Security Art Work

Threat detection is largely based on indicators of compromise. These indicators are observables that we identify during the management of an incident or during an investigation, that we receive from third parties in the form of intelligence feeds, that we download from platforms such as MISP, that we share among working groups… in short, we discover them or they discover them. But where do these indicators come from? In one way or another, indicators, a fundamental part of the characterisation of a threat (actor, operation…), come from intelligence analysis. In this article, we will discuss the path from intelligence gathering to the generation of indicators of compromise to detect a threat. This path is summarised in the figure below:

We all know that the various intelligence disciplines play a fundamental role in detecting threats in cyberspace. In this cyber domain, each of these disciplines (simplified SIGINT, MASINT, HUMINT, OSINT and GEOINT) has a specific weight and value, and forms the basis of what we call cyber intelligence. For example, the role of signals intelligence tends to be much more important than that of geospatial intelligence, and human sources contribute much less intelligence than signals, but much more value if well managed.

AI (Artificial Intelligence) has proven to be a powerful tool in a number of areas, including Security Governance, Risk Management and Regulatory Compliance (GRC). As AI continues to develop and play an increasingly important role in our society it is critical to recognize the value and importance of the human component. While AI offers significant technological advances, there are areas where human judgment, experience and interpersonal skills are indispensable.

We, as workers in consulting firms and specifically in the GRC area, analyze the repercussion and impact that the arrival of AI may have in our professional field.

Will AI put an end to our jobs? This is a question that after the media boom that the irruption of ChatGPT has meant in our lives we ask ourselves without being able to avoid it, therefore, I have proposed to carry out an analysis to understand if AI could replace the work we develop at our clients, so below I allow myself to add my point of view on different aspects and/or reasons why, in my opinion, I understand that it is unlikely that AI can replace or at least take over the work developed in the GRC areas of technology consultancies:

Regulatory complexity

Regulations and laws related to risk management and compliance can become extremely complex. AI can help in automating certain tasks related to the work performed by GRC areas, but interpreting regulations and making decisions in complex situations often requires human judgment and expert knowledge of the business context and sometimes even human, and no less important budgetary and financial aspects. Consulting firms play a crucial role in providing expert guidance on how to comply with regulations and adapt to regulatory changes based on clients’ needs.

Introduction

Cyber security is an important issue today. As the number of devices connected to the Internet continues to grow and more and more personal and business information is stored online, cyber security has become a major concern for businesses, governments and citizens.

Related to this, the emergence of quantum computing, with its ability to solve problems previously thought impossible with conventional systems, poses a major challenge for today’s computer security. This article examines its fundamentals and how it relates to quantum computing, as well as the potential threats and solutions being considered to meet these new challenges.

Quantum Computing: Fundamentals

Before discussing the implications of quantum computing for cybersecurity, it is important to understand how it works physically. Quantum computing is a different approach to traditional computing because it works thanks to the principles of quantum mechanics. Quantum mechanics is the theory that explains the behavior of elementary particles and how they interact with each other. It is based on the principle of quantum superposition, which states that quantum particles (such as electrons and photons) can be in several states at the same time. Instead of using bits to represent information, quantum computers use qubits that can be in multiple states at the same time.

The concept of Health 4.0 emerges as a specific derivation of Industry 4.0. But what is Industry 4.0? This concept arises in Germany in 2011, as a project to improve the industry but without a clear definition (see reference at the end of the article).

From this moment on, Industry 4.0 has been appearing with different interpretations, although there is a unified definition. Industry 4.0 is an umbrella that encompasses nine technologies that help in the transformation of industrial production and process automation.

These technologies are:

• Big Data and Data Analysis
• Simulation
• Internet of Things (IoT)
• Augmented Reality
• Cloud Computing
• Additive Manufacturing
• Autonomous robotics
• Cybersecurity
• Integration systems

The logistics sector has evolved in recent years to more complex deployments where there is a greater flow of communication between its elements. This evolution is noticeable in critical sectors such as maritime, for example, in port environments there are a large number of interconnections for the exchange of information between a wide range of systems.

Real examples show how there are more and more cyber-attacks targeting companies in the maritime sector. It is therefore essential to develop cybersecurity strategies based on system protection, attack detection and incident response capabilities. Cybersecurity must be considered from the design stage, thinking beyond functionality and considering it as a process that must be incorporated into the day-to-day operations of all companies.

Given the variety of industry best practice standards or mandatory regulations that have emerged on cybersecurity in the maritime sector, IACS, a non-governmental, technical-based organization of eleven major marine classification societies, has established new unified requirements (UR E26 and E27) on the cyber resilience of ships that will apply to ships contracted for construction on or after January 1, 2024. Cybersecurity will move from being an added value to a market requirement.

Humanity is facing new challenges that require, more than ever, a new comprehensive vision. As a result, all organizations, and society in general, are to a greater or lesser extent immersed in a process of digital transformation. This transformation is based on the incorporation of technology in all the organization’s business processes and hyperconnectivity. There has been a convergence between Information Systems (IT), Operation Systems (OT) and Consumer Technologies (CT), giving rise to an interconnected ecosystem in which the impact of one node can have direct implications for the entire chain.

From a cybersecurity standpoint, this systemic world leads to a high-risk scenario. As our business processes become more dependent on technology, the impact of a potential cyber-attack increases.

During the last quarter of 2022, the Lab52 team has conducted an in-depth analysis of the threats that have been active during the period, focusing on information from both public and private sources, as well as studying the geopolitical context in order to anticipate potential campaigns.

Below is the report for the quarter, which includes the main trends of the period, along with analysis of the most sophisticated threats and the most important geopolitical events.

The intelligence gathering and analysis carried out by the Lab52 cyberintelligence team has led to a series of conclusions and generated intelligence for S2 Grupo’s security services.

Some people may be wondering what the metaverse is, or even that it goes unnoticed in their daily lives.

Avoiding technicalities, and in order to provide a simple explanation, we can say that the purpose of the metaverse is “the creation of an immersive digital world“.

That is, a world through which users, using convergent technology such as virtual reality glasses, haptic garments, etc. can perform the same activities they do in real life (going to the movies, meeting friends, studying, working, shopping, …) and that, in turn, what happens in this digital world has repercussions in their lives. For example, it could be the case of making a purchase of a product through this digital world and it arrives at your home as if you had ordered it “in the real world”.

Although the metaverse seems somewhat novel, it is a term that appeared in the 1992 play Snow Crash, where people could interact in a virtual world through avatars. This concept was also seen years later in the video game Second Life or, more recently, in the Decentreland platform where you can even buy virtual plots of land as if it were a reality.

The increasing number of data breaches in the healthcare sector is causing serious problems in management and storage. In addition, traditional security methods being used to protect healthcare applications are proving ineffective. This is why emerging technologies such as blockchain are offering new security approaches and processes for healthcare applications, providing data confidentiality and privacy.

Data breaches are one of the main cybersecurity issues in the healthcare sector. Figure 1 shows how the amount of health record data leakage has been increasing, highlighting a large change between 2018 and 2019, a date coinciding with the start of the COVID-19 pandemic.

This post and the full series has been elaborated jointly with Ana Isabel Prieto, Sergio Villanueva and Luis Búrdalo.

In previous articles of this series (see part I and part II) we described the problem of detecting malicious domains and proposed a way to address this problem by combining various statistical and Machine Learning techniques and algorithms.

The set of variables from which these domains will be characterized for their subsequent analysis by the aforementioned Machine Learning algorithms was also described. In this last installment, the experiments carried out and the results obtained are described.

The tests have been carried out against a total of 78,661 domains extracted from the a priori legitimate traffic of an organization, from which 45 lexical features belonging to the categories described above have been calculated.