1 of 0- Slide 1 of 3
Former Ransomware Responders Indicted for Extortion
Two former cybersecurity incident response professionals and an unnamed conspirator have been indicted by the US Department of Justice for conducting ransomware attacks against five US companies in 2023. Ryan Clifford Goldberg, a former incident response manager for Sygnia Cybersecurity Services, and Kevin Tyler Martin, a former ransomware threat negotiator for DigitalMint, are charged with conspiracy and interference with interstate commerce by extortion, and with intentional damage to protected computers. All three were employed at the time of the attacks but have since been terminated; while the unnamed "Co-Conspirator 1" is mentioned in the indictment and was also a DigitalMint ransomware negotiator, the filing only specifies charges for Goldberg and Martin. The trio attacked a medical device company in Florida, a pharmaceutical company in Maryland, a doctor's office and an engineering company in California, and a drone manufacturer in Virginia, all of which were engaged in interstate commerce. The conspirators deployed ALPHV BlackCat ransomware, extorting each organization for cryptocurrency in exchange for a decryption key and a promise not to publish stolen data. Only the medical device company paid the ransom, totaling approximately US$1,274,781.2 at the time. The conspiracy and extortion charges each carry a maximum sentence of 20 years in prison, and the intentional damage charge carries a maximum of 10 years; each charge carries up to US$250,000 in fines on top of forfeitures.
Editor's Notes
A clear case of ethical behavior failing or being suppressed by the perceived rewards of the attackers’ game, in this case becoming affiliates for the ALPHV/BlackCat Ransomware service. While DigitalMint and Sygnia terminated these guys as soon as their alleged involvement was detected, they will still be doing damage control and reputation repair for a bit. A question is, could you detect employees “going bad?” Do you ever recheck their background or watch for aberrations in behavior? This could be a good topic to run to ground with HR.