This week is the first article about Microsoft Copilot, from its basic architecture to its integration within Microsoft 365. Don't miss next week's edition, where I’ll discuss the essential security measures for Copilot » READ MORE

This week was another example of a huge data breach related to millions of Social Security numbers being leaked. Can only recommend the investigation from Krebsonsecurity.com. The background story on the company who leaked the data, National Public Data, is really interesting and worrying at the same time.

In other news the geopolitics continue to be a significant driver of cyber security activities. OpenAI confirmed they have disrupted a covert Iranian influence operation. I’m wondering how much of this aligned with the recent Microsoft report, where they mentioned, “[…] In total, we’ve seen nearly all actors seek to incorporate AI content in their operations, but more recently many actors have pivoted back to techniques that have proven effective in the past—simple digital manipulations, mischaracterization of content, and use of trusted labels or logos atop false information. […]” Interesting time and something to keep an eye on from understanding how threat actors are actually incorporating AI in their operations.

A busy Patch Tuesday from Microsoft, with six zero-days within a total of 85 CVEs. Here is a list of those 6 CVEs: CVE-2024-38213, CVE-2024-38193, CVE-2024-38189, CVE-2024-38178, CVE-2024-38107, CVE-2024-38106. If you have looked at those please prioritise, the one related to IPv6 (CVE-2024-38063) can be proven being nasty. You can find a full summary here and here. Obviously assess them within your own context to identify the ones that really matter for you.

Early August is also the time for Black Hat and Def Con 2024. Here is another pretty good summary of the key research and announcement from TechCrunch.

Check out as well some great report on Ransomware activities, which highlight that 6 ransomware groups are responsible for half of the ransomware attacks » READ MORE

Microsoft Graph: Microsoft Graph is the API framework that connects and manages data across the Microsoft 365 ecosystem, including emails, files, chats, and more. It provides real-time access to this data, ensuring Copilot can retrieve relevant information based on user permissions and context.

Large Language Models (LLMs): LLMs, such as those based on GPT-4, power Copilot's ability to understand and generate human-like text. These models interpret user prompts and generate responses by processing vast amounts of data, enabling Copilot to assist with tasks like drafting documents or summarizing information.

Semantic Index: The Semantic Index enhances data retrieval by understanding the relationships between different pieces of content. It enables Copilot to deliver more accurate and contextually relevant responses by going beyond simple keyword searches.

Grounding Process: Grounding refines user prompts by querying Microsoft Graph for relevant context before they are processed by the LLMs. This ensures that the responses generated by Copilot are specific and actionable.

Post-Processing and Orchestration Engine: After generating a response, Copilot uses post-processing to ensure the output is secure, compliant, and relevant. The orchestration engine manages these steps, integrating the response seamlessly into Microsoft 365 applications.

Plugins and Extensibility: Plugins extend Copilot’s functionality by integrating with third-party tools and services. These allow Copilot to perform specialized tasks and access additional data sources, all while maintaining security and compliance within the Microsoft 365 environment.

https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-overview

https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-copilot

Introducing Microsoft 365 Copilot | Your Copilot for Work

Six ransomware groups are responsible for over half of all compromises in 2024.

Newly disclosed vulnerabilities are the primary drivers of ransomware activity.

Law enforcement operations significantly disrupt ransomware group activities.

The U.S. accounts for over half of the global ransomware attacks in 2024.

Manufacturing and healthcare sectors remain prime targets for ransomware attacks.

Law enforcement actions are extending to organizations affiliated with ransomware groups.

Ransomware groups frequently misrepresent data sources on leak sites.

Ransomware groups use double-extortion tactics, leaking stolen data if ransoms are unpaid.

Ransomware groups are evolving and rebranding to avoid law enforcement scrutiny.

The success of ransomware has led to a growing pool of threat actors seeking fame and fortune.

1762 new posts on ransomware leak sites in the first half of 2024.

Six ransomware groups accounted for more than half of the compromises observed.

Manufacturing, healthcare, and construction were the industries most impacted by ransomware.

The U.S. accounted for 52% of total ransomware attacks in the first half of 2024.

AI augments offensive security by automating tasks and enhancing human capabilities, improving efficiency.

Human oversight is vital for validating AI outputs, ensuring accuracy and maintaining a technical edge.

AI agents' cyclic approach enables continuous learning and adaptation, enhancing complex problem-solving.

Balancing AI automation with human oversight prevents unintended consequences in offensive security.

AI lowers barriers to entry, democratizing security testing and allowing broader participation.

AI's integration into offensive security requires robust GRC frameworks to ensure ethical, secure use.

AI-powered tools process vast data, uncovering patterns unrecognizable to humans, aiding vulnerability discovery.

AI enhances professional security testers' productivity, focusing on strategic and complex tasks.

AI can autonomously exploit vulnerabilities, including zero-day exploits, with high success rates.

Offensive security must evolve with AI capabilities, fostering a culture of responsible AI use.