Security Boulevard

CWEs and CVEs have similarities and differences. Understanding both can help you keep your organization secure. Staying ahead of vulnerabilities is critical for any cybersecurity pro tasked with protecting an organization’s assets and data in a constantly shifting threat landscape. The Common Vulnerabilities and Exposures (CVE) system and the Common Vulnerability Scoring System (CVSS) are...

The post Understand CVE vs CVSS for Improved Cybersecurity appeared first on TrueFort.

The post Understand CVE vs CVSS for Improved Cybersecurity appeared first on Security Boulevard.

The Open Source Initiative has published (news article here) its definition of “open source AI,” and it’s terrible. It allows for secret training data and mechanisms. It allows for development to be done in secret. Since for a neural network, the training data is the source code—it’s how the model gets programmed—the definition makes no sense.

And it’s confusing; most “open source” AI models—like LLAMA—are open source in name only. But the OSI seems to have been co-opted by industry players that want both corporate secrecy and the “open source” label. (Here’s one ...

The post AI Industry is Trying to Subvert the Definition of “Open Source AI” appeared first on Security Boulevard.

How observability empowers security and explore the continuous monitoring, automated response mechanisms and deep insights it provides to effectively address threats in real time.

The post Observability in Security: Strategies for the Modern Enterprise appeared first on Security Boulevard.

Cyber resilience is all about how well an organization can withstand attacks and operate successfully, even while navigating cybersecurity incidents.

The post Steps Organizations Can Take to Improve Cyber Resilience appeared first on Security Boulevard.

The chief information security officer (CISO) role has changed dramatically from just a few short years ago. Once confined to technical security, CISOs have emerged as key strategic partners in the C-suite.

The post The CISO Evolution: From Tactical Defender to Strategic Business Partner appeared first on Security Boulevard.

I had a tremendous time at the InCyber Montreal forum. The speakers, panels, fellow practitioners, and events were outstanding!

I bumped into Dan Lohrmann and Nancy Rainosek before their panel with Sue McCauley on CISO challenges. We had some very interesting discussions throughout the day. Always great to hang out with Dan and Nancy.

Then it was my turn on a panel, led by Nataliya Khylenko, discussing how to strike a balance when protecting data in the age of AI. Fellow panelists Sandra Estok, Tania Tanic, and Brandon Pugh were brilliant in providing diverse and relevant perspectives.

By the end of the day, I was able to spend some quality time with Diane M Janosek, Christophe Foulon, and Evgeniy Kharam.

One of my favorite talks was from the passionate Sumona Banerji, who discussed the evolving risks of child online grooming and victimization.

I also caught glimpses of Alexa Charles who leads the coordination of this massive event and keeps all us speakers happy! She is a true superstar!

The Gala Cocktail was spectacular. A local mariachi band, not what I expected in Montreal Canada, played lively tunes and the discussions were flowing among the cybersecurity professionals!

Last but not least Vincent Riou and Shigeru Kitamura, former National Security Advisor of Japan, announced an expansion of the InCyber events to include San Antonio and Japan for 2025!

I am looking forward to both next year!

The post Highlights from the InCyber Montreal Forum appeared first on Security Boulevard.

Over the past few years, businesses have rapidly expanded their digital infrastructure to accommodate distributed workforces and implemented a slew of modernization initiatives to bring them into the digital era. This has fueled a shift from on-premises data storage to […]

The post From Data to Cloud: Bridging Security Gaps with DSPM and CSPM appeared first on TechSpective.

The post From Data to Cloud: Bridging Security Gaps with DSPM and CSPM appeared first on Security Boulevard.

Authors/Presenters: Or Yair, Shmuel Cohen

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – QuickShell Sharing Is Caring About RCE Attack Chain On QuickShare – Or Yair, Shmuel Cohen appeared first on Security Boulevard.

The AI agents and digital coworkers are automating tasks, enhancing productivity, and changing the way we collaborate. This post delves into the transformative impact of AI on the future of work, exploring the benefits, challenges, and potential implications for employees and businesses alike.

The post The Future of Work: Understanding AI Agents and Digital Coworkers appeared first on Security Boulevard.

Various Cybersecurity Experts, CISO Global A well-run kitchen requires a fully stocked pantry and a clear understanding of what’s on hand. In cybersecurity, your pantry is your asset inventory—every server, every piece of software, and even those firmware components lurking in the background. You wouldn’t want to cook without knowing exactly what ingredients are available, […]

The post The Global Effort to Maintain Supply Chain Security | Part Two appeared first on CISO Global.

The post The Global Effort to Maintain Supply Chain Security | Part Two appeared first on Security Boulevard.

A Critical Guide to Securing Large Language Models
glenn.hamilton…
Thu, 11/07/2024 - 18:07

Securing large language models (LLMs) presents unique challenges due to their complexity, scale, and data interactions. Before we dive into securing them, let’s touch on the basics.

• What are LLMs? LLMs are Large Language Models that are advanced artificial intelligence systems designed to understand and generate human-like text.
• How popular are LLMs? Incredibly, as they generate text, images, answer questions, and write creative content for you.
• How do businesses use LLMs? They enhance customer service, create content, summarize research, analyze large datasets, and translate languages.

Securing LLMs is critical as they are trained on massive datasets that contain sensitive information. Protecting LLMs from unauthorized access or misuse is vital.

The Thales Solution for LLM Security

• CTE agent: The CTE (CipherTrust Transparent Encryption) agent is a software component installed at the kernel level on a physical or virtual machine. It encrypts and protects data on that machine. Once installed, the CTE agent enables encryption for any number of devices or directories on the machine, ensuring that only authorized users and processes can access the encrypted data at file system level transparent to the application.
• CTE-U agent: The CTE-U (CipherTrust Transparent Encryption UserSpace) agent is a user-space level encryption solution that serves the same fundamental purpose, as the CTE agent. Unlike the CTE agent, the CTE-U agent operates at the user-space level.

What is CipherTrust Transparent Encryption?

CipherTrust Transparent Encryption (CTE), is part of the CipherTrust Data Security Platform (CDSP) which delivers data-at-rest encryption with centralized key management, privileged user access control and detailed data access audit logging. Protecting data wherever it resides, on-premises, across multiple clouds and within big data, and Kubernetes environments. The deployment is simple, scalable, and fast, with agents installed at operating, filesystem or device layer, and encryption and decryption are transparent to all applications that run above it. CipherTrust Transparent Encryption is designed to meet data security compliance and best practice requirements with minimal disruption, effort, and cost. Implementation is seamless keeping both business and operational processes working without changes even during deployment and roll out. The solution works in conjunction with the FIPS 140-2 up to Level 3 compliant CipherTrust Manager, which centralizes encryption key and policy management for CDSP.

Benefits of CipherTrust Transparent Encryption

Simplified Management: CipherTrust Manager provides a unified management console that enables you to discover and classify sensitive data and protect data using integrated Thales Data Protection Connectors across on-premises data stores and multi-cloud deployments. It offers advanced self-service licensing for improved visibility and control of licenses.

Cloud-friendly Deployment: CipherTrust Manager offers users additional hosting options, and can run as a native virtual machine on AWS, Microsoft Azure, Google Cloud, VMware, Microsoft HyperV and more. Additionally, native support for CipherTrust Cloud Key Management is available on CipherTrust Manager to streamline key management across multiple cloud infrastructures and SaaS applications.

Flexible Form Factors:

CipherTrust Manager is available in both virtual and physical form factors. Flexible deployment options can easily scale to provide key management at remote facilities or in cloud infrastructures. CipherTrust Manager supports managing keys in the FIPS 140 L3 boundary of Luna Network HSM.

Protect LLMs with Thales

To Protect LLMs, the Thales CipherTrust Data Security Platform with Transparent Encryption is used, whereas enterprises can leverage Thales’ advanced data protection features within the CipherTrust platform. Thales is a trusted brand in the LLM Security Industry. View our comprehensive White Paper for information on LLM Security. We'll continue to innovate with LLM Security and continue publishing updates in future articles.

Data Security Compliance Encryption Key Management Cloud Security

Doug Bies | Product Marketing Manager
More About This Author >

Securing large language models (LLMs) presents unique challenges due to their complexity, scale, and data interactions. Before we dive into securing them, let’s touch on the basics.

• What are LLMs? LLMs are Large Language Models that are advanced artificial intelligence systems designed to understand and generate human-like text.
• How popular are LLMs? Incredibly, as they generate text, images, answer questions, and write creative content for you.
• How do businesses use LLMs? They enhance customer service, create content, summarize research, analyze large datasets, and translate languages.

Securing LLMs is critical as they are trained on massive datasets that contain sensitive information. Protecting LLMs from unauthorized access or misuse is vital.

The Thales Solution for LLM Security

• CTE agent: The CTE (CipherTrust Transparent Encryption) agent is a software component installed at the kernel level on a physical or virtual machine. It encrypts and protects data on that machine. Once installed, the CTE agent enables encryption for any number of devices or directories on the machine, ensuring that only authorized users and processes can access the encrypted data at file system level transparent to the application.
• CTE-U agent: The CTE-U (CipherTrust Transparent Encryption UserSpace) agent is a user-space level encryption solution that serves the same fundamental purpose, as the CTE agent. Unlike the CTE agent, the CTE-U agent operates at the user-space level.

What is CipherTrust Transparent Encryption?

CipherTrust Transparent Encryption (CTE), is part of the CipherTrust Data Security Platform (CDSP) which delivers data-at-rest encryption with centralized key management, privileged user access control and detailed data access audit logging. Protecting data wherever it resides, on-premises, across multiple clouds and within big data, and Kubernetes environments. The deployment is simple, scalable, and fast, with agents installed at operating, filesystem or device layer, and encryption and decryption are transparent to all applications that run above it. CipherTrust Transparent Encryption is designed to meet data security compliance and best practice requirements with minimal disruption, effort, and cost. Implementation is seamless keeping both business and operational processes working without changes even during deployment and roll out. The solution works in conjunction with the FIPS 140-2 up to Level 3 compliant CipherTrust Manager, which centralizes encryption key and policy management for CDSP.

Benefits of CipherTrust Transparent Encryption

Simplified Management: CipherTrust Manager provides a unified management console that enables you to discover and classify sensitive data and protect data using integrated Thales Data Protection Connectors across on-premises data stores and multi-cloud deployments. It offers advanced self-service licensing for improved visibility and control of licenses.

Cloud-friendly Deployment: CipherTrust Manager offers users additional hosting options, and can run as a native virtual machine on AWS, Microsoft Azure, Google Cloud, VMware, Microsoft HyperV and more. Additionally, native support for CipherTrust Cloud Key Management is available on CipherTrust Manager to streamline key management across multiple cloud infrastructures and SaaS applications.

Flexible Form Factors:

CipherTrust Manager is available in both virtual and physical form factors. Flexible deployment options can easily scale to provide key management at remote facilities or in cloud infrastructures. CipherTrust Manager supports managing keys in the FIPS 140 L3 boundary of Luna Network HSM.

Protect LLMs with Thales

To Protect LLMs, the Thales CipherTrust Data Security Platform with Transparent Encryption is used, whereas enterprises can leverage Thales’ advanced data protection features within the CipherTrust platform. Thales is a trusted brand in the LLM Security Industry. View our comprehensive White Paper for information on LLM Security. We'll continue to innovate with LLM Security and continue publishing updates in future articles.

Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "A Critical Guide to Securing Large Language Models",
"description": "Explore the complexities of securing large language models (LLMs) and learn how Thales’ CipherTrust Transparent Encryption (CTE) provides advanced protection for sensitive data and compliance across cloud and on-premises environments.",
"datePublished": "2024-11-07",
"author": {
"@type": "Person",
"name": "Doug Bies",
"url": "https://cpl.thalesgroup.com/blog/author/dbies",
"sameAs": "https://www.linkedin.com/in/doug-bies-440487a/"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"mainEntityOfPage": "https://cpl.thalesgroup.com/blog/data-security/securing-llms"
} studio THALES BLOG A Critical Guide to Securing Large Language Models

November 7, 2024

The post A Critical Guide to Securing Large Language Models appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Probabilistic Uncertainty’ appeared first on Security Boulevard.

Travel accounts and platforms provide juicy targets for fraudsters, particularly around holidays. Learn how to identify threats and keep your customers' travel plans safe.

The post Bot Attacks Are Coming to Town: How to Safeguard Your Customers’ Holiday Travel appeared first on Security Boulevard.

Fortinet today extended the reach of its generative artificial intelligence (AI) capabilities to include support for its network detection and response (NDR) and cloud native application protection platform (CNAPP).

The post Fortinet Extends Generative AI Reach Across Portfolio appeared first on Security Boulevard.

 BIX isn’t just an AI assistant—it’s a game-changer in cybersecurity. With BIX, organizations can instantly get clear, actionable answers on everything from vulnerabilities to threat analysis and risk mitigation, transforming massive data into precise insights, risk reduction strategies with quantifiable ROI. But how did this revolutionary AI come to life? It all started back in …

Read More

The post The Story of BIX, a Specialized AI Agent for Cybersecurity, Built with NVIDIA AI appeared first on Security Boulevard.

Authors/Presenters: Alon Leviev

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Windows Downdate: Downgrade Attacks Using Windows Updates appeared first on Security Boulevard.

Threat actors are becoming increasingly creative, using vulnerabilities to infiltrate organizations in ways that might not immediately raise alarms. Veriti’s research team recently discovered a targeted email campaign utilizing CVE-2024-38213, cleverly disguised to appear associated with the Gas Infrastructure Europe (GIE) Annual Conference in Munich. By taking advantage of this vulnerability, attackers managed to bypass […]

The post CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack  appeared first on VERITI.

The post CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack  appeared first on Security Boulevard.

AppOmni announced a partnership that combines the company’s Zero Trust Posture Management (ZTPM) solution with Cisco’s Security Service Edge (SSE) technology suite.

The post AppOmni and Cisco Partner to Extend SaaS Security with End-to-End Zero Trust From Endpoint to the Application appeared first on AppOmni.

The post AppOmni and Cisco Partner to Extend SaaS Security with End-to-End Zero Trust From Endpoint to the Application appeared first on Security Boulevard.

Stop chasing false positives in your self-hosted instances. With GitGuardian's custom host for validity checks, security teams get real-time insights to prioritize active threats, reduce noise, and prevent costly breaches.

The post Prevent Security Breaches in Self-Hosted Environments with GitGuardian’s Custom Host for Validity Checks appeared first on Security Boulevard.

Valid card data is highly sought-after on the cybercrime underground. In fact, it’s helping to drive a global epidemic in payment fraud predicted to reach $40bn by 2026. In a bid to stem losses, the card industry created the Payment Card Industry Data Security Standard (PCI DSS) over two decades ago. No organization that processes, transmits or stores card data can afford to ignore it. Yet compliance can be onerous.

The post A Beginner’s Guide to PCI DSS 4.0: Requirements 1-4 appeared first on Security Boulevard.