Not to brag, but 2022 was a banner year for us here at Portnox!  Not content with just having an award-winning cloud-native zero trust platform, we had several major releases that continue to raise the bar for zero trust solutions everywhere.

Tackling TACACS+ – as a Service!:

How do you keep network device administration from turning into a nightmare of changing password policies, too many people having too much access, and risking constant device lockouts?   

TACACS+, of course! After all, it’s the industry standard for making device access manageable.  

Portnox released the first ever cloud-native TACACS+ service, which combines Authentication, Authorization, and Accounting (AAA) services with all the benefits of a fully cloud-native platform – e.g. we work with the equipment you have, and no nights wasted for upgrades and patches.   

Our TACACS+ service offers seamless integration with your existing identity provider, as well as key features like privilege levels and executed command logging to make network device administration simpler than ever.  

Shining a Light on the Shadows: IoT Fingerprinting

IoT (Internet of Things) devices are inescapable at this point – everything from your fish tank to your fridge can connect to the internet.  The use cases for these devices span many industries – from IoMT (Internet of Medical Things) which can monitor your health and adjust medication in real-time, to IIoT (Internet of Industrial Things) which can track inventory down to the smallest screw in seconds, to the more familiar consumer IoT which lets you control your window blinds, thermostat, lights, and more from your phone.   

But as useful as these devices are, they present an equal number of security concerns, chief among them being visibility. That’s to say – how do you know when they’re connected to your network?    

Enter IoT Fingerprinting from Portnox – the first ever cloud-native fingerprinting service that requires no on-prem installation or setup whatsoever!  No more having to watch your network slow to a crawl while running a port scanner, or painstakingly troubleshooting how to deploy a listener. You will see your IoT devices and all the information you need – make, model, OS, firmware – and still maintain the magic of a cloud-native solution with no upgrades, patches, or maintenance taking up your free time.  

What’s our secret?  DHCP Gleaning! This is a process by which the switch listens in on DHCP requests when a device joins the network and asks for an IP and extracts information from the request that helps identify the device. Many enterprise switches support this (although they may not call it Gleaning specifically; that’s actually a Cisco term.)  

DHCP Goes Even Further 

While DHCP Gleaning is an excellent method of gathering critical information about your IoT devices, the downside is that not all enterprise switches support it. And that’s another tricky thing about IoT devices – they don’t respond to traditional monitoring protocols, they often ship with all ports closed, and you can’t install extra software on them. So how do you discover and fingerprint them on your network if you can’t take advantage of DHCP gleaning? 

Enter another first – Portnox’s SaaS-based DHCP listener! This makes IoT Fingerprinting truly vendor agnostic, as any switch worth its salt will be able to configure a DHCP helper (sometimes called a DHCP relay agent or forwarder.) With a simple configuration, your device will listen for DHCP and BOOTP broadcasts and forward them to our DHCP listener. And when we say simple configuration, we mean it – here’s a sample from a Cisco IOS router:

ROUTER> ENABLE
ROUTER# CONFIGURE TERMINAL
ROUTER(CONFIG)# INTERFACE VLAN2
ROUTER(CONFIG-IF)# IP HELPER-ADDRESS 20.85.253.96  

Just 4 simple lines and you’re ready to go. Most devices support the configuration of more than one listener, too, so if you already have one set up for something else you can still take advantage of our cloud-based listener.   

Wearing Shades for the Future 

We’re pretty proud of these features, but we obviously have no intention of resting on our laurels.  We have a lot of exciting things planned for 2023 to continue our commitment to protecting your weekends from maintenance and upgrades with a cloud-native, vendor-agnostic, feature-rich, zero trust, network access control platform.  

For most of history, our species has found creative ways to use technology for both bad and good. For example, we can harness nuclear energy to produce vast amounts of clean energy, helping to reduce our reliance on fossil fuels. But we can also use nuclear power to create devastating weapons of mass destruction.

The same is true for many other technologies. Is the internet a way to unite people and revolutionize how we access information? Or is it a tool for cyberbullying, identity theft, and spreading misinformation? Well, it’s both.  

Now it’s AI’s turn to fall to the dark side. AI has the potential to transform industries, revolutionize the way we work, and improve our daily lives. And that’s precisely why it’s generated so much buzz in recent years. However, it’s also caught the attention of cybercriminals intent on using it to create AI malware, AI ransomware, and for a range of other deleterious purposes.

But how exactly are cybercriminals leveraging advanced AI tools like ChatGPT? And what are reputable industry bodies like NIST doing to stop them? Let’s get into it.  

ChatGPT & The State of Malicious AI Today 

Open AI’s ChatGPT has garnered much attention recently, with the tool reaching over one million users in just five days of its launch. But while most people are using the impressive AI for fun or to improve their workflow, cybercriminals are using it for more nefarious purposes, including:  

Phishing and spamming: Bad actors could use ChatGPT to generate convincing phishing emails or messages to lure victims into clicking on malicious links, downloading malware, or providing personal information. It can even help create convincing-sounding emails impersonating high-ranking individuals, like a CEO.  

Malware development: Cybercriminals could use ChatGPT to create more sophisticated malware that can evade detection by traditional security measures. In January 2023, Checkpoint outlined how fledgling and seasoned cybercriminals were using the chatbot to create infostealers and encryption tools.  

Scamming: ChatGPT could create convincing scams, such as investment or romance scams, that could trick victims into sending money or providing sensitive information. 

Automated attacks: Cybercriminals could use ChatGPT to automate brute-force attacks or password cracking, making it easier and faster to breach security systems. 

It’s important to note that OpenAI takes measures to prevent its technology from being used for malicious activities by working with law enforcement and security organizations and implementing ethical guidelines. So, for example, if you explicitly ask, it won’t write malicious code. Still, cybercriminals are finding ways around this. For example, some developers experimenting with ChatGPT found that if you detail the steps of writing the malware instead of giving a direct prompt, the AI will construct the malware for you.  

Perhaps the most dangerous thing about ChatGPT from a cybersecurity perspective is that it allows anyone to be a hacker. Before AI, there were several barriers to entry for becoming a hacker. For example, you would need technical skills like knowledge of computer programming and networking and access to specialized tools and resources, usually obtained on the dark web. But AI is helping bridge these gaps even for people with minimal hacking experience.  

The Rise of AI Malware, AI Ransomware, & Sophisticated Attacks 

While security-conscious companies and security researchers are busy finding new and increasingly advanced ways of safeguarding systems, cybercriminals are busy finding ways to bypass these advancements. It’s a constant game of cat and mouse. And the result? Increasingly sophisticated cyberattacks.  

Cybersecurity researchers have already found evidence of well-known cybercriminal gangs hiring pen testers to help break into company networks. The notorious ransomware gang Conti (who racked up a terrifying $182 million in ransomware payments in 2021) is one such group thought to be reinvesting its earnings into hiring experienced tech professionals.  

A natural next step for cybercriminals will be to hire ML and AL experts to create advanced malware campaigns. Cybercriminals may use AI to automate large portions of the ransomware creation process, allowing for accelerated and more frequent attacks. And then we have true AI malware and AI ransomware. This is where hackers create situationally aware malware that analyzes the target system’s defense mechanisms and quickly learns and mimics everyday system communications to evade detection. 

NIST’s New AI Risk Management Framework 

On January 26, 2023, The National Institute of Standards & Technology (NIST) issued Version 1.0 of its Artificial Intelligence Risk Management Framework to enable organizations to design and manage trustworthy and responsible AI. But what is this framework all about? 

The AI RMF divides into two parts. The first part frames the risks related to AI and outlines trustworthy AI system characteristics, while the second part describes four specific functions — govern, map, measure, and manage. These four functions are further divided into categories and subcategories and help organizations address AI system risks in practice. In addition, organizations can apply these functions in context-specific use cases and at any stage of the AI life cycle, making them versatile tools.  

Crucially, NIST’s AI Risk Management Framework focuses on changing how we think about AI. It outlines seven characteristics of trustworthy AI, including “Safe” and “Accountable & Transparent,” which are particularly relevant to AI’s use in cybercrime. The “Safe” section emphasizes the importance of designing AI systems that do not cause harm to humans, property, or the environment. Meanwhile, the “Accountable & Transparent” section requires that information and outputs from AI systems be available to all users. This helps prevent cybercriminals from manipulating the AI into providing responses that other users could not elicit. 

Final Thoughts 

The growing use of AI by cybercriminals has led to the emergence of new threats, such as AI ransomware and AI malware. These pose a significant risk to organizations and individuals alike. However, the new NIST AI Risk Management Framework provides a comprehensive approach to addressing these risks. By following its guidelines, organizations can mitigate the threats posed by malicious AI and ensure the development of trustworthy AI systems. As AI technology continues to evolve, organizations must take steps to protect themselves and stay up-to-date with the latest risk management strategies. 

Introduction

In today’s digital world, cyber risk is high and growing. The best way to control this risk is with a proactive cyber security strategy that quantifies and measures your company’s vulnerability to theft, fraud, or data breach.

The cyber threat landscape is diverse, and there is a wide range of potential threats in this sector, such as intellectual property theft, ransomware, data breaches, DDoS attacks, and insider threats. As cyber criminals improve on new methods for making threats, it is therefore important for cyber security professionals to be on top of where the latest threats are to hide from evolving threats. But for a company to achieve this, it must first understand the risks of cybersecurity, be vigilant in its security stance, and be aware of its accompanying risks.

Cyber risk quantification (CRQ) is the primary route to understanding the cyber threat landscape and mitigating risks within a cyber security environment. Cyber risk quantification is also part of Cyber Security Risk Management and is a crucial part of an organization’s overall security posture. It involves assessing risks relating to various cybersecurity topics, such as vulnerabilities, threats and impacts. Quantification addresses measurement, tracking and reporting on the risks relating to specific topics to prepare for cyberattacks effectively.

Risk quantification is determining how likely a threat or attack is to be successful against your organization and then assessing the severity of such an event. Cyber risk quantification is a part of this process, and it pertains specifically to threats that target information on computer networks or in physical systems, like computer networks or smartphones. These include both internal threats (such as employees) and those from external sources (hackers).

Risk quantification is an enterprise tool to help them understand their existing cyber risk environment. It also enables them to devise effective strategies for reducing those risks by implementing appropriate controls.

What is Cyber Risk Quantification?

This process of cyber risk quantification has been described as a three-step process: identifying the “pen-testing assets”, counting vulnerabilities, and measuring the potential threats. These steps represent a holistic approach, allowing a comprehensive view of one’s cyber risk posture and its vulnerabilities, threats, and risks.

At its core, cyber risk quantification is not a specific set of rules or methodologies but rather a method for conducting a rigorous, in-depth analysis of subjecting any IT infrastructure. The intent is to obtain objective evidence to develop strategies for reducing risks and ultimately strengthening an organization’s cyber resilience.

Benefits of Cyber Risk Quantification

Cyber risk quantification is important in ensuring that cyber threats are understood and can help cyber security teams analyse vulnerabilities and risks and create cyber risk mitigation strategies. The following are the benefits of cyber risk quantification.

Provides Insights into Vulnerabilities

An analysis of the information technology assets allows companies to understand their cyber risk posture and quantify their security vulnerabilities. The process makes companies feel more secure in knowing they are not as vulnerable as they originally assumed.

Helps Identify & Mitigate Threats

Cyber risk quantification is a process that helps identify the number of potential threats within an organization. It helps determine what the company needs to do to prevent a cyber attack.

Provides Information for Basing Decisions

The cyber risk quantification process allows the creation of an actionable and detailed plan for organizations to make informed decisions about protecting themselves from cyberattacks.

Helps Identify the Need for Resources

Companies can use the cyber risk quantification process results to determine what resources are required to reduce or eliminate current organizational threats and vulnerabilities.

Risk Management Decision

After a cyber risk quantification process, one can better understand their current security posture and related cyber risks to well-informed decisions about reducing this risk.

Automating the Process

Can automate cyber risk quantification to save time and labour. It means that technicians will not have to spend time performing cyber risk quantification on each piece of information technology equipment.

Cost-Effective

The overall cost of implementing cyber risk quantification will not be much more than processing a security vulnerability assessment.

Determining the Company’s Cyber Tolerance

Can use the information obtained for identifying and developing cybersecurity strategies for the foreseeable future. It means that the consequences of an attack during this planning period are less severe than those that would experience after a cyber attack once an organization has planned out their cyber security strategy.

Determining the Potential Cost of a Cyber Attack

Companies can use cyber risk quantification to estimate the cost of a successful attack and use this to determine how much money should be allocated towards mitigating the impact of an attack.

Planning Effective Training Programs

The results of a cyber risk quantification process can be used to create more effective training programs and plan for an organization’s IT infrastructure training needs.

How to Leverage on Cyber Risk Quantification

Cyber risk quantification can be leveraged on the following levels:

Organizational Levels

The senior management of an organization needs to determine the organizational level of cyber risk quantification. The level at which this model is used will depends on how large and how organized an organization is.

For example, an enterprise with thousands of employees or many systems will benefit from applying this model at a higher level (e.g., enterprise-wide) than a smaller company that runs just one corporate system.

Site Level

Organizationally focused cyber risk quantification methods can be applied to each site. It is the level at which most companies are structured; they have one or a few locations and may have dozens of sites. The IT personnel at each site may also not have direct access to all the data needed for an effective cyber risk quantification model.

Process Level

Many organizations are involved in processing large amounts of data (e.g. processing credit card information or handling employee information). These organizations can apply the same data processing methodologies to cyber risk quantification and perform a different amount of manual data analysis.

Asset Level

Cyber risk quantification can be applied to a specific asset (e.g., a server, router, switch). It is an effective method for performing cyber risk quantification on small network environments or those with limited access to the underlying devices on a network.

Information System Level

This level is useful for the entire IT infrastructure. Most organizations would benefit from a more holistic enterprise approach to cyber risk quantification.

Individual Asset Level

Some organizations may have large network environments that do not need a holistic enterprise-level approach to quantifying cyber risk. Some systems are relatively small and easy to manage individually with minimal use of IT resources.

Application Component Level

An individual application component (e.g. a web server) is typically not a significant resource on its own, and it has unique vulnerabilities that need to be fixed. In most instances, cyber risk quantification of an application component will include looking at its counterpart components. It would be a rare occurrence for those performing cyber risk quantification on an individual asset level.

Challenges of Cyber Risk Quantification

Cyber risk quantification is a challenging task because of the numerous variables can have an impact on how risks are quantified. Some of the most common factors that have to be considered when performing cyber risk quantification include:

Data Visibility

The amount of data for analysis is often limited in the cyber risk quantification process. It means that the available data has to be collected from a relatively small number of sources and then analyzed using an automated method.

Can’t Calculate Risk

Cyber risk quantification could be a better science. Often, organizations will need a higher level of understanding concerning the vulnerabilities they are trying to quantify and the impact a successful cyber attack would have on their company.

Partial Remediation

Sometimes, a company can perform some level of remediation, but not all of its IT infrastructure components. It is often the case in smaller companies where policy and security costs can be very high.

Time Frame of Analysis

Cyber threat intelligence is always changing, and so is the level of risk for an organization, even for an asset within that organization. Cyber risk quantification models must be set up to keep pace with these changes.

Data Manipulation

The information is also analyzed against other data that has been manipulated and stored for analysis. While this does not mean that all data is manipulated, it does mean that some data may have been tampered with or changed to alter the analysis’s findings (e.g., personal information).

No Consistent Methodology

Cyber risk quantification is not an exact science; therefore, it cannot be performed consistently.

No Standardization

The model used for cyber risk quantification may depend on the organization and the structure of its IT infrastructure. It is challenging to translate results from one organization to another or even use it across various industries.

No Known Method

Studies have shown that industry and IT experts do not widely accept any known cyber threat quantification methodology.

Conclusion

Cyber risk quantification stands as an emerging field in cybersecurity, that will undoubtedly play an increasingly crucial role in the future of cybersecurity for assessing organizational risk before potential attacks occur.