Alex Stamos

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

The United States has spent two years supporting Ukraine in one ground war and seven months backing Israel in another, and it continues to prepare for the possibility of a third in Taiwan. But arguably its most persistent focus has been on a far longer-running, more perennial, borderless battle over cyberspace and the future of technology.The State Department unveiled its own piece of that ever-expanding policy priority this week with the release of its International Cyberspace and Digital Strategy, which lays out a doctrine of “digital solidarity” that emphasizes the role of technology in diplomacy and the need to build international coalitions to uphold an “open, inclusive, secure, and resilient” internet through “responsible state behavior” in cyberspace. The strategy document, unveiled on Monday, sits at the intersection of three hallmarks of the Biden administration’s first term: an escalating conflict with adversaries such as Russia and China that frequently plays out in the cyber realm; an emphasis on “minilateralism” by building international coalitions and partnerships among smaller, targeted groupings; and a determination to maintain the United States’ global technological primacy. “Today’s revolutions in technology are at the heart of our competition with geopolitical rivals,” U.S. Secretary of State Antony Blinken said while announcing the strategy at the RSA Conference in San Francisco, which is Silicon Valley’s biggest annual gathering of cybersecurity professionals. “Our ability to design, to develop, to deploy technologies will determine our capacity to shape the tech future, and naturally, operating from a position of strength better positions us to set standards and advance norms around the world,” Blinken added. “But our advantage comes not just from our domestic strength. It comes from our solidarity with the majority of the world that shares our vision for a vibrant, open, and secure technological future, and from an unmatched network of allies and partners with whom we can work in common cause.” Speaking to reporters just minutes after that speech, Nathaniel Fick, the U.S. ambassador at large for cyberspace and digital policy, outlined the importance of those global partnerships in setting broader norms and collectively calling out contraventions by the likes of Russia and China. “It’s easy to pick on one kid at the playground. It’s harder to pick on 30 kids,” he said. “So building durable coalitions in these attributions matters.” https://lnkd.in/g6JxMzEG

4

1 Comment

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

As we near the U.S. elections in November 2024, it's clear that the battleground extends beyond politics to the digital sphere. Cyabra's recent study reveals a concerning surge in fake social media accounts, including a significant number of bots aimed at manipulating public opinion. The use of bots to amplify content and create false consensus is a growing threat that demands our vigilance. I'm thrilled to be included in this important article from Techopedia. Misinformation, especially through advanced bots and generative AI, poses a serious challenge. Researchers have noted a staggering tenfold increase in fake accounts during March and April alone. To combat this issue, it's imperative to verify sources, diversify news intake, and report suspicious accounts actively. In this crucial time, each of us plays a vital role in upholding the integrity of our democratic processes. Let's embrace this responsibility and work together to ensure that truth prevails. Stay informed, stay skeptical, and let's safeguard our elections. Read more about the study here: https://lnkd.in/epmTtuup

11

All eyes are on $CSCO as the tech bellwether reports after the market closes today. Key themes to watch for from Chuck Robbins and company... Splunk integration Security momentum Networking for AI

22

4 Comments

Colorado's governor signed the Artificial Intelligence Act, Senate Bill (SB) 24-205, on May 17, 2024. This law will come into effect on February 1, 2026. Overview of the AI Act - Scope: SB 24-205 sets a new standard for AI use in hiring, employment, and consumer services in Colorado. It mandates a duty of reasonable care for developers and deployers of AI tools to prevent algorithmic discrimination. - Target Groups: The law applies to both "developers" (those who create or modify AI tools) and "deployers" (those who use these tools), especially in high-risk areas. - Protected Categories: The law protects a wide range of categories, including age, color, disability, ethnicity, genetic information, language proficiency, national origin, race, religion, reproductive health, sex, veteran status, and other classifications protected by state or federal law. Compliance Requirements - Duty of Care: Developers and deployers must exercise reasonable care to avoid discrimination based on the protected categories. This involves extensive transparency, notices, analysis, and documentation. - High-Risk AI Tools: The law focuses on high-risk AI tools, requiring developers and deployers to prevent differential treatment or impact on protected categories. - Exceptions: There is an exception for employers with 50 or fewer employees. Impacts on Employers - Compliance Burden: The law imposes significant compliance requirements, which could discourage the use of AI tools in Colorado. Employers must provide detailed notices, describe AI tools in plain language, manage known or foreseeable risks, and conduct impact assessments. - Notice Requirements: Employers need to inform individuals about the AI tools used, explain their risks, and describe how these tools contribute to decision-making processes. This involves considerable time and financial resources. - Opt-Out Rights: The right to opt out of profiling means employers must create alternative, non-AI systems for those who choose not to be evaluated by AI tools. - Individual Appeals: The law allows individuals to appeal decisions made by AI tools. This could lead to human review for every unsuccessful applicant, potentially overwhelming hiring operations. Potential Challenges - Extra-Territorial Impact: With remote work becoming common, employers may struggle to determine if an applicant is a Colorado resident, complicating compliance. - Parallel Systems: Employers will need to develop non-AI systems for those opting out of AI profiling, reducing the efficiencies gained from AI. - Operational Overload: The requirement for human review of AI decisions could slow down hiring processes significantly. The broad scope and detailed requirements of this law may present challenges for employers, particularly in managing compliance and maintaining operational efficiency. #AI #regulation #law

3

5 Comments

📣As we observe Memorial Day, I'd like to share some thoughts on the vastness and connectivity of the Internet. It's astounding how we interact with millions of people, many of whom we know little about. As a Marine and a war veteran🪖, I've had experiences where individuals approached me with questionable intentions, often revealing hidden agendas.🥸 In the realm of cybersecurity, vigilance is crucial. Platforms like WhatsApp and Signal are popular for their encrypted communications, but they come with their own sets of risks and considerations. While Signal is secure, it has been decrypted for court cases, which raises questions about privacy. WhatsApp, on the other hand, is often criticized for security, but its point-to-point encryption ensures conversations remain private.🔐 As someone experienced in detecting potential threats, I understand the importance of cybersecurity. However, many citizens lack this awareness. It's crucial to remain cautious when engaging with others online, as we may unknowingly interact with individuals with harmful intentions. On this Memorial Day, let's remember the sacrifices made for our freedoms and acknowledge the importance of security in protecting those freedoms. Without vigilance and sacrifice, our liberties could be at risk.🧐 Let's honor those who have served and continue to safeguard our nation. #Memorialday #technology ##Leadership https://lnkd.in/epnSXFiW

4

Researchers at Forescout Technologies Inc.‘s #VedereLabs discovered 90,000 unknown vulnerabilities and risk blind spots in standard vulnerability guidance. These vulnerabilities, not included in the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities (KEV) catalog, pose potential risks that cyber adversaries could exploit. The analysis also revealed inconsistencies in scoring vulnerabilities across databases, a process typically conducted using CVSS scores within the CVE ecosystem. The data indicates that the most exploited #OT and #IoT devices include network attached storage (NAS) at 21 percent, IP cameras at 17 percent, building automation devices at 12 percent, and VoIP equipment at 11 percent. “Vulnerabilities are being found, weaponized, and exploited in the wild faster than ever before, with 97 0-days exploited in 2023 and already 27 this year,” Elisa Costante, vice president of research at Forescout Technologies Inc. Research – Vedere Labs, said in a media statement. “Current methodologies for cataloging issues such as MITRE’s Common Vulnerabilities and Exposures (CVE) system and NIST’s National Vulnerability Database (NVD) are critical tools but have significant limitations." https://lnkd.in/gKgVyBEx

11

If you are following along on the CUI program home game, you know that the CUI program was created to apply a consistent set of requirements across the entire Executive Branch of the federal government which define what is sensitive, unclassified information and how that information should be safeguarded and disseminated. These requirements are defined in 32 CFR 2002, which was published in 2016. When the United States Department of Defense first created DoDI 5200.48 back in 2016 (DoDI 5200.48 defines DoD's implementation of the CUI program), 32 CFR 2002 was pretty new and, understandably, the early version of 5200.48 had some inconsistencies. DoD released an updated version of DoDI 5200.48 about a year and a half ago, and it addressed some of those inconsistencies. DoD recently released an updated policy memo which makes some additional changes to 5200.48. https://lnkd.in/gmsySBBq Those changes have, unfortunately, created a bit of added confusion about when CUI can be disseminated to authorized holders, and especially when: a) the disseminator is a government contractor; and b) the authorized holders are not US persons. The CMMC Information Institute put together the flowchart, below, to try to help walk government contractors through when CUI can be disseminated to someone who is not a US person (or, really, anytime). Hopefully it is helpful!

56

14 Comments

Last week was undoubtedly “PQC Week,” with an abundance of news highlighting advancements in Post-Quantum Cryptography (#PQC). From Zoom's announcement of PQC KEM integration to the US Government urging federal contractors to enhance encryption once NIST finalizes standards for Dilithium (Module-Lattice-Based Digital Signature Standard - ML-DSA FIPS-204) and SPHINCS+ (Stateless Hash-Based Digital Signature Standard - SLH-DSA - FIPS-205), it’s clear that PQC is making headlines. Few Highlights: Enterprise Initiatives: Zoom has taken a significant step by incorporating PQC Key Encapsulation Mechanisms (KEM) into their products, demonstrating a commitment to future-proofing their security. Government Mandates: The US Government is pushing federal contractors to adopt stronger encryption protocols swiftly, in line with National Institute of Standards and Technology (NIST)'s upcoming standards for FIPS-204 and FIPS-205. This underscores the critical need to transition to PQC. Emphasizing Crypto-Agility: While moving towards PQC is essential, the first step should be achieving #crypto-agility. Regardless of the strategy for adopting stronger encryption algorithms or regulatory requirements, it’s crucial to start with a comprehensive discovery and inventory of cryptographic assets. Discovery Solutions: Effective migration to PQC begins with a thorough discovery process. Identifying all cryptographic assets within an environment ensures a strategic and efficient transition, laying a solid foundation for implementing quantum-resistant algorithms. This essentially will act as the first Cryptography Bill of Materials (CBOM) for your organization. A journey of a thousand miles begins with a single step. For PQC, that step is a deep and wide discovery of your cryptographic landscape. https://lnkd.in/gUjaP6rV

97

4 Comments

This should be part of every company's and board's quarterly Threat Landscape briefing. There is a reason why these warnings are increasing in frequency and urgency. Ignoring them is beyond foolish. #greatpowercompetition #economicwarfare #criticalinfrastructure #cyberwarfare #cyberattack #cyberdefense #cyberresilience #ciso #cio #ciro #cro #ceo #boardofdirectors

52

2 Comments

Yet another report from Forescout Research - Vedere Labs. This time we looked into exploited vulnerabilities, the catalogues available and the impacted devices! Have a read. https://lnkd.in/griGMznV

17

There's a Lunar Backdoor? "ESET Research discovered two previously unknown backdoors – LunarWeb and LunarMail – used in the compromise of a European MFA and its diplomatic missions. LunarWeb, deployed on servers, uses HTTP(S) for its C&C communications and mimics legitimate requests, while LunarMail, deployed on workstations, is persisted as an Outlook add-in and uses email messages for its C&C communications. Both backdoors employ the technique of steganography, hiding commands in images to avoid detection. Both backdoors utilize a loader that uses the DNS domain name for decryption of the payload, share portions of their codebases, and have the unusual capability of being able to execute Lua scripts. The loader can have various forms, including trojanized open-source software, demonstrating the advanced techniques used by the attackers."

1

I have a new blog post in which I compare and contrast how privacy laws are proposed and implemented in California and at the Federal level. This is very analogous to software development: in California, it is open and agile, while at the Federal level, it is closed and waterfall. https://lnkd.in/gW387JRZ

34

1 Comment

Rust addresses critical vulnerability on Windows in std lib

2

Are you scratching your head trying to figure out your new SBOM requirements? Our new phase of "Digitial Safety" will replace Cybersecurity with requirements seen in other fields of civic society. Knowing what is in your software, hardware, and silicon is no different from learning the materials used to build a skyscraper. SBOM requirements are inevitable. Check out Nigel Hanson's series of SBOM articles on Digitial Safety. https://lnkd.in/gYh-by7W . #sbom

8