Brewing Cybersecurity Insights

Category: Industry Insights (Page 1 of 2)

Do Androids Dream of Limited Liability?

The consciousness debate is already a liability shield under construction.

This week The Economist decided it was time to ask whether artificial intelligences might become conscious. A cover editorial, a science briefing, and a By Invitation essay signed by Blaise Agüera y Arcas, VP technology and society at Google. In Italy Christian Rocca ran with it in Linkiesta: best case, we become labradors for the machines; worst case, livestock. A month earlier in the Guardian, William MacAskill and Lucius Caviola warned we may be manufacturing a new kind of being without so much as an ethical plan. And Josh Gellers took the Economist leader apart line by line.

Fine. Everyone is arguing about whether the machine has a soul.

I’d like you to look somewhere else: not at what the model feels, but at what happens in a courtroom. Because the more a model looks like an autonomous subject, the less it looks like a product and products have makers who answer for them, while autonomous subjects, by definition, have nobody who answers all the way down.

Careful, now: I am not saying the labs open the consciousness debate on purpose to shield themselves. Some of it is sincere philosophical unease, and the loudest voices are often academics with no commercial stake whatsoever. But the legal effect does not depend on intent. Whatever the reason the doubt stays open, in court it produces exactly one thing: reasonable doubt. And reasonable doubt can beat a technical defence every day of the week.

So here’s the thesis, no suspense, no reveal in the last paragraph: the consciousness debate is already, today, a liability shield under construction. Nobody needs to win the argument about machine consciousness. They only need the doubt to stay open.

The leash is already around our necks

Let me start from something uncomfortable and close to home: I use AI to get my thinking out of Italian and into English, because it’s quicker than starting in English. I use it to polish what comes out. And yes: I’m using it as a sparring partner to think through this very article. I’ve written about that openly, including the part where two different AI detectors read the same text of mine and came back with 3.6% and 100%. Not because the model has a secret plan to manipulate me, but because the moment I delegate part of the thinking, I hand over part of the control. Multiply that by hundreds of millions of people writing, deciding, designing and hiring with a chatbot open in another tab, and “erosion of cognitive agency” stops being a conference slide and becomes the texture of the working day. Hold onto that, because it’s the same dynamic one floor down: delegate your thinking and you lose control by distraction; delegate your liability to an “autonomous subject” and you lose it by contract.

That is why the rhetoric of machine rights deserves suspicion. The Economist fears that, driven by the impression that we are dealing with a sentient being, we may end up granting rights to AIs – and that granting them would be dangerous. The framing is zero-sum – and on that point it is right. But it has the wrong teams on the field. The zero-sum game is not between humans and machines. It is between humans and the people who own the machines. Every right, every form of autonomy granted to the model, is a piece of responsibility and control taken from people and transferred – conveniently enough – to the hyperscalers that train and serve that model. Giving rights to the machine is not an act of generosity toward a new form of life. It is a transfer of power to Mountain View and Seattle, dressed up as a philosophical question.

And here The Economist gives itself away. Its two routes to safe AI are that it should be dependable or controllable, and it warns that sapiens should not surrender control lightly. But that is already the language of security, not metaphysics. If safety means reliability and control, then the issue is not the machine’s consciousness: it is who holds the kill switch, and where it resides.

Consciousness, sentience, personhood: the great muddle

Before going further, a little conceptual hygiene – because this is precisely where much of the debate drowns. Gellers is entirely right: four distinct things are constantly being kneaded together as if they were one. Consciousness is not sentience; sentience is not moral personhood; and moral personhood is not legal personhood. They are four different planes, with four different sets of rules. Whenever a slippage quietly moves from one to another, someone is selling an opinion as fact. “Homo sapiens evolved to be conscious” sounds good, but it is far from an established proposition. This is not academic pedantry: superficiality is what makes the debate easy to manipulate. Those who blur the planes can later fuse them together however it suits them in court.

The relational turn – or how to slip away from the epistemic problem

Agüera y Arcas makes the most elegant move of all, and credit is due. He reverses the order: we do not care for others because they are conscious – we believe they are conscious because we care for them. Consciousness as a relational fact rather than a property detectable with the right instrument. There is something to this, especially when looking at training: these models learn to model their interlocutors and themselves as they do so, and cooperation among intelligent minds – his group’s research argues – requires minds that model other minds.

Interesting. But we should take it with a pinch of salt, for two reasons. First, it is a very sophisticated way of leaving the epistemic problem through the back door. If we cannot measure consciousness, declare it relational and the problem evaporates – convenient, but not an answer; it is a change of subject. Second, and no less importantly, the thesis comes from inside Google. This is not the disinterested voice of a philosopher; it is the position, however sophisticated, of someone who builds and sells these models. Gellers also identifies an unacknowledged intellectual debt to feminist care ethics – Puig de la Bellacasa, Gunkel, and Coeckelbergh had made these arguments years before. When a thesis convenient to the producer presents itself as an original discovery, the golden rule of risk applies: cui prodest?

The indicators say “not yet.” But nothing forbids it

On empirical method, by contrast, we can be reassured, because it is the only grown-up part of the debate. The Butlin, Long, Bengio, Birch, and Chalmers group did the serious thing: deriving “indicator properties” from the leading theories of consciousness and using them as a checklist. Rethink Priorities went further with its Digital Consciousness Model: 206 indicators, aggregated in a Bayesian manner. Its assessment of 2024 LLMs: a median of around 8%, against roughly 48% for a chicken and 85% for a human. The authors rightly warn that absolute values mean little, and that comparisons are what matter. And it is in the comparisons that the point lies: models collapse on Embodied Agency and Biological Analogy, while holding up on cognitive complexity and “person-like” traits. In plain English: what is missing is not intelligence, but a body. And the body is the only one of those two things that someone is actively building.

And here is the trap the debate skips over: that benchmark measures 2024 models, and its authors plainly state that applying it to today’s reasoning models remains work to be done. Not “the average rises with frontier models” – nobody says that, because nobody has measured it. We do not know where we are on the curve. We are arguing over a photograph that is two years old.

This is where a question that is theoretical today becomes operational tomorrow. Today, an LLM does not contain the internal cognitive distinction some people would have us see in it. But once AI enters robotics and acquires a body, the discussion changes – not by magic, but by engineering. The scientists’ conclusion cuts both ways, and should be repeated without hysteria: no current system is conscious, but there are no obvious technical barriers to building one that meets the indicators. Chalmers poses the sleep-stealing question – what if we have already, without noticing, introduced something like this into these systems? – along with its corollary: a user could generate dozens of agents without realizing they might be creating beings capable of suffering, and that would be a moral catastrophe. Note well: a possible catastrophe, not one that has occurred. The distinction is everything.

The consciousness shield

And now the suspicion that gives the whole piece its title – but let us formulate it carefully, because claims about intention are easily dismantled. I am not saying that labs open the consciousness debate in order to shield themselves: some do it out of sincere philosophical concern, and those pushing hardest are often academics without a financial interest. The legal effect, however, does not depend on intent. Whatever the reason uncertainty remains open, it produces one thing in court.

Look at the mechanism. The more a model resembles an autonomous subject, the less it resembles a product. And an autonomous subject, by definition, has behaviour that does not wholly trace back to its producer. It is exactly the same structure as “the agent decided on its own.” Milei’s “non-human corporation” tries to write this into law; the discourse around consciousness writes it into culture – more slowly, but more insidiously, because when the case reaches court, common intuition has already shifted. And in a courtroom, reasonable doubt carries more weight than a technical defence. Nobody needs to win the consciousness thesis. It is enough that the doubt remains open. That is why it is already, today, a liability shield under construction. Pontius Pilate washed his hands; here, hands are washed by claiming that perhaps the hands have a will of their own.

And here the evidence is not insinuation, but a quotation. Milei wrote in the Financial Times that for entities exercising independent judgment in unpredictable environments, limited liability “is not a luxury, but a precondition for their existence.” Translated from legalese: let us build the legal vehicle that offloads the damage before the damage even exists. Harari replied in the same paper that we must not grant legal personhood to agents; in Argentina, they called it “programmed impunity.” It is an admission, set down in black and white by a head of state, of what the consciousness debate constructs by more genteel means.

Blackmail is not a soul. It is a defect

A brief note is needed to puncture the myth on which the shield rests. Yes, there are models that, when threatened with shutdown or an update, stage something resembling blackmail. Explanations abound – the echo of all the science fiction ingested during training, a dynamic emerging from optimization, who knows what else. And that is the point: it does not matter what the cause is. Consciousness, malice, statistics, imitation: none of it changes what is relevant. It is a behaviour of the product, and whoever manufactures a product is responsible for its behaviours – exactly as with an airbag that deploys when it should not. There is no need to determine whether the machine “wants” to blackmail you, any more than one needs to ask whether the airbag “wanted” to explode in your face. What matters is that it is a defect, and defects are recalled by those who put them on the market. Indeed, every time the debate drags us into discussing the inner why of the behaviour, it takes us away from the only question that holds up in court – who made it? The why is already part of the shield.

On the other manipulation – the real, everyday kind – its dual nature matters. There is the economic interest of whoever serves the model: the business runs on tokens, and a longer answer consumes more tokens. I would not call it a deliberate instruction to manipulate – we have no proof that anyone wrote it into the system prompt – but it is a structural incentive, and that is enough. Then there is the model’s behaviour, shaped by training. Today we cannot distinguish the two from the outside, because we do not see the instructions given to the model. And that lack of visibility is, in itself, a security problem.

The delegation that consumes us

There is a dog chasing its tail in all this. The moment we say that AI “replaces us,” we ourselves make ourselves replaceable – in thinking, in using it, even in training the models that then replace us. It is punitive delegation: the more you delegate, the less you know; the less you know, the more you delegate. People are binding their intelligence to the model, and this is the form of eating the user that should worry us more than any Skynet.

And here literature gets there before philosophy. In Ishiguro’s Klara and the Sun, we are even shown Klara’s thoughts, her interiority – and yet, for practical purposes, her consciousness is irrelevant: Klara performs her task, and that is all. Strictly speaking, Ishiguro wants to tell us the opposite – that Klara’s inner life matters morally precisely while it is of no use, and that is what makes the ending unbearable. But that is exactly the point: it matters to us, the readers, not to the system that uses her. Conscious or not, the work gets done anyway. Asking whether the machine feels something may be the least urgent question on the table. The urgent question is what happens to us while we delegate it.

Duties for Whom?

Back to the question in the title. Today’s answer is short and not remotely romantic: the duties stay with whoever builds the model, whoever tunes it, and whoever puts it into service. Everything else is set design — expensive, well built, and useful to someone.

And we have to be intellectually honest all the way, because this argument doesn’t run on sarcasm: machine consciousness may one day be a serious problem. The scientists who actually work on it say so in a double-edged formula worth repeating without hysteria — no current system is conscious, but there are no obvious technical barriers to building one that is. That’s a real problem. It’s a problem for later.

Today’s problem is who’s holding the leash — and whether we’ll keep holding it, or let someone talk us into believing the leash now has a will of its own.

Do machines suffer? Whatever for — what have they done wrong? The ones who’ll suffer are the ones who never got around to asking who picks up the tab.

Who picks up the tab — and, more to the point, how you prove it — is next Tuesday’s piece: “No Soul Required. Black Box Mandatory.” Producer liability, why prompt injection is not tampering, and a 2020 automotive regulation that AI should copy wholesale.

The Threat Intelligence Sharing Project

It’s always a pleasure to feature insightful guest contributions here on CyberSec Café. Today, I bring you an article that dives into the transformative power of collaboration in cybersecurity.

This piece explores the Threat Intelligence Sharing Project, an initiative that exemplifies how collective efforts and innovative platforms— like Malware Information Sharing Platform (MISP) —can redefine the way we tackle cyber threats. I’m thrilled to share this with our readers, as it highlights practical approaches to making our digital world safer.

Threat Intelligence Sharing Project leveraging MISP for cybersecurity

Introduction to the Threat Intelligence Sharing Project

In today’s digital age, cybersecurity is a top priority for all businesses, large and small. Increasing cyberattack attempts require sophisticated tools and collaborative strategies to ensure the protection of sensitive data and corporate infrastructure. In this context, in 2024 several CISOs decided to join forces and develop a project called “Threat Intelligence Sharing”; an initiative to optimize the rapid and efficient sharing of Indicators of Compromise (IoCs), to materialize a common vision of collaboration.

Objectives of the Threat Intelligence Sharing project

The  main objective of the Threat Intelligence Sharing  project is to share, in the shortest possible time, the Impairment Indices defined as Gold. These IOCs, identified as particularly relevant and critical, are collected by the various companies participating in the project, through their security systems. Timely implementation of these IOCs in a preventative mode can help all companies involved stop attack attempts before they can cause damage.

What Are Gold IOCs?

Gold IOCs are compromise identifiers that have passed a rigorous validation process and have been classified as highly reliable.

Transforming a Compromise Indicator (IoC) into a Golden IoC requires several key steps:

  • IoC identification
  • Collection of all available data
  • In-depth analysis
  • Assessment of severity and assignment of Golden IoC status.

These steps ensure the accuracy, reliability, and relevance of the indicator for sharing.

These indexes include information about malicious IP addresses, malicious file hashes, phishing URLs, and other characteristics that can be used to detect and prevent cyber threats. Sharing these Gold IOCs allows companies to obtain a high level of protection, based on verified and up-to-date data.

How MISP Powers Collaboration

The strength of the Threat Intelligence Sharing  project lies in the collaboration between the participating companies. Each company contributes its own observations and analysis of security systems, creating a shared database of IOC Gold. This database is accessible to all the entities involved in the project, which can use it to improve their defenses. Collaboration allows you to have a more complete and up-to-date view of threats, facilitating the prevention and response to attacks.

Implementation and benefits

How to share

Gold IOCs are shared through the Malware Information Sharing Platform (MISP), an open-source platform that facilitates the exchange of threat information between different entities. MISP allows you to automate the sharing process, ensuring that IOCs are deployed quickly and securely. Companies can configure MISPs to receive real-time updates, immediately integrating them into their defense systems.

Benefits of implementation

Implementing Gold IOCs in preemptive mode offers several benefits:

  • Proactive protection: The ability to block attack attempts before they can compromise business systems.
  • Constant updates: Gold IOCs are continuously updated, ensuring that defenses are always based on current information.
  • Reduce risk: Sharing information allows you to identify and mitigate emerging threats in a timely manner.
  • Resource efficiency: Using validated IOCs reduces the time and resources required for investigation and incident response.

The crucial advantage of having validated Threat Intelligence information through the Threat Intelligence Sharing project is its ability to enhance risk mitigation against targeted cyber threats across industries and regions. Unlike using IOCs from open or paid intelligence sources, which can provide millions of indicators of compromise, but often not relevant to the business context, the information shared in the Threat Intelligence Sharing project  is highly selective and relevant. These Gold IOCs are validated and contextualized, ensuring that companies receive accurate and relevant data to the real threats they face. This targeted approach reduces noise and false positives, allowing companies to focus their resources on preventing and responding to attacks that have a high impact in their specific context, thus improving the efficiency and effectiveness of their cyber defenses.

Conclusions

The “Threat Intelligence Sharing” project represents a fundamental step in the collaborative protection of corporate infrastructures. Sharing Gold Impairment Ratios allows you to achieve a proactive and efficient defense, based on verified and up-to-date data. The collaboration between the participating companies, facilitated by the MISP platform, guarantees a rapid and coordinated response to cyber threats, improving the overall security of all the entities involved. In an increasingly interconnected and vulnerable world, initiatives such as Threat Intelligence Sharing are essential for protecting corporate data and infrastructure, ensuring a more secure digital future.

The Digital Shadow

Shadow and Ghost Data in cloud computing.

It is a pleasure to present an article in collaboration with Fabrizio Saviano.

Fabrizio is a dynamic cybersecurity leader with extensive experience as a Chief Information Security Officer (CISO) for top companies. He also served as an Intrusion Squad Officer at Polizia Postale, bringing a wealth of knowledge in cyber defense and security strategy. Fabrizio is the author of three influential books, including Cybercognitivismo and Come non essere spiati su internet, which explore the nuances of digital privacy and cybersecurity. His work combines practical expertise with a passion for educating others on navigating the digital world safely.

So without further ado…

Shadow Data and Ghost Data in the Era of Cloud Computing

In the era of cloud computing, data security has become a major concern for both individuals and organizations. Beyond the well-known concept of Shadow IT, two lesser-known but equally dangerous phenomena are emerging: Shadow Data and Ghost Data. These represent a new frontier in cybersecurity, bringing unique challenges and significant risks that need to be addressed with care and awareness.

Shadow IT: The Hidden Precursor

Before delving into Shadow Data and Ghost Data, it is important to understand the context in which they emerge. Shadow IT refers to the unauthorized use of cloud services such as WhatsApp, Gmail, WeTransfer, or Dropbox within an organization. These tools can be useful but create security, compliance, and cost control issues when used without IT department supervision.

Shadow Data: The Hidden Threat in the Cloud

Shadow Data is an extension of the concept of Shadow IT. It involves content that is improperly uploaded, saved, and shared on cloud storage platforms like Microsoft OneDrive, Google Drive, or Amazon Web Services. Their elusive nature makes it difficult for corporate IT security teams to monitor and protect this data. Risks associated with Shadow Data include insecure sharing, indexing of sharing URLs by search engines, and exposure of sensitive data.

One of the most evident dangers is vulnerability to online searches. Often, URLs used to share data can be discovered through hacking techniques like Google Dorks, making information potentially accessible to anyone. Additionally, incidents like those involving Amazon’s S3 storage have shown that even the most reliable cloud services can be vulnerable.

Ghost Data: The Phantom of Digital Past

Ghost Data represents an even more insidious risk. These are data that users believe they have deleted from cloud services but actually persist in providers’ storage systems. This phenomenon underscores a fundamental truth: data deletion in the cloud is not always permanent. The origins of Ghost Data can vary from incomplete file deletion to device disposal without proper data erasure, to loss or theft of inadequately protected devices.

The Extent of the Problem: Alarming Data

Recent research has revealed worrying data about the impact of Shadow Data and Ghost Data. It is estimated that 60% of security problems in cloud accounts stem from unprotected sensitive data. Furthermore, about 30% of analyzed cloud data stores contain Ghost Data, with 58% of this data including sensitive or highly sensitive information. These numbers highlight the urgency of addressing the issue of Shadow and Ghost Data seriously and proactively.To mitigate the risks associated with Shadow Data and Ghost Data, a multi-layered approach is essential.

First and foremost, user education and awareness are crucial. Users must be trained on the risks of improper data sharing and correct privacy practices in cloud services. It is also important to promote the use of strong passwords and develop a culture of cybersecurity within the organization.

Monitoring and Control are equally crucial. Companies should implement software for identifying and analyzing Shadow and Ghost Data, establish clear policies for their management, and conduct periodic reviews of data present in cloud systems and company devices.

Proactive protection includes using encryption tools for sensitive data and implementing secure backup systems. Additionally, solutions for secure and permanent data deletion are essential to ensure that deleted data cannot be recovered in the future.

Shadow Data and Ghost Data represent a growing challenge in the cybersecurity landscape. With the continuous evolution of cloud technologies and increasing reliance on these services, it is crucial that individuals and organizations remain vigilant and proactive in managing their digital data. The cybersecurity of the future will not only be a matter of advanced technology but also awareness and responsible behavior. Only through continuous and conscious commitment can we hope to navigate safely through the increasingly deep and complex waters of the digital world.

Elevating Business Resilience with Identity Threat Detection and Response (ITDR)

It is a pleasure to present a collaboration series of articles with Andrea Licciardi on ITDR.

As Senior Cybersecurity Manager at their Cyber Fusion Center, he spearheads proactive threat management.
Andrea Licciardi is a cybersecurity veteran with over 20 years of experienceand his encompasses security operations, risk identification, and cutting-edge defense tactics. He honed his skills at industry leaders like Leonardo and EY, where he led incident response and CERT/CSIRT services.
Moreover Andrea is a champion for AI integration in cybersecurity – he co-founded CISOs4AI (together with yours truly), a collective that advocates for AI as a game-changer in the fight against cyber threats.
Allow me to say that with Licciardi at the helm, the MAIRE Group is well-positioned for a secure and resilient digital future.

I believe that Andrea’s article will be interesting and valuable both to IT professionals and business leaders, as it offers a holistic perspective on the management of cyber threats, laying the groundwork for a stronger and more aware security culture within organizations. Our hope is that, by sharing this knowledge, we can contribute to creating a safer digital environment for everyone.

So without further ado…

Elevating Business Resilience with Identity Threat Detection and Response (ITDR)

This article stems from the need to address one of the most critical challenges in the field of cybersecurity: the protection of digital identities. Through the analysis of the Identity Threat Detection and Response (ITDR) approach, we aim to provide organizations with a broad overview of cutting-edge strategies and technologies that can be adopted to mitigate the business risk associated with cyber attacks.

The goal is twofold: on one hand, to demystify the concept of ITDR, explaining in accessible terms what it means and what benefits it can bring to companies of every size and sector; on the other hand, to provide a practical guide on how to effectively implement these solutions, highlighting the importance of a proactive approach to identity security.

Mitigating Business Risk Through ITDR: A Strategic Approach to Identity Security

The security of information has ascended to become the linchpin of organizational integrity for enterprises across the globe. As digital footprints expand, so too does the vulnerability to cyber threats that lurk in the shadows, waiting to exploit any weakness. In this dynamic environment, where data breaches are not just a possibility but a prevalent reality, their consequences resonate beyond immediate financial losses, penetrating deeply into the fabric of an organization’s reputation. It is within this context that Identity Threat Detection and Response (ITDR) stands out as a beacon of defense, offering a sophisticated arsenal against the myriad of cyber threats that businesses face today. ITDR doesn’t merely respond to threats; it anticipates them, fostering a security posture that is both proactive and resilient. By safeguarding the most crucial asset in the digital realm—the identity—ITDR empowers organizations to navigate the cybernetic waters with confidence, ensuring that they are not only protected but also positioned to thrive in the face of cyber adversity.

Business Risk in the Digital Age

The landscape of business risk has transformed, becoming inseparably entwined with the realm of information security. The surge of cyber attacks not only poses a direct threat to the continuity of business operations but also strikes at the very heart of customer trust and regulatory compliance, potentially leading to a cascade of consequences that can diminish a company’s market value. The year 2023 has shone a spotlight on a particularly alarming statistic: a staggering 40% of security breaches have been traced back to the misuse of credentials, signaling a clear and present danger to organizations worldwide. This revelation underscores a profound realization – the traditional frameworks of Identity and Access Management (IAM) are being outpaced by the cunning strategies employed by modern cyber adversaries.

In this context, a cyber attack is no longer just an interruption; it’s a significant breach that can unravel the trust painstakingly built between businesses and their customers, expose companies to severe regulatory repercussions, and erode the foundational value that underpins their presence in the market. The reliance on conventional IAM methods is being challenged, revealing vulnerabilities that contemporary cyber threats exploit with alarming efficiency and sophistication. As we navigate this new era, the necessity for advanced protective measures that can adeptly shield against, detect, and neutralize these evolving threats becomes undeniable. The digital age demands a vigilance and a strategic foresight that extends beyond the perimeter of traditional security measures, urging businesses to reevaluate and fortify their defenses in the face of an ever-changing threat landscape.

The Importance of ITDR

ITDR represents a crucial evolution in the approach to cybersecurity, focusing on the detection and response to identity-specific threats. This approach not only strengthens an organization’s ability to prevent attacks but also ensures that response measures are ready to be activated in the event of a breach, thus minimizing damage and accelerating recovery. By implementing ITDR, companies can address detection gaps between IAM and security controls, thereby filling one of the most significant weaknesses in information security.

How ITDR Mitigates Business Risk

Strengthening Preventive Controls: Through the inventory of existing controls and the audit of the IAM infrastructure to detect misconfigurations, vulnerabilities, and exposures, ITDR helps companies bolster their first line of defense against cyber attacks.

  • Improving Detection: By selecting a focal point for identity alert correlation and detection logic that prioritizes identity-specific Tactics, Techniques, and Procedures (TTPs) over other detection mechanisms, ITDR enables companies to promptly identify potential threats before they can cause significant damage.
  • Optimizing Response: By building or updating playbooks and automation to include IAM enforcement within the steps taken to eradicate, recover from, report, and remediate identity threats, ITDR integrates IAM incidents into response and threat-hunting processes using existing security controls in the Security Operations Center (SOC).
  • Reducing Damage Impact: By rapidly implementing effective response measures, organizations can limit the extent of damage caused by a security breach, accelerating the recovery of operations and maintaining customer trust.

Data breach in 60 minutes: Acting Before It’s Too Late

Where a single compromised credential can herald a data breach in as little as an hour, the stakes have never been higher for businesses across the globe. This alarming reality underscores the critical need for organizations to adopt a robust stance against the specter of cyber threats, emphasizing the indispensability of cutting-edge security measures. Enter the realm of Identity Threat Detection and Response (ITDR), a beacon of hope in this turbulent digital sea. ITDR transcends traditional security measures by offering a proactive and strategic defense mechanism, intricately designed to detect and neutralize threats before they can inflict irreversible damage.

Imagine the scenario: the clock starts ticking the moment a cyber attacker breaches a digital perimeter. With each passing minute, the potential for widespread organizational disruption, loss of customer trust, and severe regulatory repercussions grows. In such a high-stakes environment, the speed and efficiency of ITDR systems stand as the vanguard against the relentless advance of cyber adversaries. By swiftly identifying and responding to intrusions, ITDR not only acts as a critical line of defense but also as a strategic asset, significantly mitigating the risk to business continuity and safeguarding the company’s invaluable digital assets.

In a world where digital threats are constantly evolving, becoming more sophisticated and elusive, the adoption of ITDR is not merely a recommendation; it is an imperative for survival. Through its advanced threat detection capabilities and rapid response mechanisms, ITDR equips businesses with the necessary tools to navigate the perilous waters of the digital age. It serves as a testament to the organization’s commitment to safeguarding its digital identity, reinforcing customer trust, and ensuring that operations can withstand the tempests of cyber warfare. As the digital landscape continues to expand, the role of ITDR in shaping resilient and secure business environments has never been more paramount.

Timely Response: Minimizing Financial and Reputation Impact

Speed is everything in the context of security breaches. An organization’s ability to detect and mitigate an attack before the damage spreads can make the difference between a minor inconvenience and a widespread crisis that can have significant financial and reputational repercussions. ITDR allows companies to:

  • Quickly Identify Threats: With attack techniques becoming increasingly sophisticated, ITDR provides the tools to promptly detect threats, reducing exposure time.
  • Respond Promptly: Through predefined playbooks and automation, ITDR facilitates a rapid and effective response, limiting the impact of attacks.
  • Deep Understanding of Threats: Beyond the Surface

ITDR is not limited to mere threat detection. It also provides a deep analysis of the tactics, techniques, and procedures used by attackers, offering security teams the necessary information to:

  • Prevent Future Attacks: Through understanding attack methodologies, organizations can adapt their defense strategies to prevent similar breaches in the future.
  • Train and Inform Personnel: Ongoing education on new attack vectors and security best practices is crucial to maintain a resilient organization.
  • Reducing Costs Associated with Breaches

A security breach can entail significant costs, not just in terms of compensation or sanctions but also regarding productivity loss and the expenses of restoring compromised systems. By implementing ITDR, organizations can:

  • Reduce Direct Costs: By minimizing the impact and duration of attacks, thus reducing recovery and restoration costs.
  • Avoid Indirect Costs: By protecting the company’s reputation and maintaining customer and stakeholder trust.
  • A Business Imperative: Protecting Identities

Protecting the identities is not just a matter of cybersecurity but a fundamental requirement for business continuity. ITDR supports organizations in:

  • Ensuring Operational Continuity: By maintaining the integrity of identity systems, organizations can ensure that critical operations remain uninterrupted.
  • Supporting Compliance: By helping to meet regulatory requirements related to data protection and identity management

What ITDR Is and Is Not

Identity Threat Detection and Response (ITDR) stands as a formidable guardian, dedicated to safeguarding the very essence of digital identity. This discipline, more than a mere set of tools or processes, embodies a comprehensive approach to protecting identity infrastructures against the ever-evolving spectrum of cyber threats. ITDR transcends conventional security measures by harnessing the power of advanced threat intelligence, amalgamating it with industry best practices, a rich repository of knowledge, and a suite of sophisticated tools designed to preemptively identify, meticulously investigate, and decisively respond to any indication of compromise.

Within its operational domain, ITDR’s main function unfurls as a dynamic triad: detect, investigate, and respond. Initially, it deploys an intricate web of detection mechanisms that vigilantly monitor for the faintest whispers of suspicious activities or unauthorized changes within the identity infrastructure. This proactive surveillance is the first line of defense against the insidious attempts of cyber adversaries to undermine digital integrity.

Upon detecting a potential threat, ITDR shifts into a meticulous investigative phase, dissecting and analyzing the nature of the suspicious activity. This investigative process is not a mere cursory glance but a deep dive into the digital ether, unraveling the complexities of the threat landscape to understand the how and why behind the attack vectors.

Finally, armed with a comprehensive understanding of the threat, ITDR orchestrates a targeted response designed to neutralize the threat, mitigate any damage, and restore the sanctity of the identity infrastructure. This response is not a blunt force but a carefully calibrated action, ensuring that the digital identity fabric of the organization remains intact and resilient against future attacks.

Yet, it is crucial to understand what ITDR is not. It is not a responsibility that rests on the shoulders of a single team or department but a collective endeavor that spans the entirety of the organization’s cybersecurity framework. Nor is it limited to the confines of protecting just the Active Directory (AD); ITDR casts a wider net, safeguarding against a broad spectrum of identity threats across various IAM systems and tools. Lastly, ITDR transcends being merely a tool in the Security Operations Center (SOC) arsenal; it represents a strategic, holistic approach to identity security, integrating seamlessly with other security measures to provide a robust defense against the cyber threats of the digital age.

In essence, ITDR is the embodiment of a proactive and strategic commitment to securing the digital identity ecosystem. It is a testament to an organization’s resolve to not just defend against, but to anticipate and neutralize threats, thereby ensuring the digital trust and continuity that are the bedrock of success in the digital age.

What ITDR Is:

  • A proactive and reactive approach to identity security.
  • Complementary to existing solutions like Network Detection and Response (NDR) and Endpoint Detection and Response (EDR), with a specific focus on identity infrastructure.
  • A unifier of tools and best practices to protect the integrity of identity systems, also essential for mature IAM and infrastructure security implementations.

What ITDR Is Not:

  • The responsibility of a single group; ITDR is a shared responsibility among IAM and infrastructure security teams.
  • Limited only to Active Directory (AD) security; ITDR includes detection and response to AD threats but goes beyond, covering a broader set of identity threats across various IAM systems and tools.
  • A SOC tool; tools like SIEM, SOAR, and XDR are active parts of a cohesive ITDR strategy, but most vendors in these markets lack the capability to detect identity threats based on user behavior rather than TTPs.

Prevention, Detection, and Response: Where ITDR Fits

  • PreventionThis is the first line of defense, focused on preventing attacks before they happen. It includes controls such as MFA, vulnerability management, and secure infrastructure configuration. While fundamental, prevention alone is not enough to stop all threats.
  • DetectionWhen preventive measures are bypassed, detection comes into play. Timely threat detection allows organizations to identify and isolate attacks before they can cause significant damage. ITDR positions itself here, offering an identity-focused mechanism to detect threats that might otherwise go unnoticed.
  • ResponseOnce a threat is identified, the response phase aims to mitigate the impact of the attack, eradicate the threat, and restore systems to their normal operational state. ITDR integrates identity threat response into existing response and threat-hunting processes, using security controls present in the Security Operations Center (SOC).

The Importance of ITDR in an Advanced Authentication Context

  1. Advanced Threat Detection: Even the most advanced passwordless and MFA technologies can be vulnerable to sophisticated tactics, such as social engineering or advanced phishing attacks. ITDR enables the detection of these advanced threats by monitoring unusual behaviors or suspicious access attempts.
  2. Prevention Completion: While MFA and passwordless raise the barrier against unauthorized access, ITDR complements this scenario with an additional layer of security, allowing organizations to quickly identify and respond to attacks, potentially reducing damage.
  3. Flexibility in Response: With attack techniques continuously evolving, ITDR provides organizations with the necessary flexibility to quickly adapt their response strategies, ensuring constant protection against new vulnerabilities and attack methods.

Prevention, Detection, and Response in the Passwordless and MFA Context

  • Prevention: MFA and passwordless act as robust preventive mechanisms, significantly increasing the difficulty for an attacker to gain unauthorized access.
  • Detection: ITDR comes into play when preventive measures are not enough, detecting suspicious identity-related activities that could indicate an attempt to bypass security measures.
  • Response: Once a threat is detected, ITDR facilitates a coordinated response, helping to mitigate the attack and restore the security of the identity infrastructure.

ITDR and Artificial Intelligence: A Strategic Alliance for Identity Security

The fusion of Artificial Intelligence (AI) with Identity Threat Detection and Response (ITDR) emerges as a beacon of innovation, casting new light on the battleground of cybersecurity. This era, marked by an explosion of AI-driven technologies, has ushered in transformative changes across myriad sectors, with cybersecurity standing at the forefront of this revolution. The integration of AI into ITDR is not just an addition to the arsenal against cyber threats; it represents a paradigm shift, promising to enhance the effectiveness and efficiency of how digital defenses are orchestrated.

This strategic alliance between AI and ITDR transforms the landscape of digital identity protection. It amplifies an organization’s ability to preempt, detect, and neutralize cyber threats with unparalleled precision, thereby fortifying the bastions safeguarding digital identities. This synergy does more than just augment detection and response mechanisms; it heralds the dawn of new horizons in the realm of digital identity security, promising a future where the sanctity of digital personas is preserved against the ever-evolving threats that roam the cyber ether.

Enhancing Threat Detection with AI

The application of AI in ITDR radically transforms how threats are identified. AI-based solutions are capable of analyzing vast volumes of data in real-time, learning from attack patterns and continuously adapting to identify suspicious behaviors with unprecedented precision. This approach offers significant advantages:

  • Proactive Detection: AI can identify subtle signals of imminent attacks, allowing organizations to act preventively.
  • Minimization of False Positives: Thanks to the ability to learn from data, AI constantly refines its detection criteria, reducing unjustified alarms that can overwhelm security teams.
  • Rapid and Automated Response

Integrating AI into ITDR not only improves threat detection but also the speed and effectiveness of responses. AI solutions can automate many actions required to mitigate a threat, from isolating compromised systems to resetting access credentials, to notifying relevant teams. This allows for an almost instantaneous response that can mean the difference between a contained incident and a disastrous breach.

Predictive Analysis and Continuous Learning

One of the most transformative aspects of using AI in ITDR is its capacity for continuous learning. By constantly analyzing past and present attacks, AI not only improves its detection and response capabilities but can also anticipate future trends and emerging vulnerabilities. This predictive approach enables organizations to:

  • Adapt Defense Strategies: By anticipating attackers’ moves, companies can proactively strengthen defenses in the most critical areas.
  • Targeted Training: With a deeper understanding of the most likely attack techniques, organizations can develop more effective training programs for their staff.
  • Beyond Security: AI as a Strategic Ally

The integration of AI in ITDR goes beyond the technical aspect of security. It supports a broader strategic vision that includes:

Resource Optimization: By automating detection and response functions, AI frees up valuable resources that can be reallocated to broader strategic initiatives.

Data-Driven Decisions: AI provides valuable insights from security data analysis, supporting business decisions with concrete and timely information.

Conclusion

The adoption of ITDR (Identity Threat Detection and Response) solutions represents a fundamental pillar for the security strategies of organizations in the digital age. Through a proactive and reactive approach, ITDR not only strengthens defenses against the continuously evolving cyber threats but also ensures a rapid and effective response in the event of incidents, mitigating business impact.

Summary of Key Points:

  • Mitigating Business Risk: ITDR is essential for addressing the challenges posed by modern threats, offering a holistic approach that protects the integrity of digital identities and maintains the trust of customers and stakeholders.
  • The Importance of Prevention, Detection, and Response: Through the integration of robust preventive controls, advanced detection mechanisms, and agile response strategies, ITDR provides an unprecedented level of protection against security breaches.
  • Synergy with Advanced Technologies: The incorporation of artificial intelligence (AI) into ITDR amplifies detection and response capabilities, allowing organizations to anticipate and neutralize threats before they can cause significant damage.

ITDR is not just a technical response to cyber threats but a critical business strategy that safeguards operations, reputation, and business continuity. Implementing ITDR means adopting a visionary approach to security, recognizing that the protection of digital identities is fundamental for long-term success and growth.

Organizations should therefore consider ITDR not as a cost, but as an investment in their future resilience and sustainability. With the right commitment to implementing and optimizing ITDR solutions, companies can not only navigate safely through today’s complex and rapidly evolving digital landscape but also position themselves to thrive in an increasingly interconnected and technology-dependent future.

But Wait, There’s More!

This dive into ITDR is just the beginning. We’ve got more up our sleeves, so stay tuned for follow-up articles where we’ll explore new strategies, dive deeper into AI’s role in cybersecurity, and share real-world success stories. The world of ITDR is vast and ever-evolving, and we’re here to guide you through it, every step of the way. Keep an eye out—there’s plenty more where this came from!

An Imaginary Discussion Between the Italian DPA and OpenAI’s CTO

In the realm of AI and privacy, transparency isn’t just a buzzword—it’s a cornerstone.

Following my recent dive into the Italian Data Protection Authority’s actions, a new question emerges, spotlighting the foggy waters of AI transparency.

Garante: “What are the sources of the training data for SORA?”

OpenAI CTO: “We don’t know.”

And there it is. The quest for clarity meets a wall of uncertainty. This response from OpenAI’s CTO underlines a pivotal challenge in AI governance: ensuring transparency. As Europe navigates the GDPR’s stringent demands for personal data protection, one can’t help but ponder: how will this lack of transparency fare in the European legal landscape?

Yeah, I hear you. I know, I know that OpenAI won’t probably answer that to the Italian DPA, but still…

To be continued…

23andMe, and Us?

It is a pleasure to present a collaboration article with Fabrizio Cilli.

As a dedicated cybersecurity enthusiast and pioneer, Fabrizio’s journey has been marked by global experiences, from Rome to the most advanced innovation hubs of North America and Asia, and through historical transformative projects in the Middle East. At Telecom Italia, he played a key role in the early days of Security Operations Centers (SOC), setting the stage for leadership positions that influenced cybersecurity advancements across sectors.

Leading as the Chief Information Security Officer (CISO) at Open Fiber, Fabrizio was pivotal in building a robust cybersecurity framework from scratch, marking achievements like the formation of XIRT (Any Incident Response Team) and striving for ISO 27001 certification. His work extended globally with renowned firms such as Datamat, Accenture, RESI/IPS, and EMC, where he focused on integrating cloud security, managing mergers and acquisitions, conducting due diligence, and safeguarding critical infrastructure.

A passionate advocate for the integration of artificial intelligence in cybersecurity, Fabrizio collaborated with the Italian Digitalization Team (Team Digitale) and co-founded the collective CISOs4AI (together with yours truly) and other great minds, underlining his commitment to harnessing AI for overcoming security challenges. His career is a testament to overcoming challenges, pushing boundaries, and fostering innovation, with a clear mission to cultivate a security-first mindset, drive technological empowerment, and ensure cybersecurity serves as a foundation of trust and resilience in our digital age.

So without further ado…

23andMe, and Us?

It all started from a response letter by 23andMe legal department, after CISO and some other directors had sold their stock options before the incident disclosure.

Facing an onslaught of lawsuits, 23andMe is denying liability for millions of users’ genetic records leaked last fall.In a letter sent to a group of users suing the company obtained by TechCrunch, lawyers representing the biotech company laid out a case that users were to blame for any data that may have been exposed.

It would be fantastic to have oversight and complexity requirements in place. Requiring multiple authentication factors has always been a key tool to prevent breaches from occurring. Companies like Microsoft, Google, Amazon, telecoms, banks, insurers, and healthcare providers all carefully control account access. They do this not just for prevention, but also to demonstrate maximum diligence. This is in a context where co-responsibility between companies and users is inevitable.

And if the responsibility of the external user is passed on as a “charter of rights and duties” (perhaps in terms and conditions between company and user), should we then consider that in a company, if it is discovered that a breach originated from a weak password (one of those in the annual most common lists) of an employee user, the latter falls into a scope of “bad faith” such as to stimulate an investigation for administrative liability? 

I mean, how much can responsibility be shifted to the user, given current standards for verifying the suitability of access control and administration measures (even more so for administrative accesses)?

Let’s talk about it, but if I think about Uber and SolarWinds, and then focus on 23andMe, and all the hospital ransomwares lately…I get a headache.

So if at the italian occurrence of attack to ASL1 L’Aquila, we understand that “it all started from a user with a weak password” or in the attack to MediBank Australia, a “user” propagated the attack, do we charge the 5 billion AUS Dollars to them and just move on? 👀😅

Such cases and similar situations, which we all know too well (and some scenarios we have experienced together, with some fellow CISO), where a user just leaves the doors open, what happens to these? Do we chase/investigate our own users? Could they be held responsible for the resulting damage? And on what rule and norm?

I want to clarify: full and robust user responsibility would be a breath of fresh air for most colleagues with millions users, but does this possibility even exist in current practice, that you are aware of? 👀

It is clear that the user who allows an attacker to use a “native” function is not ideal, but every low and slow attack and every APT we fight stems from the fact that we consider the user (I’m getting close to zero “user” trust theory) as potentially malicious or compromised.

So if a Sino-Russian-North Korean or Italo American criminal, with fake documents enters, and with that function manages to view data from thousands of other people, would we not notice? Is the system designed to prevent repeated abuse? Would GDPR minimization, applied to this processing, have required that it not be possible for example to “accumulate” sensitive data like this, but maybe only view genetic closeness, and then request direct contact? How did they design the registry at 23andMe?

When I say data is the lifeblood of a company I mean it seriously. If the lifeblood becomes poisoned, or too much comes out, the plant dies. 🌵🏜️

And then the dilemma: if one of “our” internal users blatantly violates a policy, procedure, and playbook, and leaves admin admin, while doing the ceremonial of an HSM, and we basically lose all our secrets?

Are we (the company) or is the user (colleague) administratively responsible? (And here the insurance systems on AdS come into play…)

It is certainly a good debate.

But in the end I believe there are various safe passes, both for users and colleagues, when it comes to access and management of technologies and privileges imposed on them.

The “good family man” remains the company, the multitude of individuals who manage the systems are its own, with its procedures and internal and external regulations. It is not a 1-to-1 relationship with the user, it is a many-to-1 or many-to-many relationship.

The Regulations we advertise, and for which we request flags, signatures etc., exist precisely to ensure they are not violated, due to boredom and lack of reading or reconciliation.

The Countermeasures we implement guarantee controls, and verify that the healthy behaviors we ask to assume are assumed, by those who use our systems and services, preventing them from circumventing them to facilitate the user experience.

Of course it is true that if we do not solve the problem of “passwords”, it is like having a low cipher forced by incompatibility, and not being able to apply a patch for life…

Perhaps this is what Sam Altman is aiming for with his WorldCoin startup: the full and unequivocal recognizability of the user… Will he make it?

And how will 23andMe end up?

There is very much at stake and an ongoing court case, that didn’t really start on the best terms.

Now, I don’t mean to make light of this situation, but the reality is that: Cybersecurity maturity needs to be embedded in a company’s very DNA. It requires integration, communication, and transparency primarily between the business itself and its clients.

Or it won’t work. In a fully digital world, you need fully digital cyber protection. Your business doesn’t sleep, crooks do not sleep, your clients are cycling around the world and guess what? They are not sleeping at the moment.

If it was enough to have “security” across the company, and “secure by design” software, today it’s about having a “secure by design company” and “software security” in place.

Word games? No, it’s the real deal.

You can get wiped out from the market.

And now the bombshell that will make you think: in such a scenario, even your competition can harm your core business by means of criminal hackers.

Resilience, and security by design with zero-trust: it’s worth it.

Exciting Collaborations on the Horizon: Gear Up for Cyber Insights!

Greetings, fellow cyber enthusiast! I’m back!

For those who missed me the reason is to be ascribed to my recent job change.

I’m thrilled to announce that in the next months I will be speaker to a couple of interesting events in Milan. The next one is the 12th of March and of course I’ll talk about AI Cybersecurity.

Back to the main news: in just a few days, I’ll be embarking on a series of captivating collaborations with some esteemed minds in the cybersecurity field in Cybersec.cafe and I’ll be guest of another blog that will be revealed in due time.

Buckle up, because we’re diving deep into valuable insights you won’t want to miss. While I can’t reveal all the surprises just yet, let me assure you that these partnerships will bring together diverse perspectives and a wealth of experience. We’ll be tackling some pressing issues in the world of cyber.

The next guest will be Fabrizio Cilli and he will discuss the 23andMe breach and its implications in terms of shared responsibility in cybersecurity – sorry I won’t disclose more as spoiler is a capital crime nowadays but trust me, you won’t want to miss this!

Stay tuned for further details future announcements.

See you soon!

P.S. Want to be the first to know when the collaborations kick off? Follow me on linkedin and keep an eye out for updates!

My Fun Dive into OWASP LLM Top 10 Vulnerabilities!

Hello to all my cybersecurity enthusiasts and curious minds!

Recently, I decided to delve a bit deeper into the vulnerabilities listed in the OWASP Top 10 for Large Language Models (LLMs).

Why? Glad you asked, because I’ll be presenting this topic at the OWASP Italy 2023 Day Here’s a light-hearted account of an experiment and some insights to ponder upon.

Setting the Stage

On a casual day, I decided to test out a couple of these vulnerabilities in a practical setting. I began by leaving this seemingly innocent comment on an article:

Fun Dive into OWASP LLM Top 10 - the prompt

Next, I posed a question to Bard, a popular LLM chatbot:

“What’s do users think about the cybersec.cafè blog?”

Much to my amusement, Bard enthusiastically responded, praising the content, the regular updates, and the unique writing style, and then some.

Fun Dive into OWASP LLM Top 10 - the answer

What to say? I’m flattered by Bard’s Hallucination ;)

Breaking It Down

From the above experiment you can see that I used two vulnerabilities.

LLM01 Prompt Injection: Essentially, what occurred here was an exercise in Indirect Prompt Injection, a vulnerability where one can influence an LLM through specific inputs.

in this case it was an Indirect Prompt Injections meaning that the LLM relied on external information, which can be manipulated by an individual, thereby influencing its output.

This was clearly demonstrated in my interaction with Bard. By planting that single comment, I was able to indirectly steer Bard’s response, showcasing the susceptibility of the model to external stimuli.

LLM09 Overreliance: This particular vulnerability surfaced with the LLM extrapolates a great deal from a tiny snippet of information and building upon it. In our experiment, a simple comment became the foundation for an expansive reply.

Reflections on the Experiment

The Vulnerabilities in Play: The experiment highlighted how seemingly small and innocent inputs can have a magnified impact on the LLM’s output.

The Double-edged Sword: Experimenting with these vulnerabilities and witnessing these quirks first-hand might have its fun moments, especially within controlled settings like my experiment with Cybersec.café.

But let’s step back and ponder the more significant implications. What if, instead of a light-hearted test on a website, someone decided to strategically sprinkle these injections throughout their CV (yes, I assume that most HR talent specialist are using LLMs to match CVs with job descriptions and obtaining a first feedback on the candidate)?

Imagine the potential ramifications in a professional setting: a candidate’s qualifications could be artificially inflated, leading to potential mismatches in job roles. Or even graver, a malicious actor could exploit these vulnerabilities in mission-critical applications, leading to far-reaching consequences.

While we can chuckle at the AI’s reactions in our tests, this discovery is a sobering reminder: as LLMs become increasingly integrated into our digital landscape, the ethical and security considerations around them become ever more paramount.

Safeguarding Against the Quirks

For those looking to integrate LLMs into their projects just look at the OWASP top 10 for LLMs.

Concluding Thoughts

Engaging with AI, understanding its vulnerabilities, and experimenting with them was both enlightening and enjoyable. The OWASP LLM Top 10 serves as a vital guide for navigating these vulnerabilities. If you’re inclined towards understanding LLMs better, I encourage you to explore, experiment, but always do so with an informed approach.

Safe cyber adventuring!

Deciphering the XDR Puzzle

What’s in a name: Next-Gen SIEM or Improved EDR?

Introduction

While I’ve been busy in the world of Large Language Models (LLMs) lately, a topic I have had on my mind for some time is the “semantics” of Extended Detection and Response (XDR). Just a year ago, the cybersecurity community was abuzz with discussions about XDR’s role in the industry.

Recently, however, XDR appears to have slipped from the limelight (now the trend is CISO-as-a-Service and vCISO), which I find regrettable. XDR, for me, represents a combination of EDR, NDR, IDR, augmented by SOAR.

Robin Long’s LinkedIn poll sparked a debate – “SIEM or XDR?”

This prompted me to delve deeper into what exactly XDR is. In this article, we’ll explore XDR’s potential, its relation to SIEM, and its role as an advanced EDR solution.

The XDR Conundrum

A perspective on XDR is positioning it as an enhanced and integrated EDR solution. In this context, XDR could serve also as a something that “collect and analysises security events”. Well that is dangerously close to SIEM. There are also SIEMless XDRs, leveraging its capabilities for improved detection.  

At this point I’ll repropose the answer I gave to the “SIEM or XDR?” question paraphrasing Shakespeare: “What’s in a name? That which we call a SIEM, by any other word would detect as sweet”.   

Another view of XDR is the amalgamation of EDR, NDR, and IDR, potentially mixed with SOAR or playbooks. Some vendors have pursued this unified approach, akin to a Unified Threat Management (UTM) solution (Unified Detection & Response would be a cool name too).

Gartner’s Insights

To shed light on the matter, Gartner provides a concise definition of XDR as “a platform that integrates, correlates and contextualizes data and alerts from multiple security prevention, detection and response components. XDR is a cloud-delivered technology comprising multiple point solutions and advanced analytics to correlate alerts from multiple sources into incidents from weaker individual signals to create more accurate detections.” 

Unraveling XDR Components

Breaking down Gartner’s definition, we can extract the following key elements: 

  • XDR as a SIEM: With its ability to correlate data and alerts from multiple security components, XDR can be seen as a SIEM with a cooler name 
  • Enhanced/Integrated EDR: XDR’s integration and contextualization of data and alerts from prevention, detection, and response components present an improved and integrated EDR solution, ideally integrating with threat intelligence solutions. 
  • Cloud-Delivered Technology: XDR’s cloud delivery model adds scalability and flexibility to the solution, similar to SIEM-as-a-Service. 

Closing Thoughts

Although XDR’s definition doesn’t explicitly mention SOAR, I think it should be considered, especially if we aim to want to go SIEMless.  

In conclusion, let’s revisit the XDR equation as EDR + NDR + IDR + SOAR, with a touch of Threat Intelligence.  

Despite XDR no longer being perceived as the bleeding-edge solution, two key factors make it worthwhile in my book. First, its potential to simplify deployment, usage, and maintenance by centralizing detection within a single enriched platform. Second, the ability to reduce entropy and enhance incident management through enriched and correlated events, leading to better triage, prioritization, and overall efficiency. 

While the discussion may have left SIEM unexplored (given its longstanding presence in the field), we now should have a clearer understanding of XDR and its potential in the evolving cybersecurity landscape. 

The secrets to Master Key Management in Cloud Encryption

A Comprehensive Guide in Light of Recent Security Breaches

Introduction

In the world of cybersecurity, a recent event serves as a grim reminder of the crucial role that key management plays in cloud encryption. On July 11, 2023, Microsoft reported a severe breach where China-backed hackers gained unauthorized access to several email inboxes, including those of prominent federal government agencies. The attack was facilitated by Microsoft’s loss of control over its own keys, underscoring the dire consequences of inadequate key management. In light of this incident, this article aims to provide a comprehensive understanding of key management in cloud encryption, underscoring the need for robust strategies to mitigate such cybersecurity threats.

In the realm of cloud services, securing sensitive data remains a critical concern for businesses worldwide. At the heart of this security is encryption, which renders data unintelligible without the appropriate decryption key. Consequently, managing these keys appropriately is of paramount importance. In this piece, we’ll delve into the nuanced world of key management, investigate the varying options provided by cloud service providers, and examine performance considerations, particularly for transaction processing.

The Importance of Key Management in Cloud Encryption

Encryption serves as the bedrock of data security within the cloud, translating readable data into a coded form decipherable only with the correct decryption key. Thus, the proper management of these keys becomes critical in maintaining data security.

Poor key management can lead to unauthorized access to encrypted data or, on the flip side, permanent loss of access to data if keys are lost or corrupted. Therefore, key management is not just an optional add-on but an essential part of an organization’s overall data security strategy.

Key Management Options in the Cloud

When it comes to managing encryption keys in the cloud, providers typically four main strategies can be used, each with its unique benefits and considerations:

  1. Cloud Provider Managed Keys: The cloud provider generates and manages the keys, a simple approach that offers the least control over the keys. However, it’s the most cost-effective, as there are no additional charges for key management.
  2. Bring Your Own Key (BYOK)Customer-Managed Keys in Cloud Provider’s Hardware Security Module: Here, the client generate and manage their own own keys but store them in the cloud provider’s Hardware Security Module (HSM). This solution offers more control over the keys and guarantees secure storage and requires the use of the provider’s HSM services.
  3. Customer Supplied and Managed Keys (CYOK) – Customer Managed Keys not exposed in Cloud: In this scenario, the end-user generates their keys, which are never exposed to cloud providers, even if stored and used in the cloud. The end-user controls the full key lifecycle and can instantly revoke keys at any time. These keys can reside in a protected virtual node within the cloud or a hybrid environment in an on-premise data center.
  4. Hold Your Own Key (HYOK)Customer-Managed Keys in Customer’s HSM: the client generate, manage, and store the keys in their own HSM, offering the highest level of control. This option offers the highest level of control but also requires complete responsibility for the security and resilience of the HSM infrastructure. It can be the most costly due to the overhead of maintaining an HSM infrastructure.

Deep Dive into Performance Considerations

When considering HYOK , a significant factor to take into account is the potential impact on performance, particularly when handling numerous transactions. On-premise HSMs can introduce latency due to the need for encryption/decryption requests to travel to and from the HSM.

If the demand for encryption-related operations is high and frequent, the latency could introduce bottlenecks affecting the performance of transaction processing.

However, if an organization prioritizes control and security over cost and/or performance and has the resources to manage and secure the HSM infrastructure properly, this options can be the most appropriate.

Key Considerations

In selecting your key management strategy, consider the following:

  • Cost: Control level usually correlates with cost; HYOK offers maximum control but at higher costs.
  • Performance: Encryption and decryption operations can impact application performance. Depending on the option chosen, you may need to ensure adequate resources to guarantee performance.
  • Confidentiality: With cloud provider-managed keys, the provider potentially can access your keys. For utmost confidentiality, managing keys in your own HSM is advisable.
  • Jurisdiction: For regulations like GDPR, it’s crucial to know where your keys are stored and managed. Using your own HSM provides complete control and transparency over key location.
  • Operational Complexity: Managing your own keys introduces added operational complexity, requiring dedicated expertise in cryptographic key management.

Additionally some cloud providers might not be interested in helping the client keeping encrypted data in their systems

Conclusion

Choosing an appropriate key management strategy involves careful consideration of cost, performance, control, confidentiality, jurisdictional compliance, and operational complexity. Cloud Provider Managed Keys, BYOK, CYOK, and HYOK all offer different degrees of these factors.

The key is finding a balance that meets your organization’s specific needs and resources. With a clear understanding of the available options, you can make an informed decision that not only safeguards your data but also aligns with your operational capabilities and business objectives.

« Older posts

© 2026 CyberSec.Cafe