Keeping out of the Headlines: Early Signals of Modern Security Breaches

Not long ago, enterprise security professionals had the luxury of focusing almost entirely on cyber security issues. Granted, staying ahead of all the numerous instances of malware — which mutates almost daily — while fortifying cloud deployments has never been easy. Still, the attack surface was largely confined to this sole concern, even with the exfiltration attempts.

Today, several factors have made this statement no longer true for even small and mid-size organizations. The prevalence and realistic nature of visual, verbal, and vocal expressions of artificial intelligence are expanding the attack surface to include nation state actors, labor arbitrage, and laptop farms, in addition to increasingly targeted phishing and ransomware attacks.

In parallel, the movement to enable existing services with aspects of advanced machine learning, including language models, dynamic agents, MCP servers, and more, has resulted in a security climate described by Pega CISO Carlos Fuentes as “overly permissive”, making organizations even more vulnerable.

Compounding the problem is the fact that regulatory scrutiny and mandates are also intensifying, particularly for SaaS and AI applications. “When you talk about infrastructure and SaaS and these apps, you’ve got to solve for 50,000 different applications,” commented Sean Roche, Obsidian Security Director of Value Engineering, Product Marketing. “It’s not just Azure, AWS, and GCP anymore.”

There are even facets of quantum computing and its potential to readily decrypt encrypted data that many are scrambling to counteract by updating their encryption protocols. The cumulative effects of all of these facets of enterprise security are not only taxing, but also overwhelming. According to DH2i CEO Don Boxley, things have “moved out of the TV realm of science fiction. It’s the real deal now. It’s scary.”

Nation State Actors

The threat of nation state actors is foremost for many organizations because it’s at the confluence of so many contemporary phenomena. It’s a consequence of the remote work force, globalization, AI, and even contemporary political manifestations that span economics. There has been more than one well documented case in which US organizations have been infiltrated by nation state actors to “raise money for the North Korean Regime,” pointed out Thomas Phelps, Laserfiche CIO and SVP of Corporate Strategy.

With this type of attack, US organizations inadvertently hire employees alleging to be in the country, but are actually located overseas. In some instances the impetus is financial reasons; in others, it may be to steal intellectual property, trade secrets, and other proprietary information. “They give you a fake US address that happens to be a laptop farm to ship equipment to for remote onboarding and they connect to that from abroad,” Phelps remarked. “They’re actually not even in the US. They just connect to that laptop farm.”

Mitigation Efforts

There are several actions organizations can take to detect such threats early and minimize their effects, including:

• Liveness Tests: Also known as AI tests, these impromptu evaluations entail making remote employees validate their physical existence on video calls to distinguish humans from computer simulated forms of AI. “You can ask them to reach for a mug or an object, or pick something up in the room,” Fuentes mentioned.
• Intelligence Specialists: Some vendors specialize in mitigating the likelihood of hiring nation state actors. According to Fuentes, “You can give them the resumes of existing employees, past employees, and they’ll tell you if that ID might’ve been stolen or compromised, or if they have Chinese Communist Party (CCP) ties,” Fuentes said. “It will give you a pool of potential suspects.”
• Monitoring Tools: Certain vendors have developed software that can detect potential instances of nation state actors. “You can run it on your laptop and say here’s a small community of people I want to monitor, and then there’s monitoring tools you can run that’ll tell you whether this person might be a nation state actor,” Fuentes revealed.

Regulatory Compliance for SaaS

The need to apply security controls to the proliferation of SaaS applications across the enterprise, as well as demonstrate to regulators that organizations are doing so successfully, is another paramount concern organizations are dealing with. Such applications include everything from Microsoft Office 365 to ServiceNow, Workday, and analytics-oriented offerings like Snowflake. Traditionally, organizations had to onboard security controls for these applications through APIs that were not standardized and required security personnel taking what Roche termed “months” to fully understand, then map, the API’s exposed metrics to security requirements. Consequently, users were “installing applications too slowly, making them available to AI too slowly, and regulators were imposing stricter controls,” Roche observed.

This process for securing applications is considerably expedited by applying solutions that provide an overview of what applications organizations have, what information their APIs expose, and what security controls, like Multi-Factor Authentication (MFA), are in place. Competitive offerings even map those controls to regulatory frameworks like NIST, detail what the SaaS provider’s controls include, and identify any gaps between what the regulations require. “They can now report back to the regulators and tell them we’ve got these controls, the vendor gives them to us, and satisfy them in minutes, instead of in weeks and months of people building compliance reports for them,” Roche added.

Advanced Phishing Attacks

Conventional cyber security attacks like phishing and malware have become even more formidable by sophisticated machine learning models simulating voices, images, and speech. The realism of the outputs of such models shouldn’t be underestimated. Boxley referenced an AI company in the UK that “has these voices and you can feed it a script and the voice will speak it and it sounds perfect. You can run it through this service and suddenly they have a British accent, or an Indian accent, or whatever accent.” The fraudulent usage of such technologies is invaluable for attackers employing them and other advanced machine learning measures for compromising the information of organizations and their workers. Additionally, the wealth of information about users that’s readily available on social media channels is ideal for creating AI-based phishing and malware attacks. “Before, phishing exploits were easier to detect because you could see the obvious typos, the spelling mistakes, and things like that,” Phelps reflected. “Now, with AI, you’ve got well tailored phishing emails that are targeting specific individuals, specific organizations, and are harder to detect.”

Hasty AI Enablement

Many applications, including those involving SaaS, are adding capabilities for organizations to work directly with dynamic agents, language models, and foundational models. In attempting to modernize these applications at the contemporary pace of business, vendors may prioritize a speedy time-to-market over security. “In the early days on the internet, everyone was building web sites and sites might not have the best security,” Fuentes explained. “People might forget to put in password authentication and role-based access. “The same thing that happened in the early days of web development is happening with AI, where people are rushing in without properly securing things.”

Although it’s possible for prudent organizations to carefully implement security measures to make their own infrastructure amenable to contemporary statistical AI deployments, it’s harder to do so when the infrastructure isn’t their own. This concern becomes acute when working with third-party SaaS applications. For example, certain “SaaS apps are turning on AI features to stay relevant, like Atlassian, Slack, and Snowflake, but they’re not giving people a control to turn them on or off and they haven’t figured out how to put this in the logs,” Roche mentioned. Organizations can overcome these shortfalls by adopting competitive SaaS security tools that can detect when an interface for implementing statistical AI has been put in place for turning on such features. “That way, security teams can respond, work with the vendor, and turn the controls on or off,” Roche said.

Post Quantum Cryptology

Although quantum computers that don’t utilize quantum annealing aren’t projected to ship until the end of the decade, many organizations are preparing now for their decryption capabilities. According to Boxley, the most pervasive encryption technology “over the wire” is TCLS1.2x. However, that protocol is alleged to be vulnerable to the decryption capabilities of quantum computers, which is why concerned organizations are hurrying to adopt TCLS1.3, which is said to be resilient to quantum computing decryption capabilities.

The concern is that with the older encryption protocols, “if you came across some encrypted data, you could store it, and once you had a quantum computer later, you could then run it against it, find the key, and you could decrypt the data,” Boxley recounted.Such capabilitiescould potentially undermine all previous encryption technologies — and the security mechanisms based on them.

Early Detection, Preparation

In general, early detection and a layered approach are best practices to implementing data security. It’s important to realize that technology is no panacea or replacement for educated employees well versed in modern security threats. Formal training and a culture of enterprise awareness, coupled with shrewd applications of technology, may prove the best defense against these emergent threats. “It’s a different world and next year’s threats are going to be very different,” Carlos said. “You just have to understand the threat landscape, adapt to it, and educate people on adapting to it.”