Sadie Creese

The UK AI Safety Institute has launched Inspect - a framework for large Language model evaluations..... The press release (https://lnkd.in/eFew4A5Q) states "New UK-built AI safety testing platform to strengthen and accelerate global safety evaluations. Inspect will make it easier for a wide range of groups to develop AI evaluations, boosting collaboration with researchers and developers." "Inspect provides many built-in components, including facilities for prompt engineering, tool usage, multi-turn dialog, and model graded evaluations. Extensions to Inspect (e.g. to support new elicitation and scoring techniques) can be provided by other Python packages" Access the Inspect platform --> https://lnkd.in/eXFaRDMC Manchester Met University Research - Department of Computing & Mathematics

65

1 Comment

In episode 213 of “The Data Diva” Talks Privacy Podcast, Debbie Reynolds talks to Prof Bill Buchanan OBE FRSE, Professor of Applied Cryptography at Edinburgh Napier University (Scotland). Professor Buchanan begins by sharing his career journey, highlighting his transition from electrical engineering to becoming a prominent figure in cryptography and cybersecurity. The conversation covers key topics, including the distinction between symmetric key encryption and public key encryption, where Buchanan explains how these methods are used to secure communications. He also dives into the importance of digital signatures for verifying data authenticity and maintaining data integrity, emphasizing their role in making the internet more trustworthy. The discussion expands into advanced cryptographic techniques like hashing functions, zero-knowledge proofs, and homomorphic encryption, which allow encrypted data to be processed securely without decryption. Buchanan sheds light on the critical challenge of key management in preventing data breaches, especially in cloud environments, and introduces listeners to post-quantum cryptography, which aims to protect against the emerging threat of quantum computers. The episode also touches on artificial intelligence’s influence on cryptography, where AI’s ability to exploit side channels and reverse-engineer code presents new challenges. Buchanan addresses the ongoing debate surrounding government surveillance and backdoors in encryption, warning of the risks associated with weakening encryption standards. He concludes with his vision for the future of data privacy, advocating for a more citizen-focused approach that grants individuals greater control over their data, especially as AI and large tech companies continue to reshape the digital landscape. This episode offers a deep dive into the evolving world of cryptography, data privacy, and the future of security in a rapidly advancing technological era and his hope for Data Privacy in the future. Audio and full transcript here: https://lnkd.in/gW4yvUeQ Subscribe to “The Data Diva” Talks Privacy Podcast, now available on all major podcast directories, including Apple Podcasts, Spotify, Stitcher, iHeart Radio, and more. Hosted by Data Diva Media Debbie Reynolds Consulting, LLC #dataprotection #dataprivacy #datadiva #privacy #cybersecurity #Cryptography #Encryption #DigitalSignatures #AI #PostQuantumCryptography #KeyManagement #DataSecurity #ZeroKnowledgeProofs #HomomorphicEncryption #QuantumComputing #DataIntegrity #GovernmentSurveillance

108

16 Comments

Keynote at 3:45pm PT today, in the #CVPR2024 Workshop on Media Forensics. (Arch 2B). https://lnkd.in/ehvhywWk WMF is hands down my favourite part of CVPR - a great community building the tools we need to fight AI abuse and misinformation - especially during this election year. I'll be talking about our body of work on media provenance with the Adobe Content Authenticity Initiative the past several years, and how open provenance tools can not only help fight fake news but open up new ways to generate value and improve creative agency over content re-use in the age of Generative AI. There is a preprint of our supporting IEEE CG&A journal paper at https://bit.ly/provtriad

150

🚨 Quantum Breakthrough: RSA & AES Encryption Under Threat from Quantum Computing! 🚨 📅 14 October 2024 Severity: Critical (Quantum Threat) In a historic leap, Chinese researchers from Shanghai University have successfully broken RSA encryption using a D-Wave quantum computer. This breakthrough signals the end of an era for widely trusted encryption standards like RSA and AES, which secure everything from VPNs and emails to financial transactions and sensitive government data. 🔑 Why It Matters: RSA’s security relies on the complexity of factoring large numbers—a task deemed impossible for classical computers. But with quantum computing, this is no longer the case. The team was able to factor a 50-bit RSA integer using a quantum annealing algorithm on D-Wave’s 5000-qubit machine, completing in just 1 hour what would have taken classical methods thousands of years. AES, another widely used encryption standard, is also at risk. This development means sensitive data secured by RSA and AES could soon be decrypted by quantum attackers. 💡 What You Can Do: • Transition to quantum-safe encryption to protect against future quantum cyberattacks. • Update encryption protocols now to post-quantum cryptography (PQC). • Be aware of the “Harvest Now, Decrypt Later” strategy, where attackers collect encrypted data now, intending to decrypt it when quantum technology advances. 📖 Learn more about quantum threats and how to prepare : https://lnkd.in/dF2kyEwD ⚠️ Awareness Tip: The security we rely on today is vulnerable. Quantum computers are rapidly becoming a real threat—organizations must act now to safeguard their data for the future. #QuantumComputing #Cybersecurity #RSAEncryption #QuantumSafe #AES #EncryptionThreats #PostQuantumCryptography #DataProtection

2

Check out this amazing whitepaper by Connor Morley on his quite spectacular research for Glasswall on mitigation of image steganography. If you want to geek out on the technical details of steganography and file security, this is the document to read

2

Two new pieces on Binding Hook on cybersecurity capacity building! 🔖 The Digital Security in Latin America group at Royal Holloway, University of London argue that top-down maturity models need to be paired with locally sensitive bottom up approaches, by James Barr, Sofia L., Jessica McClearn, and Phil Sheriff https://lnkd.in/exRGh8wZ 🔖 European Cyber Conflict Research Initiative fellow Joseph Jarnecki sets out the challenges facing current trends towards cyber *capability* support, and why this differs from the broader capacity building landscape. https://lnkd.in/eF-6v4SW

35

The Alan Turing Institute reports that #AI must be embraced and used for national #security decision-making or the government risks losing out on the opportunity presented by the technology - GCHQ and the Joint Intelligence Organisation commissioned the institute and its Centre for Emerging Technology and Security to research and write the report. The key findings include that AI will be vital to national security decision-making, as AI is able to identify patterns, trends and anomalies at a speed and size that human security staff are not able to achieve. https://lnkd.in/eMjYnD5p

4

A milestone in encryption control – what sank the US key-escrow policy? Craig Jarvis &Keith M. Martin In the 1990s, the US government recognised its citizens required cryptography for protection of digital data but also that encryption may impede law enforcement and intelligence collection. To reconcile these, President Clinton introduced the key-escrow policy, whereby the state would provide citizens with powerful encryption software whilst retaining decryption capabilities. The policy ultimately failed – the determinant reason for its discontinuation is unknown. This article posits and evidences that industry’s argument that key-escrow would curtail the global growth of the US technology sector was the determinant factor in the policy’s discontinuation. https://lnkd.in/eqzNpsTc

14

1 Comment

I will be demonstrating the latest Llama 3 LLM models for this keynote and showcase its offensive and defensive setups … and in how poor it can be with anything that requires in-depth cybersecurity knowledge

15

🚨 Opaxe subscribers be aware - Threat Actor Claims to Leak Database of Opaxe, Impacting 16,000 Users and 5.5 Million Records. "A curated data source for the mining and minerals industry. We collect, collate and republish listed mining company announcements so that you can access them quickly and easily, all in one place. We have more than 40,000 mining company announcements and 3 million data points extracted from these announcements." "Opaxe is a smart software platform that reconfigures and redistributes information and produces business insights to help mining professionals and investors make better decisions. Our founding team of industry experts and people with domain expertise understand the issues with data overload and not being able to find the wood from the trees. We set out to make it easy for you to locate the specific mining company announcement that you need, out of the 10,000’s of announcements that are out there."

4

Earlier this week, the National Institute of Standards and Technology (NIST) issued interim guidance for agencies seeking to make use of ‘syncable authenticators’ (for example, passkeys) in both enterprise-facing and public-facing use cases. What does this mean? Essentially, NIST is saying that it is acceptable to use a passkey that can be shared across multiple devices as way to meet AAL2 standards for authentication. NIST acknowledges the risk that come along with syncable authenticators, many of which we spelled out in a blog post a while ago (see here - https://lnkd.in/eiDMtNtt): - How to securely store, transmit and protect the keys - How to ensure that the keys are used by the authorized person - How to implement strong authentication in shared device scenarios The challenge becomes really obvious when you look at the definition of AAL2 with the updated definition: 1. "To meet AAL2 requirements, the syncable authenticator SHALL make use of a local authentication event to unlock the locally stored key or SHALL be used with another authenticator (e.g., a user-selected password) if no local authentication mechanism is available." So essentially, you can either unlock the key with a local authenticator (implying a biometric) or with a password. What do you think the fraudsters are going to do? 2. "Private keys stored in cloud-based accounts SHALL be protected by access control mechanisms such that only the authenticated user can access their private keys in the sync fabric." Cloud-based accounts today are also primarily protected by passwords. So again I ask, what do you think the fraudsters are going to do? We built Anonybit to handle this scenario exactly. The decentralized data vault can securely store the passkey. The passkey will then get bound to the user's biometric in the decentralized cloud. To retrieve the passkey, the user needs to authenticate themselves with the biometric. This solution ensures that only the authorized person can retrieve and use the passkey. No more tradeoffs between privacy and security. Have your cake and eat it too. DM me to see it in action. #passkeys #fido2 #authentication #passwordlessauthentication #identitymanagement #innovation #datavault #decentralizedbiometrics #enterprisesecurity https://lnkd.in/e3de-DK7

30

2 Comments

The approach of "this is on our land" is perhaps an old-fashioned idea. Data security requires a good deal more than just where the data actually sits: https://lnkd.in/eGMJgUis

13

1 Comment

Introducing the Future of Counter-Terrorism: The Price-Oquindo DTM™ Model’s Groundbreaking Approach to Dynamic Threat Mitigation Explore how the Price-Oquindo Dynamic Threat Mitigation (DTM™) Model leverages cutting-edge AI, real-time data integration, and a unique, patent-pending predictive algorithm to redefine how we approach terrorism risk management globally.

5

Where should we focus the IRIS next? You decide! The Information Risk Insights Study (IRIS) research series from the Cyentia Institute aims to provide rigorous analysis to support organizations in assessing and managing cyber risk. https://lnkd.in/e_BGmwT Over the years, we've examined the overall frequency and financial losses from security incidents, compared those metrics across different sectors and org sizes, conducted in-depth study of the 100 largest cyber loss events, researched massive multi-party incidents, and focused on particular threats (e.g., ransomware). We generally select topics to cover in the IRIS based on community interest and availability of sponsorship funds. So - back to the question at the beginning of this post. What would you like to see the IRIS focus on next? Are there vendors, gov agencies, or other organizations out there interested in sponsoring an IRIS on particular topics? Let us know! #cyberrisk #cybersecurity #cyberattacks

5

New guidance on Strengthening AI System Security released by the NSA, UK NCSC and others! The National Security Agency (NSA) is releasing a Cybersecurity Information Sheet (CSI), “Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems.” While intended for national security purposes, the guidance has application for anyone bringing AI capabilities into a managed environment, especially those in high-threat, high-value environments. The best practices presented align to the main steps of AI deployment: 1. Secure the deployment environment 2. Continuously protect the AI system 3. Secure AI operation and maintenance - In this section, notice the importance of "Promot[ing] a security-aware culture to minimize the risk of human error". The full guidance can be found here: https://lnkd.in/e_6SJe3y #AI #artificialintelligence #security #cybersecurity #systems #deployment #resilience #guidance

34

4 Comments

When the Power of Hash-based and Symmetric-key Methods Combine for PQC Signatures: Ascon-Sign And, so, Dilithium, FALCON and SPHINCS+ have become NIST standards for digital signatures, and with an aim to remove RSA, ECDSA and EdDSA. But, NIST wants alternatives to these, especially so that we are not too dependent on lattice-based approaches (such as with Dilithium and FALCON). These are: - Multivariate Signatures (10): 3WISE, DME-Sign, HPPC (Hidden Product of Polynomial Composition), MAYO, PROV (PRovable unbalanced Oil and Vinegar), QR-UOV, SNOVA, TUOV (Triangular Unbalanced Oil and Vinegar), UOV (Unbalanced Oil and Vinegar), and VOX. - MPC-in-the-Head Signatures (7): Biscuit, MIRA, MiRitH (MinRank in the Head), MQOM (MQ on my Mind), PERK, RYDE, and SDitH (Syndrome Decoding in the Head). - Lattice-based Signatures (6): EagleSign, EHTv3 and EHTv4, HAETAE, HAWK, HuFu (Hash-and-Sign Signatures From Powerful Gadgets), and SQUIRRELS ( Square Unstructured Integer Euclidean Lattice Signature). - Code-based Signatures (5): CROSS (Codes and Restricted Objects Signature), Enhanced pqsigRM, FuLeeca, LESS (Linear Equivalence), MEDS (Matrix Equivalence Digital Signature). - Symmetric-based Signatures (4): AIMer, Ascon-Sign, FAEST, and SPHINCS-alpha. - Other Signatures (4): ALTEQ, eMLE-Sig 2.0 (Embedded Multilayer Equations with Heavy Layer Randomization), KAZ-SIGN (Kriptografi Atasi Zarah), Preon, and Xifrat1-Sign. - Isogeny Signatures (1): SQIsign. We can see multivariate and MPC-in-the-head are the most popular here. But, we also see that symmetric-based signatures have four entries, so let’s look at one of these: Ascon-Sign. https://lnkd.in/dHrePWNh

5

Brilliant article Lee Parrish; thank you! Context is so very important here. While risk management has long been one of the top three oversight areas for directors, it is clear that cyber risk management is unique. Apologies in advance, CISOs, but too many of you and your team members still confuse simple terms like threat, vulnerability, and risk. Don't bother to ask the C-suite or board members. =#enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors

10

1 Comment

GuardZoo Android Surveillanceware Targeting Military Personnel GuardZoo is an active Android surveillanceware campaign targeting military personnel in the Middle East since October 2019. Named after a piece of source code enabling persistence, it uses animal-related class names like AnimalCoop and MainZoo. Lookout attributes this campaign to a Yemeni, Houthi-aligned threat actor. Over 450 IP addresses from victims primarily in Yemen, Saudi Arabia, Egypt, Oman, UAE, Qatar, and Turkey have been identified. GuardZoo can collect extensive data, including photos, documents, location data, device information, and more. Distributed via WhatsApp, WhatsApp Business, and direct browser download, it allows threat actors to deploy additional invasive malware on infected devices. For more details, visit the Lookout report: [GuardZoo Surveillanceware Report](https://lnkd.in/dZXeP2eA) #CyberSecurity #Lookout

11