Tag: cybersecurity

  • AI, Supply Chains, and the Next Cyber Battlefield

    AI, Supply Chains, and the Next Cyber Battlefield

    I regularly track developments in cybersecurity, artificial intelligence, critical infrastructure, and geopolitical competition.

    Most of these stories disappear into the daily news cycle.

    A few feel different.

    A few reveal where technology is heading, how conflict is changing, and what tomorrow’s risks might look like.

    These are the signals that have captured my attention recently.


    Signal #1: AI Is Becoming an Operational Security Tool

    The conversation around AI often focuses on productivity and automation.

    The more interesting development is operational decision-making.

    Organizations are increasingly using AI to triage alerts, investigate suspicious activity, summarize incidents, and assist analysts during security operations. At the same time, attackers are experimenting with AI-assisted reconnaissance, vulnerability discovery, and social engineering.

    The race is no longer simply human versus human.

    It is becoming machine-assisted defenders versus machine-assisted attackers.

    Why It Matters

    For the first time, cyber conflict is beginning to scale beyond purely human decision-making.

    The side that can accelerate decisions fastest may gain a significant advantage.

    Organizations that learn how to effectively combine human judgment with machine speed may find themselves far better positioned than those relying on either one alone.

    Now Picture This…

    A nation-state launches a coordinated cyber campaign against multiple critical infrastructure providers.

    Human analysts cannot keep pace with the volume of alerts.

    Both attackers and defenders rely on competing AI systems making real-time decisions.

    At first, everything appears normal.

    Then one of the defensive AI systems begins making recommendations nobody fully understands.

    The analysts face a terrible choice:

    Trust the machine—or turn it off.


    Signal #2: Supply Chains Remain the Soft Underbelly

    supply chains

    The largest organizations in the world continue to invest heavily in cybersecurity.

    Attackers increasingly look elsewhere.

    Software vendors, contractors, managed service providers, and cloud partners remain attractive targets because compromising one trusted organization can provide access to hundreds—or thousands—of others.

    The strongest front door in the world matters little if someone leaves a side entrance unlocked.

    Why It Matters

    Modern societies depend on invisible trust relationships.

    Most people never see them.

    Attackers do.

    As organizations become increasingly interconnected, the security of one company becomes dependent upon the security of many others.

    Now Picture This…

    A small software company wins a contract supporting critical government infrastructure.

    The celebration lasts exactly one day.

    Unknown to everyone involved, the company was compromised eighteen months earlier.

    The vendor was never the target.

    The contract was.

    The attackers simply waited patiently for the right door to open.


    Signal #3: Critical Infrastructure Is Becoming a Battlespace

    critical infrastructure

    Electricity, transportation, communications, water systems, healthcare, and logistics networks are increasingly viewed through a national security lens.

    Governments around the world continue investing in resilience, redundancy, and incident response capabilities.

    That investment is occurring for a reason.

    Modern economies depend on digital systems that were never originally designed to operate in a contested environment.

    Why It Matters

    The distinction between cyber attacks and real-world consequences continues to blur.

    The question is no longer whether systems can be compromised.

    The question is what happens when digital disruptions begin producing physical effects at scale.

    Now Picture This…

    A regional power outage initially appears to be an equipment failure.

    Three days later, investigators discover similar incidents occurred across multiple jurisdictions over the previous six months.

    Each event was small.

    Each event was explainable.

    Each event was ignored.

    Viewed together, however, a disturbing pattern emerges:

    Someone isn’t attacking.

    Someone is rehearsing.


    What’s On My Radar

    • AI-enabled cyber operations
    • Critical infrastructure resilience
    • The expansion of cyber competition between major powers

    Most cybersecurity headlines focus on individual incidents.

    The larger story is the gradual normalization of cyber conflict as a persistent element of modern competition.

    For thriller writers, strategists, and anyone interested in the future, that may be the most important signal of all.

  • Worth reading this week – Cyberstalking, Leaks, Pi, startups, Libra, Internet trends

    Worth reading this week – Cyberstalking, Leaks, Pi, startups, Libra, Internet trends

    Quote I’ve been pondering:

    “A mind all logic is like a knife all blade. It makes the hand bleed that uses it.” – Rabindranath Tagore

    And this one came into my inbox last minute and had to include it this week as well:

    “I will have to remember ‘I am here today to cross the swamp, not to fight all the alligators.’”
    — From The Art of Possibility by Rosamund and Benjamin Zander

    He Cyberstalked Teen Girls for Years—Then They Fought Back – excellent reporting (as always) from Wired on the dangers of cyber stalking and the dangers that teens face in the never ending attempts by creeps to extort over nude selfies. Kids shouldn’t have to feel this way:

    “Any type of security thing can happen,” she said. “They can hack anything.” Her shoulders slouched, and she directed her voice to the table where we were sitting. “I just never envisioned that, and it’s just … We shouldn’t have to live in a world where we don’t know if people are real or not.” She folded her arms around herself and bit her lip to stop herself from crying.

    Parents need to be better informed about this and they need to equip their kids to be safe online.

    Oops: Personal data of 2.7 million people leaked from Desjardins (more coverage). A rogue employee took the data with him/her. This is difficult to prevent. As an infosec pro, I know firsthand just how difficult it is to find a balance between security and business productivity. In many cases, companies err on the side of convenience and ease of access to data. Unfortunately, we continue to see the results of not locking down data sufficiently. That said, there is lots that can be done.

    AttunityOops – part 2: TD Bank internal files found online in ‘keys-to-the-kingdom’ cloud data exposure (more from ZDNet) This one is simply shameful: “Attunity, a company that manages and safeguards data, left internal files exposed on the internet for clients including Ford and TD“. “Exposed data includes passwords and private keys for production systems, employee details, sales information.” “A company that manages and safeguards data”? Wow. It’s one thing for a non-security company to bungle access to their data, but it is quite another when a company who specializes in safeguarding data does it. I suspect Attunity sales / technical reps are fielding calls from their major clients today to discuss the status of their data and their contract renewals.

    RPi-Logo-SCREENNew Raspberry Pi 4: I love these tiny computers (buy now!). My only problem is that I don’t have much time to tinker anymore. Probably a good thing or I’d have a whole army of them around the house. HackerNews doesn’t disappoint with a crowdsourced list of plenty of interesting (or not) things to do with a Pi.

     

    Wanna do a start up? I’ve tinkered with starting my own business for years, but find it difficult to make the leap when I have been fortunate enough to have an interesting career working for other people. That said, I’ll always be a dreamer. My latest trigger article: Startup idea checklist. Such a good sanity check on building a business. And, some motivational reading as well: How I bootstrapped my side project into a $20k/mo lifestyle business (and my new indie business motivation website)

    companyofoneSpeaking of startups, I stumbled across this book online: Company of One: Why Staying Small Is the Next Big Thing for Business by Paul Jarvis . It looks similar to The Million-Dollar, One-Person Business: Make Great Money. Work the Way You Like. Have the Life You Want by Elaine Pofeldt, which I loved. Tons of great tips and motivation on building a sustainable, profitable one person business. We are all experts at something and we’ve all got something to sell. I haven’t purchased Company of One yet, as my backlog of books to read is huge, but I suspect I’ll pick up a copy soon to motivate me while distracting me from actually doing the work of building my own side hustle.

    I missed last week’s post, but had this queued to go out, so I’ll still keep this in this week’s post: The big news last week: Libra – a Facebook-led digital crypto-currency. Plenty of press on this one. The best quick summary I’ve read thus far is by the entertaining writers at The Hustle. Hard to say how well adoption will go – government oversight (boosted by financial industry lobbyists, no doubt) could yet hobble it. But, if they make it easy (embedded in existing systems like Facebook and the gang), secure and stable (the lack of a financial bubble a la bitcoin), then I suspect it’ll take off.

    Key findings from the Internet Trends report (as reported in The Idea’s June 17 email):

    Mary Meeker released her latest annual Internet Trends report at Recode’s Code Conference. Below are some of the findings most pertinent to the news media industry:

    • 15% of all retail sales are now though e-commerce. E-commerce is growing at 12.4%, and regular retail is growing at just 2%. (Ed note: look out for how publishers continue to capitalize on this growing industry through affiliate links.)
    • Digital ad spending grew 22% in 2018
    • Google and Facebook still dominate the digital ad market, but Amazon and Twitter are growing
    • 62% of all digital display ad buying is of programmatic ads, and that number is growing
    • Customer acquisition costs are increasing, sometimes exceeding customers’ lifetime values for digital subscription companies. Meeker suggests that free trials can be a cost effective way to alleviate that cost.
    • Time spent with digital media is still going up. Americans in 2018 spent 6.3 hours a day, 7% higher than the year before. More than 25% of U.S. adults are “almost constantly online.”

    Note: the above stats were all taken from Atlantic Media’s The Idea June 17 email – I don’t want to claim any credit for the summary presented above! If you are interested in the media industry, I highly recommend subscribing to their mailing list.

    I think that’s it for this week. For my Canuck readers, enjoy the long weekend!

    Todd