These research efforts demonstrate the wide range of applications for RNNs in cybersecurity, highlighting their effectiveness in areas such as intrusion detection, malware analysis, user behavior modelling, spam detection, network traffic analysis, and vulnerability detection. By leveraging the capabilities of RNNs, researchers are striving to enhance cybersecurity measures and mitigate emerging threats.
![Paranoid Pawn - A Cybersecurity Blog](http://4.bp.blogspot.com/-2BhQTPpm2A0/YFAvgujbQHI/AAAAAAAABRE/ccKgfpaK4aURLMPXHwMbVEAAtPg5dncfACK4BGAYYCw/s752/ParanoidPawnBlogspot3.png)
In an era of rapid technological change security practitioners look to connect and adapt to increase and maintain organizational security strength. A healthy paranoia is necessary and the conceptualization of overall strategy must converge with the adept orchestration of security monitoring and controls. This blog is about that convergence where I seek to build a complementary security content that relates to my Paranoid Pawn YouTube channel videos. Please subscribe!
Saturday 10 June 2023
Unlocking the Potential: Recurrent Neural Networks (RNNs) at the Forefront of Cybersecurity
These research efforts demonstrate the wide range of applications for RNNs in cybersecurity, highlighting their effectiveness in areas such as intrusion detection, malware analysis, user behavior modelling, spam detection, network traffic analysis, and vulnerability detection. By leveraging the capabilities of RNNs, researchers are striving to enhance cybersecurity measures and mitigate emerging threats.
Monday 5 June 2023
Book Review: "An AI Product Manager's Handbook" - An Effective Wholistic 10,000 foot View
Book Review: "An AI Product Manager's Handbook" - An Effective Wholistic 10,000 foot View
In the ever-evolving landscape of artificial intelligence (AI), the role of a product manager has become increasingly crucial. "An AI Product Manager's Handbook" attempts to serve as a comprehensive guide for professionals seeking to navigate this complex domain. However, while the book covers a range of relevant topics, readers wanting a deeper exploration into the application of engineering and technology AI will still be searching after the read (which I consider a very good thing). This book delivers on being a great way to see the entire forest before parachuting into it.
Moving on, the book delves into the role of a product manager in an AI-focused organization, highlighting the unique challenges and responsibilities they face. It explores the process of defining AI product goals, prioritizing features, and managing the development lifecycle. The content is well-organized and the concepts are adequately explained, although the material lacks much coverage of AI security (which, to be fair, deserves its own book).
One of the book's strengths lies in its coverage of ethical considerations and responsible AI practices. It delves into the importance of fairness, transparency, and accountability in AI systems, emphasizing the need for product managers to consider the potential social impact of their products (which, to be fair, also deserves its own book). I am seeing a potential series for this author.
Moreover, the book does contain trends in AI and takes a look at the highest growth areas from research companies like McKinsey, Forrester and Gartner. Product Mangers will also gain insights on the shortest pathways to AI enablement. The author underscores the importance of having solid use cases when enabling AI in your organization. These use cases will help your product viability and impact KPIs and ROI.
In conclusion, "An AI Product Manager's Handbook" really delivers on originality and and breadth of topics promised. It covers the essential aspects of AI product management, and offers unique insights and provides practical guidance that sets it apart as something with core relevance to what is taking place now with these disruptive technologies. The book's style and topics are engaging and will elevate the reader quickly into the headspace of advancing their product with AI.
....and before we can secure AI, use it for security, or secure ourselves against it as well, we have to learn about it.
Wednesday 6 October 2021
To Heck with Vulnerability - 2020
Once each year closes it can be nice to take a step back and at the end of 2020, as if a viral pandemic wasn’t bad enough, we had to deal with digital weaknesses that left us open to more human attacks against our digital infrastructure.
One of the things I’d like to point out about vulnerability is that the vulnerabilities reported for a current year may or may not be the ones that the the most frequent top attacks are actually using to actively exploit targets for that year.
The grand majority of top vulnerabilities reported by the US Cybersecurity & Infrastructure Agency that were used by attackers for exploit in 20202 were not reported in 2020 but earlier. Which proves that the longer organizations take to patch, the longer the vulnerability will be useful to attackers thereby increasing the general global attack surface.
The vulnerabilities disclosed by year is looking like a Bull Market. Something tells me there won't be any crash in this trajectory line.
CVE stands for Common Vulnerabilities and Exposures. CVE numbers are assigned by a CVE Numbering Authority (CNA) - MITRE is the primary CNA now. The names of each vulnerability follow a naming convention of CVE-[Year Reported]-[Arbitrary Digits].
The vulnerabilities that I cover in my video CVE Rogues Gallery [2020 Edition] - Vulnerabilities and Exposures can be seen here:
Based on government data reported by the US Cybersecurity Infrastructure Security Agency, (CISA), in their exciting and newly revised Alert (AA21-209A) (as of August 2021), the majority of top vulnerabilities that were identified as used by attackers for exploit in 2020 were not reported in 2020 but earlier.
In 2020, more than 66 percent of the top CVEs used were reported in previous years. Only about 33% of the top CVEs targeted for attack that fell onto this list were actually reported in 2020. Patching quickly and remediating ahead of the curve is still extremely important. Attackers can easily discover your weak spots. And the point is, those threat actors don’t care when the CVEs were published or released, they just hope you are late to remediate.
Top Routinely Exploited Vulnerabilities 2020: CISA Alert (AA21-209A): https://us-cert.cisa.gov/ncas/alerts/aa21-209a
But make no mistake, it isn’t just Critical and High severity CVEs that you need to worry about, - even low and medium severity vulnerabilities, when chained together can lead to full compromise.
General recommendations that are in-line with protecting against these vulnerabilities are:
Don’t leave services on if you don’t need them
Make patching and upgrading a priority
Don’t allow users administrative credentials just because they want it. Make sure there is a business need. Their primary login should be a standard user account and not an administrator account
Train users to understand that they are part of the security stack of your organization. The security controls that you have implemented in your organization don’t have magic powers and still require users to act cautiously, with mindful deliberation and with security in mind.
The best advice is to have a serious and responsive upgrade and patching program, a dedicated Vulnerability Management practice, Incident Response Management, a solid implementation of defense-in-depth with your Security Stack and cyber hygiene.
Sunday 12 September 2021
Building a Common Language - CVSS (Common Vulnerability Scoring System)
CVSS Industry Use Cases
- National Vulnerability Database Analysts: These analysts use the CVSS to attribute scores to newly disclosed and discovered vulnerabilities. The vulnerabilities and their assigned CVSS score can be found in the National Vulnerability Database (NVD).
- Security Analysts, Security Researchers, Auditors, Pen-testers, Threat Actors: Red-teamers, blue-teamers, and threat actors alike have access to rely on CVSS scoring in order to understand system vulnerability, plan attacks and implement countermeasures. (choose the light)
- Makers and providers of vulnerability scanning, and Endpoint Detection and Response Platforms: They can leverage the NVD feed to provide CVSS scoring for host and device scans.
- Makers, providers, users of SIEM and Log Collection platforms: They can attempt to detect CVEs being actively exploited and apply a severity score that correlates to a perceived vulnerability to address countermeasures during and after attack.
- CVSS Current Specification: https://www.first.org/cvss/specification-document
- CVSS User Guide: https://www.first.org/cvss/user-guide
CVSS Versions and Release Dates
CVSS Version | Year Released | Limitations |
CVSSv1 | 2005 | Had not been peer reviewed when released. |
CVSSv2 | 2007 | Questions of accuracy due to lack of granularity in several metrics, weak definitions that resulted in less accurate scoring. Slow to accommodate the changing landscape of modern risk. Of a scoring range that had levels 0-10, only had 3 levels of severity - Low/Medium/High. |
CVSSv3.0 | 2015 | Accounted for the physical attack layer, but still did not address major issues with scoring for confidentiality of data amongst other unresolved issues. Levels of severity increased from 3 to 5 levels of a 0-10 scoring range - None/Low/Medium/High/Critical. |
CVSSv3.1 | 2019 | Includes updates to the user guide, a framework for extending the CVSSv3 to provide flexibility for industry verticals including healthcare, automotive and industrial sectors. Formulation and scoring improvements. |
Mapping CVSS to MITRE ATT&CK
Common Languages Change and Evolve
Thursday 11 March 2021
TryHackMe: Nessus Room Writeup
On TryHackMe, the Nessus room not only introduces us to vulnerability scanning but it is a reminder that even the home user, student and hobbyist can run a cybersecurity vulnerability scanner at home with Tenable Nessus Essentials.
Nessus Scanner requires about 30GB of initial disk space. That disk space requirement will grow over time because Nessus will store the results from each scan into its database. Also as Nessus plugins get released and updated, that will also cause the data storage size to increase.
The Nessus room consists of 5 tasks:
Introduction - where you learn about Nessus scanner’s basic purpose
Installation - where you learn how to install Nessus on Kali Linux
Navigation and Scans - where you learn to move about the console
Scanning! - Lab with a target machine that you can run scans against
Scanning a Web Application! - Lab where you perform a specialized web app scan
The last 3 of the above tasks are those that require responses in the room. Make sure that when you work in this lab you are using your own Kali Linux machine (or VM) and connecting to the Nessus room labs with openVPN. This is because the minimum Hardware Requirements (https://docs.tenable.com/nessus/Content/HardwareRequirements.htm) for Nessus is 30GB of disk space for Nessus itself. The AttackBox on TryHackMe has 25GB of disk space (at the time of publishing this writeup) in total which will not accommodate the Nessus installation.
Navigation and Scans
THM: What is the name of the button which is used to launch a scan?
THM: What side menu option allows us to create custom templates?
THM: What menu allows us to change plugin properties such as hiding them or changing their severity?
THM: In the 'Scan Templates' section after clicking on 'New Scan', what scan allows us to see simply what hosts are alive?
THM: One of the most useful scan types, which is considered to be 'suitable for any host'?
THM: What scan allows you to 'Authenticate to hosts and enumerate missing updates'?
THM: What scan is specifically used for scanning Web Applications?
Scanning!
THM: Create a new 'Basic Network Scan' targeting the deployed VM. What option can we set under 'BASIC' (on the left) to set a time for this scan to run? This can be very useful when network congestion is an issue.
New Scan button > Basic Network Scan > Settings > Schedule
THM: Under 'DISCOVERY' (on the left) set the 'Scan Type' to cover ports 1-65535. What is this type called?
After the scan completes, which 'Vulnerability' in the 'Port scanners' family can we view the details of to see the open ports on this host?
If you click on the above line-item, you will navigate to a detail page that shows which ports have been detected:
THM: What Apache HTTP Server Version is reported by Nessus?
To find the version of Apache HTTP Server click on the below line-item:
You will find the version in the following detail view:
Scanning a Web Application!
This scan you will set up like the Basic Network Scan but you will select the Web Application Tests as the Scan Type.
- New Scan button > Web Application Tests
- Enter the ip into the target text field
- Click Save
- Launch the scan and wait for results
In the vulnerabilities Tab of the scan you will notice a grouping of 2 vulnerabilities:
Click on the HTTP (Multiple Issues) line-item and you will see the following:
Then click on the line item “HTTP Server Type and Version” and you will see the plugin ID as shown below:
THM: What authentication page is discovered by the scanner that transmits credentials in cleartext?
Click on the line item “Web Server (Multiple Issues)”.
Then click on the line-item “Web Server Transmits Cleartext Credentials:
Under the Output section you will see the page that transmits cleartext Credentials:
THM: What is the file extension of the config backup?
Click on the “Backup Files Disclosure” vulnerability line-item:
The extension can be found under the Output section in the vulnerability detail:
THM: Which directory contains example documents? (This will be in a php directory)
THM: What vulnerability is this application susceptible to that is associated with X-Frame-Options?