Sri Gourisetti, Ph.D.

The EPA warns that cyberattacks on US water systems are increasing in cadence and threat level. From CBS News: “Recent attacks are not just by private entities. Some recent hacks of water utilities are linked to geopolitical rivals, and could lead to the disruption of the supply of safe water to homes and businesses. McCabe named China, Russia and Iran as the countries that are ‘actively seeking the capability to disable U.S. critical infrastructure, including water and wastewater.’” #cyberattacks #cybersecurity #water #publicpolicy #epa #china #russia

2

FAST FACTS: Did you know? The security design principle in NIST SP 800-160, Volume 1, that reflects the reality of building systems that could fail is “Loss Margins.” Principle: The system is designed to operate in a state space sufficiently distanced from the threshold at which loss occurs. Margins refer to the difference between a conservative threshold at which the system is expected to operate while subjected to adversity and the point at which the adversity results in failure. Loss margins are created by engineered features put in place in the system to maintain operational conditions and the associated adversity level at some distance (i.e., conservative threshold) from the estimated critical adversity threshold or loss-triggering threshold. Loss margins also allow for increased time to: - Detect the need for a response action, - Determine what the response action should be, and - Complete the selected response action. When there is uncertainty about the effectiveness of the response action, loss margins need to allow time to evaluate response effectiveness, determine any additional actions needed, and complete any selected actions. Uncertainty may derive from the operational environment, the design and realization of the system, the utilization and sustainment of the system, and the adversity presenting itself to the system. Loss margins are effective in addressing uncertainty about how and when a loss-triggering event occurs. Specifically, loss margins are effective in addressing uncertainty associated with: - Intelligently designed and executed attacks, including attacks that persist and evolve over time, and - Unknown, unquantified, and under appreciated threats, susceptibilities, vulnerabilities, hazards, and associated risks. For designs that incorporate loss margins, uncertainty about adversity makes determining the loss-triggering thresholds difficult. Loss margins for design should be determined with a balance between certainty (i.e., what has happened and can happen again) and uncertainty (i.e., what has not happened but can happen, or what has happened but can also happen in a different way). Loss scenarios that include loss escalation and an estimation of the critical threshold for loss occurrence are helpful in making design decisions that incorporate loss margins. Loss scenarios also help to determine the limits of adversity-driven decisions due to uncertainty in knowledge about the adversity (i.e., the adversity is insufficiently known or understood or is just unknown). The size of the margin may be reduced over time as unknown and under appreciated loss scenarios are uncovered and corrected. The size of the margin may also be increased over time as a malicious adversity capability becomes more mature or sophisticated. Join the "Ensurgency." Team SSE. https://lnkd.in/e5j5d2vm #NIST800160Vol1 #SecurityDesignPrinciples #LossMargins #Uncertainty #FailureModes #Risk #SystemsEngineering

33

3 Comments

Advancing the Quantum Frontier: A Call for Legislative Action Recent developments in quantum computing, highlighted by Rensselaer Polytechnic Institute's deployment of a functioning quantum computer and significant advancements by Microsoft and Quantinuum, mark a critical moment in technological progress. Despite these strides, the U.S. Congress has yet to fully commit to supporting this field through the National Quantum Initiative Reauthorization Act, which remains pending. This act proposes a substantial $3.6 billion investment aimed at enhancing quantum research, including the establishment of new quantum institutes and foundries. These resources are essential for maintaining global competitiveness and securing the associated supply chains crucial for both economic and national security. As the quantum landscape evolves, timely legislative support is imperative to ensure the States remain at the forefront of this transformative technology, which has far-reaching implications beyond their borders. It is crucial for global stakeholders in technology and policy to observe these developments, encouraging collaborative efforts to harness the benefits of quantum advancements. #QuantumComputing #Legislation #GlobalInnovation #TechnologyPolicy https://lnkd.in/eaa4vtHX

2

Today NIST announced the approval of FIPS standards for PQC: * FIPS 203 (Module-Lattice-Based Key-Encapsulation Mechanism Standard, CRYSTALS-KYBER submission) * FIPS 204 (Module-Lattice-Based Digital Signature Standard, CRYSTALS-Dilithium submission) * FIPS 205 (Stateless Hash-Based Digital Signature Standard, SPHINCS+ submission) While the road to adoption will be a long one, this is a critical first step towards the future of quantum resistant cryptography. More info https://lnkd.in/eyhUgW3m If you’re interested in driving the adoption of PQC through open source, check out PQCA https://pqca.org #pqc #cybersecurity #cryptography #cryptomeanscryptography 

43

The California State Senate's recent passage of a bill to regulate advanced AI model development is sparking vital discussions on balancing innovation with risk mitigation. The bill requires developers to ensure their models lack capabilities that could cause critical harms, setting a precedent for a measure of accountability in the rapidly growing AI sector. In the bill's language "to prevent unreasonable risk of critical harms," is described as: (A) The creation or use of a chemical, biological, radiological, or nuclear weapon in a manner that results in mass casualties. (B) At least five hundred million dollars ($500,000,000) of damage through cyberattacks on critical infrastructure via a single incident or multiple related incidents. (C) At least five hundred million dollars ($500,000,000) of damage by an artificial intelligence model that autonomously engages in conduct that would violate the Penal Code if undertaken by a human. human with the necessary mental state and causes either of the following: (i) Bodily harm to another human. (ii) The theft of, or harm to, property. (D) Other grave threats to public safety and security that are of comparable severity to the harms described in paragraphs (A) to (C), inclusive. Additionally, the bill requires that developers bake in kill switches. Absent federal legislation on AI, California's Senate Bill 1047's progress seems likely to influence future regulatory dialogues, shaping the landscape of AI ethics and innovation in the US. #AI #Regulation #security #Innovation #CaliforniaSenate #AIethics

9

In 75 years or potentially a lot sooner I'm anticipating nuclear fission to (tokamak) become the gold standard in clean, renewable energy with limitless potential. #nuclearfusion #cleanenergy #tokamak #artificalsun

1

⚡️Some domains likely used by #transparentTribe #APT36 counciling[.]com nbssedelhi[.]org ashifdigitalseva[.]xyz birthdeath[.]in gov-certificate[.]com viewss[.]click admin-mcas-df[.]ms admin-mcas[.]ms mcas-df[.]ms mcas[.]ms verifycertificate[.]info nimsme[.]org

1

1 Comment

Sharing some key takeaways and favorite discussions at Yotta: - Small Modular Reactors (SMRs): While there's a lot of excitement around nuclear energy, the earliest roadmap for scaling up SMRs points to 2030 and beyond. In the meantime, the industry must address the near-term energy gap and decades of stagnation in power infrastructure development. Energy transmission is just as pressing an issue as generation. Expanding power lines is essential if we want to scale renewable energy effectively. - Data Centers of the Future: With increasing rack density and evolving cooling requirements, true future-proofing is not possible. Instead, we should focus on future-resilience and flexibility to minimize retrofitting costs. Implementing Lean methodologies, such as Just-In-Time supply chain practices, optimizing delivery flow, reducing waste, and driving efficiency are key steps forward. Standards adoption which I think is a major gap in the industry is another critical piece in managing retrofit costs. - AI and Data Centers: Designers and builders need to anticipate shifts from AI training to inference. This involves translating new resiliency and availability requirements as we move from large models to smaller, contextual, and local models that cloud and edge customers demand. - Human Capital: To support this growth, we also need significant investment in skilled trades and talent, including electricians, welders, operations technicians, and commissioning agents. #yotta2024 #datacenterindustry #digitalinfrastructure #nomadfuturistfamily #nomadfuturistacademy #thefutureisnow #NomadFuturist 

63

10 Comments

New Report on Industrial Control Exposure reveals 33% of Industrial Control Exposures are from the US.     Full Report = https://lnkd.in/g8epmTit Bravo all to Censys including Andy Moore and Emily Albright for their great work on #CyberSecurity

2

NIST: USG take immediate actions including: 1) increasing pre-standardization R&D and standards participation efforts; 2) tracking and evaluating current Critical and Emerging Technology (CET) standards education grants and programs to enhance U.S. stakeholder participation in international standards activities; and 3) monitoring current technology cooperation agreements with other governments, as well as international mechanisms for standards-related communication and cooperation.

18

FAST FACTS: Did you know? The security design principle in NIST SP 800-160, Volume 1, known as “Commensurate Trustworthiness” is critical when systems engineers are considering how to build trustworthy secure systems composed of hundreds of thousands of system elements having varying levels of trustworthiness. I explained the concept of trustworthiness and assurance levels in a previous LinkedIn post. https://lnkd.in/eytZJZsU Principle: A system element is trustworthy to a level commensurate with the most significant adverse effect that results from a failure of that element. A trusted system element continuously exhibits properties of trust during the time that it is depended upon by other system elements. The degree (or level) of trustworthiness needed for a trusted element is determined by those entities that depend on the element. Some basis is required to support decisions about trust and trustworthiness. This basis includes: - Expressing the trust that is to be placed in a system element, - Expressing the trustworthiness that is exhibited by the element, and - Comparing the trustworthiness of different system elements. The principle of Commensurate Trustworthiness is particularly relevant when considering systems and system elements with complex chains of trust dependencies such as those that can be observed in many modern systems today. Systems engineers express the trust that is to be placed in a particular system element based on the most significant adverse effect that results from a failure of that element. This occurs by developing a system architecture definition as described in NIST SP 800-160, Volume 1, and examining the trust relationships and potential dependencies among all of the system elements. This results in certain system elements being deemed “critical” or “essential.” The actual trustworthiness of each system element is based on the concept of assurance which can vary widely on a sliding scale from little to no assurance to very high assurance. In order for systems engineers to make informed decisions when selecting system elements with the necessary degrees of trustworthiness for the engineered system, they need the assurance evidence to substantiate any claims about those elements. Such evidence is produced during the verification, validation, and analysis processes that are a foundational part of a disciplined systems engineering approach. The importance of the design principle of Commensurate Trustworthiness cannot be overstated especially when dealing with cyber-physical systems that include human-machine interfaces, process sensors, actuators, and other mechanical components—the types of systems that are embedded within all sectors of the U.S. critical infrastructure. Join the “Ensurgency.”  Team SSE. https://lnkd.in/e5j5d2vm #NISTSP800160Vol1 #SecurityDesignPrinciples #Trust #Risk #CommensurateTrustworthiness #Assurance #SSE #TrustworthySystems #Uncertainty #FailureModes #APT

27

1 Comment

5️⃣ Facts Friday: 1) The National Institute of Standards and Technology (NIST) launched a new program “intended to help improve understanding of AI’s capabilities and impacts.” https://lnkd.in/eAkwytgb + The program is called Assessing Risks and Impacts of AI (ARIA). + “ARIA will consider AI beyond the model and assess systems in context, including what happens when people interact with AI technology in realistic settings under regular use,” said NIST’s Reva Schwartz, who will lead the program. 2) “Chief AI officers have been named for the 24 CFO Act agencies, as well as dozens of smaller agencies,” according to an Office of Management and Budget spokesperson. https://lnkd.in/ecGKWhvH + The White House AI Executive Order required each agency to designate a Chief AI Officer “for coordinating their agency’s use of AI, promoting AI innovation in their agency, managing risks from their agency’s use of AI,” and more. 3) Thousands of internal company documents leaked from Google. https://lnkd.in/gCwaD-Dj + The documents suggest that Google may have used Chrome data to inform search rankings, despite prior company claims to the contrary. +  A Google spokesperson pushed back, saying that “we would caution against making inaccurate assumptions about Search based on out-of-context, outdated, or incomplete information.” 4) The Washington Post's CEO announced the paper’s new “Build It” plan, including intentions to integrate AI. https://lnkd.in/eEX-92ht + The paper’s CTO allegedly said that the paper needs “AI everywhere in our newsroom.” + In the past year, the Post lost $77 million. 5) OpenAI's Board created a Safety and Security Committee to make recommendations “on critical safety and security decisions for OpenAI projects and operations.” https://lnkd.in/dDHsmNVC + The Committee includes Aleksander Madry (Head of Preparedness), Lilian Weng (Head of Safety Systems), John Schulman (Head of Alignment Science), Matt Knight (Head of Security), and Jakub Pachocki (Chief Scientist). + The announcement also mentions that “OpenAI has recently begun training its next frontier model.” #AI #AIPolicy #FiveFactsFriday

5

NIST report on hardware security risks reveals 98 failure scenarios NIST’s latest report, “Hardware Security Failure Scenarios: Potential Hardware Weaknesses” (NIST IR 8517) [1], explores the hidden vulnerabilities in computer hardware, a domain often considered more secure than software. The report highlights how hardware flaws embedded in chip designs can lead to security risks that are difficult to fix post-production. [1] https://lnkd.in/dy7fhjUH More in: https://lnkd.in/dN2mSCSe #penetrationtesting #cyberteam #training #cybertraining #offsec #hacking #pentesting #pentest #ethicalhacking #cybersecurity #cyber #testing #security #hunting #cyberthreatintelligence #threatintelligence #cti #blueteam #redteam #purpleteam #soc #ctir #cyberthreat #intelligence #cyberdefense #cyberdefence #ctf #bugbounty #cybervulnerability #cyberresearch #intelligence #cyberintelligence #trends #cybertrends #cyberattacks #dataprivacy #privacy #informationsecurity #supplychain #tech #datasecurity #future #skillgap #cyberskillgap #securityawarenesstraining #securityawareness #cybersecurityawareness #cybermindset #cyberstrategy #ciberseguranca #ciberseguridad #cyberreport #cybercommand #cybercom #cyberrisk #risk #grc #cybersurvey #usarmy #army #cybercommand #military #leaders #airforce #navy #spaceforce #usa #eua #dod #cyberforce #cyberwarfare #cybercommand #apt #software #military #artificialintelligence #cyberops #kalilinux #kali #moodle #rce #remotecodeexecution #cybersecurityresearch #exploit #vulnerability #phishing #ramsomware #nist #hardware

9

XSOC has created a breakthrough (truly one of one) 512 to 51,200 bit post quantum waveform encryption that is outperforming AES (Gold Standard for last 20 years) by nearly 10X on both encryption & decryption speeds while simultaneously increasing the strengthof the security. This is a massive advancement in cryptography for both legacy × next generation systems. This is FULLY applicable to UAS/Drones, other robotics, Surface & Subsurface applications in the water, space assets, any edge sensor or tool that has a edge compute or software defined radios! This encryption will prove to be vital in (C)JADC2 Orchestration/Implementation. www.XSOCCorp.com Key Features: * Lightweight, Low-Friction Implementation: Optimized for real-time multimodal data encryption and decryption, crucial for espionage, situational awareness, monitoring, and counter-UAV operations. * High-Speed (8.5X AES speed) and Ultra-Low Latency: Ensures continuous data encryption even under adverse transmission conditions. * FIPS-140-2 Certification: Provides a framework for evaluating the security of cryptographic modules, ensuring high assurance levels. XSOC Corp has developed a one-of-one technological breakthrough within data security. A highly secure, high-speed, quantum-safe and rapidly deployable symmetric key exchange process and broadcast protocol. The key features include: Sharding of Encryption Keys: This process divides a single encryption key into multiple smaller shards, enhancing security and efficiency in key exchange processes. SOCKET (Secure Omnichannel Continuous Key Exchange Transport): Performs secure sharding of encryption keys, authenticating both sender and recipient. It offers enhanced security, efficient key shard routing, and scalability. EBP (Encrypted Broadcast Protocol): A purpose-built, encrypted transport layer protocol designed for fast data transfer speeds by managing bandwidth constraints. By combining SOCKET with EBP, XSOC Corp enables rapid and secure transmission of encrypted communications over various networks, including MANETs and IoBT (Internet of Battlefield Things). XSOC CORP Richard Blech Sam Saddigh

11

Exciting news! The hard copy of my book, "Enhancing Quantum Network Infrastructure with Dynamic Schmeling Quantum Routing Protocol and Quantum Tagging," will be available again in 2 days or less. Dive into the groundbreaking world of quantum networking with insights on DSQRP, advanced error correction, Q-QoS tagging, and more. Get your copy before they sell out again! Check here: https://a.co/d/6MGWtuv #QuantumNetworking #QuantumComputing #TechInnovation #QuantumCommunication #Networking #QuantumResearch #TechBooks #NewRelease #QuantumTechnology #FutureTech #TechTrends #Innovation #QuantumPhysics #ScienceBooks #QuantumMechanics #TechCommunity #NetworkingSolutions #QuantumProtocols #QuantumTagging #ErrorCorrection #DigitalTransformation #NextGenTech #Research #QuantumInternet #NetworkSecurity #TechIntegration #BookLovers #ScienceAndTech #AcademicBooks #TechInsights #AdvancedTech #QuantumEra #HighTech #DigitalInnovation #TechReaders #QuantumData #TechExperts #QuantumAdvancements #FutureOfNetworking #CuttingEdgeTech #SecureCommunications #QuantumSolutions #EmergingTech #TechnologyLeadership #QuantumLeap #InnovativeSolutions #TechPioneers #QuantumFuture #QuantumInfrastructure

3

Responsible for Protecting CUI? Learn About Updated NIST Guidance Controlled Unclassified Information (CUI) implementation and oversight is barreling toward government agencies and contractors alike. CUI aims to help companies better protect information that may be sensitive, but not classified. https://lnkd.in/gbhuFMKK

7

1 Comment