Roblox is accused of secretly tracking the data of children without consent, an activity that the plaintiffs say violates their privacy under federal law.
The post Tracking Accusations May Have Roblox Back in Court appeared first on Security Boulevard.
Depending on who’s doing the talking, the new European Vulnerability Database (EUVD), set up by the European Union Agency for Cybersecurity (ENISA) and which recently went operational, is a much-needed alternative to EU dependency on MITRE. Or it’s one more vulnerability database to maintain. Or it’s both.
The post EU Stakes Out Digital Sovereignty With Vulnerability Database appeared first on Security Boulevard.
In this episode, we explore Mark Zuckerberg’s bold claim that AI friends will replace human friendships, and discuss the potential implications of a world where technology mediates our connections. We also update listeners on the recent developments in the 23andMe bankruptcy case and what it means for former customers. Joining the conversation is co-host Scott […]
The post Mark Zuckerberg’s Vision: AI Companions and the Loneliness Epidemic appeared first on Shared Security Podcast.
The post Mark Zuckerberg’s Vision: AI Companions and the Loneliness Epidemic appeared first on Security Boulevard.
How Can Advanced IAM Empower Operational Freedom? Have you ever wondered how to achieve operational freedom in rising cyber threats and complex cloud environments? The answer lies in adopting an advanced Identity and Access Management (IAM) approach that encompasses Non-Human Identities (NHIs) and Secrets Security Management. But what is the correlation between IAM and operational […]
The post Achieving Operational Freedom with Advanced IAM appeared first on Entro.
The post Achieving Operational Freedom with Advanced IAM appeared first on Security Boulevard.
Why Non-Human Identities (NHIs) Management is Key in Data Protection Strategies? With cyber threats escalating at an alarming rate, Non-Human Identities (NHIs) management has become an indispensable part of comprehensive security strategies. But why are NHIs so vital in cybersecurity? To put it simply, they ensure a secure cloud by bridging the gap between security […]
The post Smart Strategies for Comprehensive Data Protection appeared first on Entro.
The post Smart Strategies for Comprehensive Data Protection appeared first on Security Boulevard.
Why is Risk Management Essential in Cybersecurity? Do you understand the critical role risk management plays in your organization’s cybersecurity framework? It is paramount for organizations to protect their Non-Human Identities (NHIs) and secrets. This crucial aspect of cybersecurity often remains underexplored. A laser-focused approach to NHI and secrets security management can do wonders in […]
The post Leveraging Powerful Tools for Risk Management appeared first on Entro.
The post Leveraging Powerful Tools for Risk Management appeared first on Security Boulevard.
Essential Considerations for Securing Cloud Infrastructure Have you ever paused to consider the potential vulnerabilities lurking in your cloud security? With businesses increasingly shift their operations towards cloud-based platforms, the concept of Non-Human Identities (NHIs) and Secrets Security Management has been rising to the forefront of cybersecurity conversations. NHI and Secrets Management is a robust […]
The post Securing Cloud Infrastructure to Handle Business Needs appeared first on Entro.
The post Securing Cloud Infrastructure to Handle Business Needs appeared first on Security Boulevard.
Author/Presenter: Glenn Thorpe
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – GroundFloor – Discover The Hidden Vulnerability Intelligence Within CISA’s KEV Catalog appeared first on Security Boulevard.
What’s on the minds of top local government chief information security officers? In this interview, Michael Dent shares current security and technology priorities, career tips and more.
The post Fairfax County, Va., CISO Michael Dent on Leadership appeared first on Security Boulevard.
Why is NHI Management Integral to Your Cybersecurity Strategy? If you’ve ever wondered, “How can I make my cybersecurity strategy more robust and reduce the risk of security breaches?” then Non-Human Identity (NHI) management could be the answer you’re looking for. NHIs are machine identities frequently used. They are birthed from a unique encrypted identifier […]
The post Ensuring Satisfaction in Managing Non-Human Identities appeared first on Entro.
The post Ensuring Satisfaction in Managing Non-Human Identities appeared first on Security Boulevard.
Is Your Organization Capable of Securing its Digital Assets? Reflect for a moment: are your digital assets comprehensively protected from security threats? With the proliferation of non-human identities (NHIs) and the need for a safe cloud environment, a rigorous approach to digital asset security is paramount. This is particularly crucial for organizations operating in various […]
The post Are You Capable of Securing Your Digital Assets? appeared first on Entro.
The post Are You Capable of Securing Your Digital Assets? appeared first on Security Boulevard.
Ever clicked a “Login with Google” button or granted a new photo app permission to access your Dropbox files? If so, you’ve already experienced OAuth 2.0 — even if you didn’t realize it at the time. Think of it like this: you wouldn’t hand the valet at a hotel your entire keychain with your house,...
The post OAuth 2.0 Overview appeared first on Security Boulevard.
Bitter Lesson, an essay by one of the creators of reinforcement learning, first published back in 2019, recently made the rounds again now that its author, Professor Richard Sutton, was named a winner of this year’s ACM Turing Award. In it, he points out that general methods have won, again and again, beating out domain-specific human expertise.
As pointed out in the essay, available on his blog here: http://www.incompleteideas.net/IncIdeas/BitterLesson.html, experts with deep domain understanding have had to learn that their expertise can become an impediment to progress.
This is a bitter lesson indeed.
He walks through well-known examples. In chess, Go, and natural language, raw compute plus a flexible learning architecture has far surpassed hand-crafted heuristics and feature engineering.
I highly recommend the original essay. It had a similar impact on me as when I read Kuhn’s Theory of Scientific Knowledge, a book whose perspective was applied and popularized by Christensen’s The Innovator’s Dilemma years later. And Kuhn’s work of course, was itself a popularization of Hegel, who spawned a number of other impactful thinkers, but I definitely digress.
In this short blog I consider why cybersecurity has been slow to learn the bitter lesson. I am fairly well placed to answer this, as a founder of one of the few cybersecurity companies building and applying deep learning foundation models in cybersecurity.
Here are a few theories:
1. the Human Log Readers that Founded CyberCybersecurity’s founders have spent decades learning every nuance of protocol quirks and attacker TTPs (tactics, techniques, and procedures). Their understanding of indicators and signature patterns is unmatched and has delivered enormous ROI. Asking them to take a back seat to deep learning models is understandably asking a lot.
2. ML in Security earned a Bad RapEarly machine learning models would perform spectacularly in the lab, only to crumble over time as their environments changed. Maintenance overheads ballooned, and false positives flooded SOC teams. As a result, many organizations concluded that “ML” was too brittle for their ever-changing environments.
3. Exponentials are UnnaturalHumans don’t internalize exponentials well.
And today we face at least four simultaneous exponentials that have rapidly changed what is possible; it is extremely probable and completely understandable that long-time builders in cybersecurity would be behind in their understanding of what is possible.
Other arguments for why the bitter lesson has not been learned in cybersecurity include:
Does learning the Bitter Lesson mean tossing everything into a black-box LLM? No, or at least not yet. LLMs remain horrible at dealing with streams of logs. They offer promise in reading samples of logs and authoring explanations once an incident has been identified, but finding that incident from enormous streams of telemetry is well beyond their capabilities today.
But — purpose-built vertical foundation models are working across many domains. Netflix has published on their usage, as has Stripe, for example.
At DeepTempo, we have built an extremely accurate and adaptable LogLM, a foundation model pre-trained on massive volumes of logs. It doesn’t rely on handcrafted rules; instead, it learns normal behavior as a high-dimensional manifold, detecting deviations no human could foresee. When an attacker spins up a stealthy living-off-the-land C2 channel or deploys polymorphic malware, the LogLM flags subtle shifts in patterns, long before a signature, if one could be written, arrives. The model and our software then add quite a bit of context to that information. Leveraging the ground truth of flow logs, which are much harder to avoid than EDR, for example, our LogLM is adapting in minutes to new domains and showing 1% or lower false positive rates. Our foundation model LogLM powers our Tempo incident identification, available today for free for trial users on Snowflake as a NativeApp.
ConclusionResistance is futile. The Bitter Lesson will eventually solidify the failing foundation of cybersecurity. I believe that time is now, and our results with some of the largest cybersecurity users bear that out, while also keeping us humble and hungry. The adversary is innovating, and we must all up our game to catch up.
I would appreciate any conversation around the topic of why and when the bitter lesson will be learned in cybersecurity.
Cyber! Take your dadgum Medicine! was originally published in DeepTempo on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Cyber! Take your dadgum Medicine! appeared first on Security Boulevard.
How did a $400 million data breach happen at Coinbase? It wasn't a tech failure—it was a human one. Learn how social engineering exploited trust and what it means for cybersecurity.
The post The Coinbase Data Breach: A Breakdown of What Went Wrong appeared first on Security Boulevard.
Authors/Presenters: Roei Sherman, Adi inov
Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.
The post BSidesLV24 – GroundFloor – Adversaries Also Lift & Shift: Cloud Threats Through The Eyes Of An Adversary appeared first on Security Boulevard.
As of today, almost a billion sites have been built using WordPress, powering businesses and organizations of all sizes. That makes any newly discovered vulnerability especially concerning—like the one recently found and reported by Imperva researchers, which could affect any WordPress site. In this blog post, we’ll explain the attack itself, the conditions that made […]
The post Beware! A threat actor could steal the titles of your private (and draft) WordPress posts! appeared first on Blog.
The post Beware! A threat actor could steal the titles of your private (and draft) WordPress posts! appeared first on Security Boulevard.
This is how you handle cybercrime digital extortion! Coinbase was compromised by trusted 3rd party partners, which exposed customer data — but customer keys to their assets were still safe. The cyber criminals then attempted to extort $20 million from Coinbase, to keep the attack secret.
Coinbase’s answer: NO! Instead, they are creating a $20 million fund to help catch the attackers — thereby turning the tables on the extortionists!
This is AWESOME! Welcome to the big leagues!
This sends a huge message:
1. Coinbase takes security seriously and knows never to pay ransomware or other digital extortion. They are following common sense, that so many others ignore: Never give aid to your enemy!
2. It also signals to other potential criminals that Coinbase is a wasted effort, as they won’t pay. Why would a cybercriminal, who seeks personal financial gain, attack them if extortion is off the table?
3. By matching the ransom demands as a bounty for the attackers, they now must contend with the greed of their trusted 3rd parties that know who they are. How willing are their ‘friends’ to identify the attackers, for a sweet reward? The hunters now become the hunted. Brilliant!
4. With the loss of customer name and contact data, there may be some social engineering attacks, but Coinbase has already said they will make customer whole if that happens. Bravo.
5. Lastly, Coinbase is being transparent — which is exactly the opposite of what the attackers want. They are following the rule I taught my children — never do what the attacker wants, as they have a plan it always ends with them winning!
In cybersecurity we must manage risks. Most think it must be done exclusively with technology tools, but sometimes we can also discourage and dissuade attackers. What Coinbase has done is essentially target the cybercriminal Threat Agents, by using psychological deterrence. Future criminal attackers will not want to be in a position where they waste efforts to only become a target themselves.
This is a playbook for every company out there that is at risk of ransomware or other digital extortion! Craft your defense and response capabilities to be able to respond like Coinbase, in the unfortunate event of a breach.
My absolute congratulations and respect to Coinbase executive leadership: Brian Armstrong CEO, Jeff Lunglhofer CISO, and Philip Martin CSO
The post Coinbase Hacked and Turns the Tables on the Cybercriminals! appeared first on Security Boulevard.
Are You Proactively Managing NHIs and Secrets for Cloud Security? Safeguarding Non-Human Identities (NHIs) and secrets are pivotal. Careful management of these crucial elements can profoundly enhance our control over cloud security. Are organizations deploying proactive security measures to stay ahead of data breaches? Understanding NHIs and Secrets in Cybersecurity It is essential to consider […]
The post Stay Ahead of Security Breaches with Proactive Measures appeared first on Entro.
The post Stay Ahead of Security Breaches with Proactive Measures appeared first on Security Boulevard.
Why is Efficient Identity Management Key to Empowering Teams? Consider this, why is managing non-human identities (NHIs) and secrets vital to the overall cloud security strategy? An increasing number of organizations are realizing the substantial role of NHIs in empowering their teams. It’s not just about managing identities and their respective secrets, but also about […]
The post Empowering Teams with Efficient Identity Management appeared first on Entro.
The post Empowering Teams with Efficient Identity Management appeared first on Security Boulevard.
Is Your Organization Prepared for Future Security Challenges? When it comes to strategic planning, one detail often overlooked by businesses is whether their cybersecurity measures are scalable for future growth. With operations expand, so does the complexity of your digital. How do you ensure the security of your business assets? Non-Human Identities (NHIs): The Silent […]
The post Are Your Security Measures Scalable for Growth? appeared first on Entro.
The post Are Your Security Measures Scalable for Growth? appeared first on Security Boulevard.
