Practive Security

Preparing you to protect yourself, your family, or your business from online threats in this digital age.

[Practive Security @PractiveSec]

A new welcome and website preview video has been added to our Essentials Membership landing page. If you are curious to see what Members have access to...watch and learn:

https://t.co/d4FHM0WBBj

[Practive Security @PractiveSec]

SOC Analysts are often told they should be engaged in threat hunting, but they often don't know where to start or where to look, and often they are led to fruitless wandering in the forest of data, searching for the unknown. This is futile and often fruitless. Some are tempted to outsource hunting to those who claim to be experts at it. But it's actually not complicated. We just approach it wrong.

You hunt where it matters. You watch your prize. You hunt where the prize is because that is what your adversary is working toward. When you narrow your field of view and look in specific places for the variations that should not be, then hunting becomes simple and possible.

Wandering the forest of data looking for IOCs is to search in vain. Your adversary is rarely found wandering the the forest lumbering about attacking at random. And if they are, then you can already defend against them without needing to hunt for them.

Learn more tips like these by signing up for our Business Essentials Membership. We publish articles ranging from simple lessons learned to strategic pillars of cyber security to practical guidance to common questions and cybersecurity topics. After decades on the front lines, we have plenty of wisdom to share. Tap in today at https://t.co/A3WTeZ3ho4

[Practive Security @PractiveSec]

Cybersecurity is won or lost strategically, not tactically.

Tactics (operational practices) should be used to measure, maintain, and restore your strategic state of security.

Tactics (operational practices) need not be spent chasing threat alerts, IOCs, and adversaries.

If you are doing that, then you have already lost strategically. It's time for a mindset shift. Time to learn from the lessons of the past. Time to do what we know works.

[Practive Security @PractiveSec]

The cybersecurity product and service companies have started a new sales pitch: "AI is embedded across the attack lifecycle."

What does that mean? It means that hackers and other cyber threat actors have access to tools that can help them scale: do more with less. This gives them more volume, capacity, capability, and speed. Is this a strategic advantage that gives them the edge over defenses?

No. Cybersecurity defense is strategic in nature and accounts for these variables. We always assume that if one adversary can, then any can. We assume there is an unknown and exploitable vulnerability in our software. We assume a system will be breached and a service taken advantage of.

That's why we build cybersecurity strategically in layers: so we can be resilient against an ever-escalating attack surface.

The adversary can only attack what you present to them. You own the terms of the engagement. Choose wisely.

[Practive Security @PractiveSec]

Surprised by the cybersecurity headlines? We aren't. But then again, we've been at this for decades, helping organizations from small to the largest in the world.

If you'd like help cutting through the noise and learning what you need to know to protect all that you are from online threats, sign-up today for our Essentials Membership to gain access to our library of information designed to be practical and effective in everyday life.

Essentials members also receive security advisories from us, strategic guidance, analysis of events, answers to FAQs, and more.

https://t.co/BG7fOzJn3t

[Practive Security @PractiveSec]

Practive Security 101 in paperback: https://t.co/AtnmjMlSn6

[Practive Security @PractiveSec]

Cybersecurity concerns are all over the news these days and we're doing our best to watch what's going on and to advise you accordingly.

But guess what? Even in the midst of AI-powered attacks discovering decades old vulnerabilities, cybersecurity fundamentals still work.

We have created a collection of writings, podcasts, and presentations that cover the essentials of personal cybersecurity and digital health to help you protect all that you are, even against the latest attacks.

You'll find it all on our website at https://t.co/BG7fOzJn3t and you can also buy our 101 series in paperback form from https://t.co/OoY2G9Lnf0. Link below.

Arm yourself with knowledge and wisdom to protect all that you are in this ever changing AI infested age.

[Practive Security @PractiveSec]

A classic technique in social engineering is to create a sense of urgency in the victim that they cannot ignore. Urgency combined with a sense that the situation is out of control and immediate action is needed to prevent some further damage.

The situation can vary, but it is the perception of imminent danger and the opportunity to act now to end it that is the trap.

In today's world, adversaries employing this technique are everywhere. Including in your feeds. The blend in. They look normal. They seem nice.

But it comes down to intent. They mean to use social engineering to force you into an action that mostly benefits them. That's why it's critical for us to be very diligent and guarded with our trust. We have to trust others. We can't know everything. So we must be very careful about who we allow to speak to us and what we listen to.

Guard your attention. It is under attack.

https://t.co/smbru2ECOx

[Practive Security @PractiveSec]

This week @CISAgov and @CISACyber spooked a lot of people with their "Preparing for Disruption" livestream.

It's important context that this video was released in the midst of the "the Internet is breaking" firestorm. All eyes are on cybersecurity right now and AI-powered cyberattacks which are threatening widespread disruptions.

It doesn't help that a few governments around the world have also put forward guidance to citizens to be prepared for Internet and critical infrastructure outages that can last several weeks.

This, I think, caused many people to wonder, is CISA now warning us about something that they believe is imminent here in the US? Is the grid about to go down?

I reviewed the entire CISA video and I don't see or hear any overt indication that they are warning us generally. What was shared throughout this video was actually really old and really basic information. We're talking entry-level basics that should be standard practice.

In cybersecurity you always assume you are under attack, that breach is imminent, that an attack will succeed, and that disruptions will happen. That's a given and has been for decades.

This seems to have been coordinated with cybersecurity awareness month and the launch of a new CISA strategy for the country.

They did repeat the theme of asking companies and providers to be prepared to operate while isolated from the Internet for an extended period, but this is just part of cybersecurity best practices.

I really don't see anything "new" here or overtly connected to other cybersecurity events and news.

Are they warning us about something imminent? No, I did not get that impression from this video.

[Matt Johnston @MattInformed]

Hang tight. I’ll see what this is about. Don’t panic. I suspect this is just odd timing. More to come.

[Practive Security @PractiveSec]

If the Internet breaks this week (or next, or the next) due to AI-powered cyber attacks, it will be because the AI Revolutionaries want to create a "we must do something" scenario which forces a wholesale capture by AI. I wrote about that last week (link below).

Regardless, if you use cloud-based services to store files, pictures etc., it is a good practice to regularly download everything to an external hard drive that you keep detached from your computer. Might want to make sure that regular maintenance is done sooner rather than later.

[Practive Security @PractiveSec]

Humans > Machines
Human Intelligence > Artificial Intelligence
Given cognition > Simulated cognition
Having a soul > reading from code
Image of God > Image of man

Does that mean we humans have the same speed or computational scale? No. But we matter more in every way.

[Practive Security @PractiveSec]

While you are wondering about cybersecurity and what to do to keep yourself safe, secure, and well in this digital age, consider ordering a copy of our book, Practive Security 101 in which we share with you knowledge, strategies, philosophy, and practical steps you can apply in everyday life:

https://t.co/OxscaOw6lo

[Practive Security @PractiveSec]

FAQ Answered: "Exploiting PHP on a website would be game over for the website owner, right?"

No. Well, it depends. Take some time to read about the Cyber attack lifecycle, also known as the cyber kill chain.

The vulnerability exploitation stage of an attack is just the start. Once exploited, the attacker needs to be able to do something with the asset (server, service, application, account etc.) that they have compromised. The entire attack lifecycle involves:

Preparation
Staging
Weaponization
Target discovery
Delivery
Initial exploit
Establishing a foothold
Moving laterally / establishing persistence
Discovery
More lateral movement
Final objective

And there are sub-stages within that cycle and sometimes the cycle starts over and repeats inside of itself.

Many cyber attacks can only get so far before they are blocked or ended for other reasons. With the PHP vulnerability, we're talking about one part of a very long process.

It's possible that all of the above can be condensed and automated so that it happens very quickly and only at that initial layer of exploitation. But that is subject to what the adversary is actually able to do on that particular system they have exploited.

[Practive Security @PractiveSec]

FAQ Answered: "Doesn't an attacker with AI have the advantage over defenders?"

No. See answer to "should we use AI to defend ourselves." Also, the truth is, defenders always have the advantage. We choose what we deploy and make accessible and on what terms, to what outcomes, on what conditions, and to whom. Cyber attacks can only take advantage of what we expose and only if our exposures create conditions that can be exploitable to any significant gain or harm.

Right now, the most sophisticated AI models are simply doing what humans already know how to do (both attack and defense), but they are doing them at a larger scale. That is not an escalation in capability that we cannot overcome, because we already know how to defend against the attacks and combinations of attacks that AI is demonstrating.

[Practive Security @PractiveSec]

FAQ Answered: "If bad guys can use AI to attack us, doesn't that mean we should use AI to defend ourselves?"

No. Cybersecurity is won or lost at the strategic level and our existing strategies still work even against the most sophisticated attacks we have seen from AI so far.

When most people talk about or promote using AI in cybersecurity, they mean for you to do so for real-time analysis of cyber attacks and to automate actions or countermeasures to reveal and thwart malicious actions as they are happening. That's a tactical approach to solving a strategic problem.

People imagine cyber attacks as something like a race between good guys and bad guys. It's not. This is total fantasy and a false narrative often used to sell unnecessary products and services. Some companies promote the idea of "time to detect" or "breakout time," as if the challenge in cybersecurity is analyzing data fast enough to get ahead of an attack as it's happening.

That's foolish. Many cyber attacks are automated. By the time you know, it's done. And those are easy to prevent anyway. The difficult ones actually play out over long periods of time - weeks and months - so there is time to spare.

LLMs, machine learning, and data analytics platforms do have value in cybersecurity, but they are as sufficient in their mission today as they were 20 years ago.

You can use AI operationally - for discovery, code scanning, exposure discovery etc. but we have existing tools and people who can do that already...without the complications, headaches, and unforeseen problems that come with AI.

[Practive Security @PractiveSec]

FAQ Answered: "If AI can hack something, doesn't that mean it is in imminent danger of being hacked by someone else with AI? Aren't these AI companies doing us a favor by getting there first?"

No. Cyber attacks are complicated. They don't just happen. They are conducted by people who have motives, capabilities, opportunity, specific targets, and risk/reward calculations. Cyber adversaries (hackers, fraudsters, scammers etc) do not have infinite capabilities or resources or time.

And Cyber attacks play out over time and often require numerous attack cycles within what we call a "campaign" in order to achieve the final mission. Just because something is exploitable on the surface (which is what AI is finding), doesn't mean it can be exploited to achieve the final objectives of any adversary who has the intent to carry out an attack against that vulnerable target.

And the targets matter. If a cyber adversary who is financially motivated and operates extortion campaigns by stealing and selling credit card numbers comes across a website they can exploit that doesn't collect credit card numbers...then they won't waste their time. So it is with all scenarios.

The AI companies are instead creating chaos that need not be but serves their deeper agenda of total transformation of the world.

[Practive Security @PractiveSec]

FAQ Answered: "What is actually happening with all this AI hacking?"

Tactically, the AI companies are training their models on how to understand and evaluate software, and they are being trained on known tools, techniques, and procedures for attacking software. Then they are being directed to pursue evaluating and testing popular software and Internet services.

From that training they are finding "bugs" in software that if interacted with in a specific way can cause the software to do unexpected things.

When bugs that trigger unexpected actions may cause harm or some failure, they are submitted to the cybersecurity industry's vulnerability management services which categorize them and disclose them to the appropriate parties so they can be fixed.

Usually software vulnerabilities are disclosed privately so the responsible parties can fix it before it is disclosed publicly. But that depends on the nature of the vulnerability and the fix.

Right now, AI models are finding vulnerabilities and developing proof-of-concept exploit methods and the industry is rushing to fix them before they can actually be exploited in the real world.

The Internet is not being hacked. The Internet is not breaking. This is self-inflicted hysteria.

Strategically, this is the AI companies turning to malicious efforts to try to force their revolution forward. They are attacking the Internet in an attempt to take over software development, IT infrastructure Ops, and cybersecurity by force.

In other words, OpenAI and Anthropic have become cyber adversaries using their technology in a form of extortion that forces change to their advantage.

[Practive Security @PractiveSec]

FAQ Answered: "If AI models are finding vulnerabilities that have existed for 10 years, isn't that good? Doesn't that prove the value of using AI for cybersecurity?"

Not necessarily, and no.

If a vulnerability has persisted that long without us finding it or exploiting it, then it didn't really matter and its discovery is of no value.

Also, most of the vulnerabilities being discovered by AI are not exploitable, or if exploited would not result in any material impact.

[Practive Security @PractiveSec]

Link: https://t.co/2XmeCIFaVn

[Practive Security @PractiveSec]

Is the Internet breaking? That is the subject of our latest Substack article. Available free to all subscribers.

Link below.