RSA Report: New Tactics, New Technologies
While the official theme of this year’s RSA Conference is “Stronger Together,” one throughline keeps repeating over and over, through the Exhibit Hall, from the stage in keynotes and sessions, and in casual conversations — the revolutionary power of emerging technologies, particularly AI. While some see it as a positive, revolutionizing force and others take a more cautionary (or even dire) view, most everyone agrees on one thing: We’ve entered a new era, both for cybersecurity and for the world at large.
In “Security as Part of Responsible AI: At Home or At Odds,” panelists discussed the dark side of revolution: Disruption. Currently, they argued, not enough attention is being paid to the downstream effects of AI — such as its potential for use in cybercrime, the existence of so-called “hallucinations” (things AI presents as truth, but which are false or completely fabricated) and other factors. But who, ultimately, will be responsible for mitigating the potential for AI to invent falsehoods, leak personally identifying data, and more?
Some feel this responsibility belongs in the realm of Responsible AI, which has generally been limited to things like mitigating biases and improving fairness. Others agree that it should belong in the security wheelhouse, because things like AI data leaks overlap somewhat with cyberattacks in terms of the need for a rapid response (and also because some cyberattacks will be directly on the AI itself).
Either way, however, network visibility will continue to be paramount. SonicWall customers will be well-positioned to face this new era, as we already have an upper hand when it comes to visibility. We have a long history of helping companies move from siloed point solutions to greater visibility, and customers such as SADAFCO, Al Qayed Holding Group, awfis space solutions, InfoStream and many others have specifically called out increased visibility with SonicWall solutions in just the past few months.
While AI comes with a great deal of risk, it also has the potential in some ways to save us from ourselves. The “SIEM There, Done That: Rising Up in the SecOps Revolution” specifically zeroed in on AI’s ability to move us past legacy solutions such as SIEM, which many organizations are still relying on. While SIEM provides a great deal of valuable telemetry, it also requires a great deal of human intervention, exacerbating the cyber skills shortage, causing alert fatigue and contributing to the problem of burnout among cyber professionals.
While gamification and other initiatives can help ease the skills shortage by attracting the next generation of cybersecurity professionals to the field, there are also things we can do in the meantime, such as deploying solutions that use machine learning and AI to automate processes and ease demands on staff. These solutions include SonicWall’s Capture ATP with RTDMI, which won Best AI and Machine Learning Based Security Solution of the Year in 2020, and has only continued to build on this foundation since.
“Why I’m Optimistic (and You Should Be, Too)” took a similarly uplifting tone, emphasizing that security is, in fact, solvable. Moreover, we already know what’s needed for effective security, including hardening the attack surface, implementing zero-trust access policies, preventing all known attacks and detecting unknown threats.
These objectives already form the cornerstones of how SonicWall does business. For the past three decades, we’ve offered firewalls and other solutions that allow our customers to harden their environment. While our signature-based protections ward against known attacks, emerging technologies such as our Capture ATP with patented Real-Time Deep Memory Inspection (RTDMI™) excel at detecting threats never before seen by anyone in the cybersecurity industry — often before they’ve exhibited any malicious behavior. And with our comprehensive zero-trust solution, SonicWall SMA 1000, organizations can control access and segment networks to limit inside threats as well as outside threats.
Unfortunately, the need to harden networks has never been more urgent, as the past several years have brought a sharp increase on critical infrastructure. In “Defending OT Systems from Ransomware,” speakers Jeff Jones and Tom VanNorman discussed why OT (Operational Technology) differs from IT. The world of OT brings with it inherent environmental risks such as large equipment, scaffolding, temperature extremes and other operational hazards, and to keep these environments safe, the systems running them have been designed for near-24/7/365 uptime. Unfortunately, cybercriminals are aware that these critical infrastructure environments cannot afford downtime — and as a result, manufacturing is now the hardest-hit industry, with groups like the Royal ransomware gang targeting critical infrastructure specifically.
While the culture of safety that drives OT environments can help foster a prevention mindset when it comes to cyberattacks, there are specific changes from the IT world that can also help. The speakers called out the need for better password hygiene, the development of an incident response plan that brings in all concerned parties as necessary steps for securing our most critical infrastructure and better phishing education as critical to beating back the rising wave of attacks on our manufacturing and other critical infrastructure.
Unfortunately, with the advent of AI, the sophistication of phishing attacks is rising rapidly. In “CatPhish Automation: The Emerging Use of AI in Social Engineering,” speaker Justin Hutchens outlined the accelerating development of AI, from the Turing test to the recent release of ChatGPT. Pulling back the curtain on the code and commands used in AI “catphishing” attacks — wherein an AI pretends to be a human in order to conduct a phishing attack — Hutchens showed how terrifyingly easy it is to conduct such attacks, and their potential for fooling even otherwise savvy users.
But catphishing isn’t the only new tactic threat actors are employing. “Hacking Exposed: Next-Generation Tactics, Techniques and Procedures” outlined a real-life attack in which the adversary uses no malware at all. By using vishing, readily available tools such as AnyDesk, and LoTL attacks, these attackers launch an attack that will be virtually undetectable by many antimalware solutions — making increased visibility and good telemetry more important than ever.
But while most of the day’s sessions dealt with the near future, some are already looking to what the more distant future will hold. In “The Next 50 Years,” theoretical physicist Michio Kaku discussed the transition from the digital era to the quantum era—a time in which extraordinarily powerful computers will revolutionize the economy, science, medicine and our way of life.
In this new era, Kaku explains, brains will interface with computers, technology will send designs directly from the minds of artists and designers to 3-D printers who will immediately bring them to life, and the libraries of the future will house elements of our personalities, digital footprints, and more — lending us a form of immortality.
While these sessions dealt with the emerging technologies, these advancements don’t supplant existing issues in cybersecurity, such as the rise of misinformation and nation-state attacks. Check back later for more on the role of government and international partnerships in fighting today’s increasingly powerful adversaries. And don’t forget to stop by Booth #5585 in Moscone North for demos, presentations and more!