Christiaan Brand

Enable your multi-cloud Zero Trust security posture and other trust boundary controls with Netography Fusion. 🔐 The Fusion platform detects activity that should never happen anywhere in your modern network, in real-time. It's a 100% SaaS security observability platform designed to deliver a very low number of high-fidelity, high-confidence alerts that your security, network, and cloud operations teams can act on. In his blog post, Netography's Patrick Bedwell shows you how the Fusion platform can help you take some of the pain out of your Zero Trust architecture (ZTA) project, wherever you are on your ZTA journey. https://okt.to/qDQ6Rc #ZeroTrust #ZeroTrustArchitecture #ZTA #cloudobservability

4

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

Check out Part 2 of Monad's Data Engineering for Cybersecurity blog series for a deep dive on collection and storage best practices for security data! 👨‍💻🤓 https://lnkd.in/dtgXaBP5

19

How much time does your security team waste on false positives? Inefficiencies in threat detection can drain your security resources and leave real threats unaddressed. Material Security clusters similar threats, simplifying investigation and remediation, saving hundreds of hours. Learn more: https://lnkd.in/gMx9Fuy9 #cybersecurity #infosec

29

2 Comments

So I reviewed the Trust Center of Perplexity which is trying to raise at 9 Billion Valuation and I have nine observations https://lnkd.in/g8J3tMCc 1. They were founded on August 2022 and still have not gotten their SOC 2 Type 2 report which validates the effectiveness of controls over a period of time. 2. The penetration testing firm they used is decent but given how that firm operates not sure if people who were used, had advanced knowledge of AI system security testing . Would love to see the scope of testing and if it considered all the architectural considerations of AI systems or it was just general WebApp/API testing. 3. The Audit firm they have used for their SOC 2 is decent (they have the same auditor as OpenAI) but when we are talking Billions with a B, I would have loved to see a Big 4 firm doing the audit (same observation for OpenAI) 4. I would have liked them to already have or working towards ISO/IEC 42001:2023 (Information technology — Artificial intelligence — Management system). Maybe they are already working on it. 5. They are using models from OpenAI and Anthropic. I don't see any language on independent model safety testing from them. It seems they are relying on model safety testing from the underlying model providers. 6. They say that they use Claude from Anthropic but Anthropic is not listed in the list of sub processors so most probably they are using Amazon Bedrock which makes Frontier Models available via an API. 7. All their sub-processors including AWS and OpenAI, list US-East 1 as their data location so geo-redundancy might be a concern. 8. They don't seem to have a responsible disclosure or a bug bounty program. 9. They have no one working there, with security in their title. One person started there last week to do GRC.

102

14 Comments

DYK: The Deep Observability market is projected to grow from $570M to $2.1B over the next four years 📈. Why? You can’t protect what you can’t see! 🔍 Dive into this report to learn about the Gigamon #DeepObservability Pipeline, competitors, and trends. Download now to stay ahead! https://ow.ly/aNF550SICMw

6

Download the 2024 Frost Radar™ report to get an unbiased look comparing 9 leading PKIaaS vendors. What’s in the Report? ✅ Understand why PKI as a Service is a strategic imperative. ✅ Learn the core capabilities to evaluate when choosing a PKIaaS solution. ✅ Gain insights into the top PKIaaS vendors in the market. ✅ Discover why Keyfactor stands out as the premier choice. Download the report now: https://okt.to/fc0PVY #PKI #PKIaaS #DigitalTrust #Cybersecurity

9

1 Comment

Learn the core capabilities to evaluate when choosing a PKIaaS solution and gain insights into the top PKIaaS vendors in the market.

3

Folks the recent “security issue” at OpenAI was an adversary who gaied access to a dev/internal discussion area(lots of questions to consider there) But let’s talk about what’s really important which is the three kinds of data OpenAI and, to a lesser extent, other AI companies created or have access to: high-quality training data, bulk user interactions, and customer data. The vast majority not directly owned by them. Consider the value and the reach they give OpenAI and indeed anyone who would gain access to this data when you use the services and do so with the proper controls and considerations…. /M

18

Blind spots in your security could be putting your organization at risk. Discover how integrating asset visibility into MDR enhances signal coverage, eliminates blind spots, and strengthens your risk management strategy. Get the insights you need—read now!

5

1 Comment

ezWarrant is an app that connects officers directly with an on-call judge to process, sign, and submit search warrants within a short time frame. This eliminates travel and saves time and resources. Details: 🌐 Web-based 📲 Electronic Signing / Document Filing 📄 Preloaded Warrant Templates 🔔 Automated Notifications via (Text, Voice Call, or Email) 🗂️ Recorded Call or Video Swear-Ins 🙌 Unlimited Law Enforcement, Prosecutors, and District Attorneys 🔒 Is it secure? The system is completely cloud-based and hosted in the Amazon Web Services (AWS) government cloud. Documents stay in the secure portal, not in email inboxes, on fax machines, or carried by pigeons. 🤔 What about returns? Sealing? We got that, too. Upload the return documents to the search warrant sent from the court to create a "packet" to sign and send back. Additionally, sealing processes are built in to keep sensitive warrants secure. ⚖️ Can the District Attorney or Prosecutor Review it? Of course. Courts can allow the submitting officer to choose to submit for review first or send it directly to the Judge. Courts may also require that all documents be approved by the prosecutor before the Judges see the template. Prosecutors can even make changes and send them back to the officer. Ready for a FREE trial of ezWarrant for your court? Contact us at [email protected] #ezJustice #ezWarrant #CourtTech #LawEnoforcement #JudicialTech #CourtTech

4

Recent data from Splunk found that: > Security analysts spend an average of 3 hours on alert investigations. > 41% of alerts are ignored because analysts don’t have the time to process them. > Mean time to respond to incidents is 15.5 hours. That’s not as bad as a few years ago, but certainly not where we need to be. If you feel the same, reach out to learn more about how to solve these big challenges - https://tandemtrace.ai/

3

1 Comment

Microsoft reveals four OpenVPN flaws leading to potential RCE and LPE - these flaws require credentials which are very common in Infostealer infections. It’s time to deal with the fact that “but you need credentials to do x” is no longer an argument when you just need one employee’s openVPN access to get RCE, especially when in big companies you have hundreds of employees infected by Infostealers. Just for the keyword “openvpn” I’m seeing 10,000,000 occurrences in Hudson Rock’s database (https://lnkd.in/deU59cgZ) Long story short - hackers will have a field day with this one. Article via BleepingComputer - https://lnkd.in/dK73rasA

106

2 Comments

What is High Fidelity Data Visual Integrity and why it matters.

1

this is pretty disturbing - it looks like self-dealing where the fox is guarding the henhouse: * co-author of this bill stands to profit from providing exactly the services the bill is requiring AI companies to use * undercuts the ability of the community to self-police by making AI startups auditing costs a huge barrier to entry to even be in the market. eliminating open-source benefit where "many eyes make all bugs shallow." * this would also starve away the opportunity for the open source community to develop transparent standards for safeguarding AI and make the evolution of safety and security standards for it an insider game of lobbying and gatekeeping for profit

4