Each week, ChannelE2E brings you the top cybersecurity insights from our affiliate site MSSP Alert, because we know that managed service providers need to stay on top of trends in cybersecurity.
This week, Canalys's Matthew Ball talked about the blast radius of IT incidents big and small and the importance of backup and recovery. The Biden administration released a memo urging action on artificial intelligence to maintain technological dominance and defend against threats, the SEC fines several organizations for making misleading statements about the SolarWinds attack and a Sysdig report unearths key information about the consequences of LLMjacking attacks.
Here's our roundup.
- Canalys: IT Outages Put Heat on Vendors, Spotlight Importance of Backup Plans
- Biden Urges AI Adoption for National Security
- SEC SolarWinds Fines a Warning to Organizations, MSSPs
- Sysdig: LLMjacking Victims Can Lose Money, and Fast
Canalys: IT Outages Put Heat on Vendors, Spotlight Importance of Backup Plans
Cybersecurity is becoming a “check box” industry where organizations are looking to make sure they have the list of components covered -- endpoints, email, identity, cloud networking, training, incident response plans, tabletop exercises and compliance for cyber insurance.
“Attend the cybersecurity keynotes. Congratulations. Check!” said Matthew Ball, a chief analyst at Canalys, during the opening session at the market analyst organization’s North America Forum this week.
“Cybersecurity is becoming boring,” said Ball. But being boring is not a bad thing. Being boring means as an industry we are closer to cybersecurity maturity.
Ball provided an update on the state of cybersecurity in the channel for 2024 and offered his insights on where the industry is going in 2025.
Biden Urges AI Adoption for National Security
The national security memorandum for AI released by the White House this week lays out an ambitious roadmap that winds through everything from the need to develop the technology in a secure way that aligns with the country’s values to ensuring the United States remains the global leader in the fast-emerging market.
The guidelines from the Biden Administration look to scale government adoption of AI for national security purposes, protect and expand the domestic supply chain for AI technology, lead the world in the development of international standards, and keep at bay China and other foreign adversaries that are developing AI technologies.
Much of the innovation that’s been done to date, particularly since the emergence of generative AI almost two years ago, has come from the private sector, according to a senior administration official during a briefing with journalists before the memorandum was released. The government needs to continue supporting and pushing private development while at the same time making sure that national security agencies are using the technologies.
“A failure to do this, a failure to take advantage of this leadership and adopt this technology … could put us at risk of a strategic surprise by our rivals, such as China,” said the official, who was not identified in the transcript of the meeting. “And as you all know, there are very clear national security applications of artificial intelligence, including in areas like cybersecurity and counterintelligence, not to mention the broad array of logistics and other activities that support military operations.”
SEC SolarWinds Fines a Warning to Organizations, MSSPs
Reports began circulating earlier this year that federal regulators were looking into the behavior of some of the victim organizations of the high-profile SolarWinds data breach to see if what they disclosed to investors aligned with what they knew internally.
The targets of the investigation were not named at the time, but the tech industry got some answers this week when the U.S. Securities and Exchange Commission (SEC) fined four companies for making misleading statements in their public disclosures that downplayed the effects of the hack on their businesses.
To settle the cases, Unisys agreed to pay a $4 million fine, while Avaya will pay $1 million. Check Point Software was fined $995,000 and Mimecast $990,000. The regulators said that by holding back important information, the publicly traded companies victimized again shareholders who already were dealing with the fallout from the attack.
“Downplaying the extent of a material cybersecurity breach is a bad strategy,” said Jorge Tenreiro, acting chief of the SEC’s Crypto Assets and Cyber Unit. “In two of these cases, the relevant cybersecurity risk factors were framed hypothetically or generically when the companies knew the warned-of risks had already materialized. The federal securities laws prohibit half-truths, and there is no exception for statements in risk-factor disclosures.”
Sysdig: LLMjacking Victims Can Lose Money, and Fast
Security and monitoring solution vendor Sysdig earlier this year outlined a new cyber threat in the emerging generative AI space, where attackers were using stolen cloud credentials to gain unauthorized access into cloud-hosted large language models (LLMs) and then selling that access to other hackers, leaving the cloud account owner with the bill.
The new scam, LLMjacking, opened up yet another avenue for cybercriminals looking to target LLMs, which are foundational to generative AI workload. Researchers with Sysdig’s Threat Security Team, in a report in May, noted that there already were numerous attacks on LLMs, from prompt injections to altering training data, but selling access to the models was something new.
In a new report released this week, Sysdig’s researchers outline the impact of LLMjacking, which is part of a larger trend in cloud cyberthreats – cloud attacks this year jumped 154% from 2023, according to Check Point Software – that are increasingly relying on automation, botnets, and open source tools to exact high financial costs to victims.
The rapid evolution of these attacks also highlights the need for MSSPs to be at the cutting edge of security practice and research, according to Crystal Morin, cybersecurity strategist at Sysdig.
