This week cyber security headline is brought to you by Snowflake! The situation is still complicated and evovling but looks like it’s already having some significant impact as it seems to be link to some data breaches at Santander and Ticketmaster. I decided to leverage some magic prompts to generate a visualisation summary and a timeline of the key dates and events. The ability of a model like ChatGPT (and others) to generate an output in a specific format is often overlooked. In this case, I’m showing example of how to use it with markmap and mermaid.js format to generate visualisation and timeline » MORE

On my rant on Microsoft Recall last week which increase the attack surface. Highly recommend to read Kevin Beaumont latest post on it as well. The other scenario that didn’t hit me last week is BYOD. If your employee use Recall and connect via remote access to a VDI to do work…all of your DLP controls are just bypassed and how do you deal with an employee leaving? Yes, you can exclude an application as per the FAQ but you need a way to enforce this. A lot of company do not control fully the BYOD devices to enforce configuration. This is going to be really interesting.

OpenAI published their work to disrupt covert operations that were leveraging ChatGPT. Not a big surprise to see that if i’m being honest but i’m wondering if this is not going to give us a glimpse of the future. Both in terms of disinformation but also in terms of what the future of detection and response looks like » MORE

Check out the article from Bessemer Venture Partners on the trends on the cyber security markets. There are a couple of really interesting points in this article and not the least about the consolidation and “platforming” we are observing » MORE

I have continued to develop my little ArXiv project from a couple of weeks ago. As I mentioned, not a developer, but doing pair programming with ChatGPT is just so cool 😎 Assuming you have some basic understanding of programming to cross-check what’s going on, it’s absolutely amazing. I was able to add several key features in a couple of hours when it would have taken me days before. Such features include refactoring the summary page, adding paging, add some extra fields like published date, better search filter, loading overlay, etc. simply amazing! I’m now thinking about expanding this to over sources such as some RSS feeds or website of reference.

Oh and well Google had to do something about the AI search overview situation 😆 Whilst this is all fun it shows as well that adoption of AI is not easy and should not be taken lightly by companies as the price of fixing your reputation is probably higher than you think.

Mitiga blog post on tactical threat hunting

Hudsonrock blog post, which was later taken down for unknown reason (if anyone knows please ping me)

Bleepingcomputer.com summary article

Techtarget.com summary article

The Stack summary article

BBC News article on Ticketmaster and Santander

Community Page article from Snowflake itself

Move this to an Agent based architecture

Ability to start the whole process with a coupe of keywords or basic context. Something like: I want to know more about the Snowflake incident and in particular what happens, threat actors, target, impact and recommendations.

Get one of the agent to go on the internet based on a curated list of data sources to pull the content. This can potentially be based on a something like your trusted RSS feeds or websites.

Rate the content of those article based on specific requirements like the level of details, threat actors or TTPs coverage, etc.

Use an agent to identify the key elements: one for what a timeline, one to zoom into the threat actors and the TTPs, one going after the target and impact, one after the recommendation

Final touch is a set of agent to produce the output from a text summary, to visualisation like the above.

OpenAI disrupted five covert influence operations aiming to manipulate public opinion.

These operations did not significantly increase audience engagement through OpenAI's services.

The disrupted operations attempted to manipulate public opinion on global political issues.

Disrupting covert operations requires a blend of AI innovation and human collaboration.

The balance between AI-generated and traditional content shapes public perception of authenticity.

Regularly update your knowledge on AI safety and responsible use practices.

Engage with cross-sector collaborations to tackle digital threats effectively.

Cybersecurity is becoming a leading sector in innovation across markets in 2024.

Public cybersecurity companies are reaching unprecedented market capitalizations in 2024.

Major cybersecurity players are focusing on acquisitions to build comprehensive platforms.

Consolidation and platformization in cybersecurity reflect a strategic shift towards efficiency

Basic security hygiene remains foundational amidst advancing technological threats and solutions.

Compliance and regulation challenges underscore the growing importance of governance in cybersecurity

TTPXHunter extracts 193 TTPs from threat reports.

Achieves 97.09% f1-score on real-world reports.

Outperforms existing TTP extraction methods.