Facebook Google Plus Twitter LinkedIn YouTube RSS 메뉴 검색 리소스 - 블로그리소스 - 웨비나리소스 - 보고서리소스 - 이벤트icons_066 icons_067icons_068icons_069icons_070

Tenable 블로그

구독

사이버 보안 스냅샷: 미국 AI 사이버 보안 도구 컨테스트에서 수백만 달러 수여 및 NIST에서 사이버 보안 프레임워크 개편

DARPA To Award Millions in AI Cyber Tool Contest

Got an idea for a new AI-based cybersecurity product? You could win millions in a new contest. Meanwhile, NIST has drafted a major revision to the CSF 2.0 and wants your opinion about it. Also, there’s a new free tool that flags security flaws in public AI models. Plus, most cloud breaches are caused by credential missteps. And much more! 

Dive into six things that are top of mind for the week ending August 11.

1 – White House contest to spur development of AI cyber tools

To promote the development of AI-powered cybersecurity products, the White House and the Defense Advanced Research Projects Agency (DARPA) this week unveiled a two-year competition with about $20 million in prizes.

The Artificial Intelligence Cyber Challenge (AIxCC), announced at the Black Hat USA 2023 conference in Las Vegas, is aimed at computer scientists, AI experts, software developers and cybersecurity masters interested in creating next-generation cyber tools that leverage the power of AI.

AI vendors Anthropic, Google, Microsoft and OpenAI will support participants by providing their technology and expertise, while the Open Source Security Foundation (OpenSSF) will act as an advisor.

Small businesses can participate as part of the “funded track,” which will provide monetary support to seven SMBs. All others can enter via the “open track.”

After entrants submit proposals, up to 20 will be selected to participate in a semifinal competition held at DefCon in August 2024. The five teams with the highest scores will be awarded prizes and will move on to the final round at DefCon in August 2025.

White House contest to spur development of AI cyber tools

“If successful, AIxCC will not only produce the next generation of cybersecurity tools, but will show how AI can be used to better society by defending its critical underpinnings,” Perri Adams, DARPA’s AIxCC program manager, said in a statement.

To get more details, check out the White House’s announcement, DARPA’s announcement, OpenSSF’s announcement and the AIxCC website.

2 – NIST releases Cybersecurity Framework 2.0 draft

The U.S. National Institute of Standards and Technology (NIST) wants you – yes, you! – to comment on the draft of its Cybersecurity Framework 2.0 it released this week.

Described as a “major update” to the framework, which was first released in 2014, this draft features an expanded scope, adds a sixth function titled “Govern,” and aims to simplify its implementation through revised guidance.

For example, the framework originally focused specifically on securing U.S. critical infrastructure organizations, but it now aims to encompass all types of organizations worldwide, regardless of size, type and industry sector.

Meanwhile, the new “Govern” function was added to address areas such as risk management strategy, organizational context, cybersecurity supply chain risk management, and policies, processes and procedures. 

The five other functions are: 

  • Identify, focused on assessing an organization’s cyber risk
  • Protect, about adopting measures to prevent and reduce cyber risk 
  • Detect, centered on discovering and analyzing cyberattacks and breaches 
  • Respond, devoted to taking action after a cyber incident
  • Recover, focused on the restoration of impacted assets and operations
NIST releases Cybersecurity Framework 2 draft

“The NIST Cybersecurity Framework (Framework or CSF) 2.0 provides guidance for reducing cybersecurity risks by helping organizations to understand, assess, prioritize, and communicate about those risks and the actions that will reduce them,” the draft document reads.

Care to share your feedback on this CSF 2.0 draft with NIST? You can email your comments to [email protected] until Nov. 4, 2023. NIST is particularly interested in hearing whether the public thinks this draft addresses current and anticipated cybersecurity challenges, and aligns with established practices and guidance.

NIST expects to publish the final version of the CSF 2.0 in early 2024, at which point it will officially replace CSF 1.1, released in 2018.

To get more details, check out the CSF’s homepage, NIST’s announcement, a draft summary and the full 52-page draft document.

3 – Open source tool detects supply chain risks in AI models

Is your organization using an artificial intelligence model it pulled from a public repository? Are you sure it’s secure? If not, you might want to check out a new and free open-source tool designed to flag supply-chain vulnerabilities and risks in publicly available AI models.

The AI Risk Database was created in March by AI vendor Robust Intelligence, which then collaborated with MITRE to further refine it into the version unveiled this week on GitHub. Indiana University is also part of the collaboration.

“This collaboration and release of the AI Risk Database can directly enable more organizations to see for themselves how they are directly at risk and vulnerable in deploying specific types of AI-enabled systems,” Douglas Robbins, MITRE vice president of engineering and prototyping, said in a statement.

Open source tool detects supply chain risks in AI models

Representatives from the three organizations talked about the AI Risk Database in a pair of presentations at Black Hat USA 2023 in Las Vegas.

To get more details, check out the announcement from MITRE and Robust Intelligence.

For more information about using AI for cybersecurity, check out these Tenable resources:

How Generative AI is Changing Security Research: The Development of the G-3PO Tool

4 – Google: Most cloud breaches due to credential failures

Weak or non-existent passwords, along with leaked credentials accounted for about 62% of cloud compromises observed by Google Cloud incident response teams in the first quarter of 2023.

Enterprises impacted by this “consistent challenge” could address it by beefing up their identity management wares and processes, Google said in the “August 2023 Threat Horizons Report” from its Cybersecurity Action Team. 

Most cloud breaches due to credential failures

(Source: “August 2023 Threat Horizons Report” from Google’s Cybersecurity Action Team)

Other findings from the 31-page report include:

  • Cyber crooks are getting legit-looking Android applications approved in the Google Play Store, and then are adding malicious features to them via stealthy versioning updates done through unapproved channels. Enterprise mitigations for this type of threat include:
    • Adopt an enterprise mobility management system
    • Create lists of pre-approved applications for your users
  • According to an analysis of anonymized alert statistics from Google’s Chronicle Security Operations, the top risk action that can lead to compromises was, by far, cross-project abuse of Google Cloud Platform’s access token generation permission

Top risky actions leading to compromises

(Source: “August 2023 Threat Horizons Report” from Google’s Cybersecurity Action Team)

To get all the details, read the full report.

For more information about identity and access management security:

5 – CISA issues cybersecurity strategic plan

Cyberbreaches have become rare. Organizations are secure and can withstand cyberattacks. Tech products are inherently secure.

These statements aren’t true today, but the U.S. Cybersecurity and Infrastructure Security Agency (CISA) wants to make them a reality, as stated in its newly released Cybersecurity Strategic Plan.

“We must be clear-eyed about the future we seek, one in which damaging cyber intrusions are a shocking anomaly, in which organizations are secure and resilient, in which technology products are safe and secure by design and default,” reads the document.

CISA issues cybersecurity strategic plan

The plan, which outlines CISA’s cybersecurity mission for the next three years, establishes three main goals:

  • Address immediate threats by:
    • improving visibility into and mitigations of cyberthreats
    • coordinating disclosures, hunts and mitigations of critical vulnerabilities
    • Planning and executing cyberdefense operations and incident response
  • Harden the terrain by:
    • understanding how attacks occur and how to stop them
    • driving effective cybersecurity investments 
    • filling gaps in cybersecurity services
  • Drive security at scale by:
    • promoting the development of secure tech products
    • understanding and reducing emerging technologies’ cyber risks
    • helping to build a cyber workforce

To get all the details, check out CISA’s announcement and the full plan document.

For more information:

6 – Biden seeks to limit U.S. investments in Chinese AI

Citing national security concerns, the Biden administration this week issued an executive order to regulate U.S. technology investments in certain “countries of concern,” including China, in areas including artificial intelligence, microelectronics and quantum computing.

The executive order calls for the creation of a national security program that the Treasury Department will be tasked with implementing and managing.

Biden seeks to limit U.S. investments in Chinese AI

“This program will seek to prevent foreign countries of concern from exploiting U.S. investment in this narrow set of technologies that are critical to support their development of military, intelligence, surveillance, and cyber-enabled capabilities that risk U.S. national security,” reads the White House announcement.

The Treasury Department is now in the process of gathering public feedback to help it craft the rules of this executive order’s program. Draft regulations will be released at a later date.

For more information, check out:

관련 기사

도움이 되는 사이버 보안 뉴스

이메일을 입력하여 Tenable 전문가에게서 적시에 알림을 받고 보안 참고 자료를 놓치지 마십시오.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable Vulnerability Management 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

100 자산

구독 옵션 선택:

지금 구매

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable Vulnerability Management 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

100 자산

구독 옵션 선택:

지금 구매

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable Vulnerability Management 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Vulnerability Management

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

100 자산

구독 옵션 선택:

지금 구매

Tenable Web App Scanning 사용해보기

Tenable One - 위험 노출 관리 플랫폼의 일부분으로 최근의 애플리케이션을 위해 설계한 최신 웹 애플리케이션 제공 전체 기능에 액세스하십시오. 많은 수작업이나 중요한 웹 애플리케이션 중단 없이, 높은 정확도로 전체 온라인 포트폴리오의 취약성을 안전하게 스캔합니다. 지금 등록하십시오.

Tenable Tenable Web App Scanning 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Web App Scanning 구입

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

5 FQDN

$3,578

지금 구매

Tenable Lumin 사용해 보기

Tenable Lumin으로 위험 노출 관리를 시각화하여 파악하고 시간에 걸쳐 위험 감소를 추적하고 유사한 조직과 대비하여 벤치마킹하십시오.

Tenable Lumin 평가판은 Tenable Lumin 및 Tenable Web App Scanning을 포함합니다.

Tenable Lumin 구매

영업 담당자에게 문의하여 어떻게 Tenable Lumin이 전체 조직에 대한 통찰을 얻고 사이버 위험을 관리하는 도움이 되는지 알아보십시오.

무료로 Tenable Nessus Professional 사용해보기

7일 동안 무료

Tenable Nessus는 현재 구입 가능한 가장 종합적인 취약성 스캐너입니다.

신규 - Tenable Nessus Expert
지금 사용 가능

Nessus Expert는 외부 공격 표면 스캔닝과 같은 더 많은 기능 및 도메인을 추가하고 클라우드 인프라를 스캔하는 기능을 추가합니다. 여기를 클릭하여 Nessus Expert를 사용해보십시오.

아래 양식을 작성하여 Nessus Pro 평가판을 사용해보십시오.

Tenable Nessus Professional 구입

Tenable Nessus는 현재 구입 가능한 가장 종합적인 취약성 스캐너입니다. Tenable Nessus Professional은 취약성 스캔 절차를 자동화하고 컴플라이언스 주기의 시간을 절감하고 IT 팀과 참여할 수 있도록 합니다.

여러 해 라이선스를 구매하여 절감하십시오. 연중무휴 전화, 커뮤니티 및 채팅 지원에 액세스하려면 Advanced 지원을 추가하십시오.

라이선스 선택

여러 해 라이선스를 구매하여 절감하십시오.

지원 및 교육 추가

무료로 Tenable Nessus Expert 사용해보기

7일간 무료

최신 공격 표면을 방어하기 위해 구축된 Nessus Expert를 사용하면 IT부터 클라우드까지, 더 많은 것을 모니터링하고 조직을 취약성으로부터 보호할 수 있습니다.

이미 Tenable Nessus Professional을 보유하고 계십니까?
7일간 Nessus Expert로 무료 업그레이드하십시오.

Tenable Nessus Expert 구입

최신 공격 표면을 방어하기 위해 구축된 Nessus Expert를 사용하면 IT부터 클라우드까지, 더 많은 것을 모니터링하고 조직을 취약성으로부터 보호할 수 있습니다.

라이선스 선택

여러 해 라이선스를 구매하여 비용을 더 절감하십시오.

지원 및 교육 추가