- Donald E. Hester
Cyber Risk Update 25 AUG 2023
This is a selection of this week's events. For more news and advisories check out our discord server.
Local Government Cyber Watch discord server. This server is focused on cybersecurity collaboration with local government stakeholders. (TLP Clear Only) Invite: https://discord.gg/PGz3NDKb5V
Cyber Incidents & Data Breaches
Tesla Data Breach Caused by “Insider Wrongdoing”. Tesla said two former employees misappropriated confidential company information and shared it with the German newspaper Handelsblatt. The data includes current and former employees’ names, addresses, phone numbers and email addresses for 75,735 people, according to Tesla's disclosure to the Maine attorney general. Tesla said it filed lawsuits against the two former employees, seized their devices, and obtained court orders preventing them from accessing or disseminating the data. https://apps.web.maine.gov/online/aeviewer/ME/40/014ae6db-4cb7-464b-b827-5d73f0bbc911.shtml
TTP & Malware
Microsoft's Threat Intel team posted a series of blogs about BlackCat’s new version of its Sphynx encryptor. Among the changes in the new version: popular post-exploitation tools Impakcet and RemCom were bundled with the encryptor.
Mandiant reports that it has seen an increase in the use of AI in information manipulation campaigns. The success of these campaigns has been fairly limited thus far. https://www.reuters.com/technology/ai-use-rising-influence-campaigns-online-impact-limited-us-cyber-firm-2023-08-17/
Despite hype, criminals struggle to use generative AI like ChatGPT for malware, with limited real world usage seen. Research from Trend Micro and Mandiant finds interesting but no groundbreaking criminal uses as AI isn't providing the exploit shortcut hackers hoped for. https://www.theregister.com/2023/08/18/ai_malware_truth/
AI & Career
It’s inevitable that AI systems will be tasked with more and more cybersecurity responsibilities. It is time to start thinking about how the roles of human CISOs and AI will evolve. The AI CISO will arise out of the arms race between attackers and defenders. https://www.csoonline.com/article/649818/are-you-prepared-for-the-rise-of-the-artificial-intelligence-ciso.html
AI is already deployed by over a third of companies according to the 2022 IBM Global AI Adoption Index and at least 40% of other companies are considering potential uses. https://www.ibm.com/watson/resources/ai-adoption
AI creates special challenges for governance processes. Laws governing business activity have been on the books a long time and make no exceptions for AI, write three lawyers from the Reed Smith firm. In this analysis, they outline how AI can create special legal risks for enterprises because the process is driven by the latest data, not programmers, and processes "can dynamically update over time both positively and negatively." https://www.jdsupra.com/legalnews/solution-for-mitigating-ai-risks-6433078/
Governance
Let NIST and ISO guide the way to IT compliance. Adhering to frameworks for IT compliance approved by the National Institute of Standards and Technology and ISO 27001 helps organizations maintain their reputations and enhance trust, writes Assad Abbas of COMSATS University Islamabad. "Organizations that do more than check off tasks must be smart about their choices," Abbas notes before covering decisions that must be made. https://www.techopedia.com/why-your-business-is-only-as-strong-as-your-it-compliance
Banned Software
The Battle to Ban TikTok and the Man at the Center of It. Montana Attorney General Austin Knudsen helped start a case that he thinks could make its way to the Supreme Court https://www.wsj.com/tech/the-battle-to-ban-tiktok-and-the-man-at-the-center-of-it-94390e0f
