Brandon Nolte

Researchers at Georgia Tech have introduced Citadel, a new memory allocator designed to combat the long-standing Rowhammer vulnerability in DRAM. Rowhammer, which affects modern DRAM systems, allows attackers to manipulate data by repeatedly accessing adjacent memory rows. Citadel tackles the root cause—physical adjacency of DRAM rows—by creating isolated security domains in separate memory regions. Unlike hardware defenses, which are costly and slow to adopt, or software solutions that slow down performance, Citadel provides a low-cost, efficient fix with just 7.4% memory overhead and no performance loss. It’s deployable on both current and legacy systems, making it a flexible solution to prevent Rowhammer attacks. Semiconductor Engineering Anish Saxena Alexandros Daglis Walter W. https://lnkd.in/gP6JXQxA. Access the paper here: https://lnkd.in/g3yf8y5p #hardwaresecurity #cybersecurity #rowhammer #DRAM #techinnovation #systemsecurity #semiconductor #startwithwcpgw #wcpgw

10

Are videos critical to your #OSINT investigations, but you don’t have a reliable tool to download them? 🤔 The Video Download extension of Silo for Research gives you quick access to a reliable downloader to capture videos in an instant. 📸

10

The U.S. military and national security personnel are testing Defense Llama, a new large language model developed by Scale AI and fine-tuned from Meta’s Llama 3 LLM over the past year. The tool is designed to integrate generative AI into critical missions such as combat planning and intelligence operations. Read more here: https://lnkd.in/dM2NhDCy #artificialintelligence #combatplanning #military #intelligenceoperations #languagemodel Alexandr Wang | Dennis Cinelli | Brooke Peterson

Seatrium Dives Deeper into Cyber-Physical Modeling of FPSOs

1

Amid growing concerns about #GPS vulnerabilities, experts agree that there's no one-size-fits-all alternative for #military #PNT needs. Insights from SandboxAQ's Lloyd Dabbs at #GEOINT highlight the Pentagon's need for a holistic strategy, combining various techniques to create a robust PNT solution. Learn more in Breaking Defense. https://bit.ly/4bgeOTN #navigation

26

1 Comment

Episode 21 - Graph DB: A must have for intelligent IAM systems 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   In this episode, we take a deep dive into the role of graph databases in Identity and Access Management (IAM) and explore why they are becoming indispensable in modern IAM systems.    For over 25 years, LDAP and relational databases have been the backbone of IAM. However, as the demands of IAM systems evolve, particularly in cloud-native and enterprise environments, it's clear that traditional databases are struggling to keep pace. It's time to introduce graph databases, a technology inherently suited for many IAM use cases.   While relational databases offer consistency and robust transactional support, they falter in handling the growing complexity of dynamic access control and scalable architectures. Graph databases, on the other hand, excel at managing complex relationships and connections—key elements in modern IAM systems.    In this episode, we discuss the limitations of RDBMS systems and explore how graph databases can transform IAM by offering smarter, more adaptable solutions for today's identity challenges.   https://lnkd.in/eV8QZDxt   #TheIdentityNavigator #IAM #Podcast #TechTalk   #IdentityAndAccessManagement

36

6 Comments

Think you need a full-time CSO? What if you could get the same expertise at a fraction of the cost? 💡​ RTB Technologies offers a Virtual Chief Security Officer (vCSO) solution, bringing you specialized talent in penetration testing, threat intelligence, and risk analysis—just like our teams did in the USAF. With vCSO, you get dedicated security oversight, clear communication with your board, and accountability for your cybersecurity efforts. 💼​ 📲 It’s time to strengthen your cybersecurity while keeping your budget in check. Book a 10-Minute Discovery Call with our team to get started – https://lnkd.in/g3Uakfxy ​#VirtualCSO #LetsGetFractional #FractionalCSO #CyberSecurity #PenetrationTesting #RiskAssessment #CyberRisk #CyberStrategy #BoardLevelSupport #RTBTechnologies​

5

NIST report on hardware security risks reveals 98 failure scenarios NIST’s latest report, “Hardware Security Failure Scenarios: Potential Hardware Weaknesses” (NIST IR 8517) [1], explores the hidden vulnerabilities in computer hardware, a domain often considered more secure than software. The report highlights how hardware flaws embedded in chip designs can lead to security risks that are difficult to fix post-production. [1] https://lnkd.in/dy7fhjUH More in: https://lnkd.in/dN2mSCSe #penetrationtesting #cyberteam #training #cybertraining #offsec #hacking #pentesting #pentest #ethicalhacking #cybersecurity #cyber #testing #security #hunting #cyberthreatintelligence #threatintelligence #cti #blueteam #redteam #purpleteam #soc #ctir #cyberthreat #intelligence #cyberdefense #cyberdefence #ctf #bugbounty #cybervulnerability #cyberresearch #intelligence #cyberintelligence #trends #cybertrends #cyberattacks #dataprivacy #privacy #informationsecurity #supplychain #tech #datasecurity #future #skillgap #cyberskillgap #securityawarenesstraining #securityawareness #cybersecurityawareness #cybermindset #cyberstrategy #ciberseguranca #ciberseguridad #cyberreport #cybercommand #cybercom #cyberrisk #risk #grc #cybersurvey #usarmy #army #cybercommand #military #leaders #airforce #navy #spaceforce #usa #eua #dod #cyberforce #cyberwarfare #cybercommand #apt #software #military #artificialintelligence #cyberops #kalilinux #kali #moodle #rce #remotecodeexecution #cybersecurityresearch #exploit #vulnerability #phishing #ramsomware #nist #hardware

9

This directive aims to eliminate redundancy in the Authorization To Operate (ATO) process, a significant pain point for defense officials and IT contractors. By ensuring that an ATO granted by one office is recognized across all DoD departments, the initiative seeks to reduce bureaucratic delays and enhance the efficiency of cloud adoption. The implementation of a unified policy across the Army, Navy, and Air Force is essential for establishing a robust and consistent security posture for cloud-based platforms, services, and applications. This policy will require comprehensive consultation between Authorizing Officers (AOs) and mission owners, ensuring that security assessments are thorough and applicable across all departments. The creation of a centralized documentation system will further facilitate transparency and accessibility, allowing for real-time sharing of security information and fostering a collaborative approach to cybersecurity. CRG’s View of the Mission-Critical Roadmap: 1. Policy Development (0-90 days):   - Establish a task force with representatives from the Army, Navy, and Air Force CIO offices.   - Draft a unified policy for ATO reciprocity across all departments.   - Define standard procedures for documentation and information sharing. 2. Stakeholder Consultation (90-180 days):   - Engage with mission owners and system owners to gather requirements and feedback.   - Identify potential challenges and address them through collaborative workshops. 3. Implementation Framework (180-270 days):   - Develop a centralized documentation system for cloud-based platforms, services, and applications.   - Pilot the new ATO reciprocity process with selected cloud services.   - Train AOs and relevant stakeholders on the new procedures and documentation system. 4. Full Deployment and Monitoring (Post 270 days):   - Roll out the ATO reciprocity policy across all DoD departments.   - Establish a continuous monitoring mechanism to ensure compliance and address any emerging issues.   - Regularly review and update the policy to adapt to evolving cybersecurity threats and technological advancements. Industry partners, this is a prime opportunity to collaborate with CRG and leverage our expertise in cloud and cybersecurity. Our seasoned SMEs and dedicated teams excel in providing comprehensive pre- and post-award support, from BD/Capture to program execution and beyond. Visit https://crgroupinc.com/ or reach out to us at contact@crgroupinc.com. #Cybersecurity #CloudSecurity #USMIL #DoD #DIB #DefenseTech #CyberDefense #CloudComputing #AuthorizationToOperate #ITSecurity #CloudAdoption #StreamlinedSecurity #DigitalDefense #TechInnovation #CyberResilience #CloudTech #DefenseIndustry #RiskManagement #SecureCloud #TechSolutions #DigitalTransformation #SecurityIntegration #CloudStrategy #DefenseContracting #ITGovernance #SecurityFramework #DataProtection #CyberThreats #DefenseStrategy #DefenseInnovation #FutureTech

3

#CMMC rule (32CFR170) tidbit for today "The OSC is responsible for maintaining and hashing all artifacts that supported the assessment. The rule has been modified to clarify C3PAOs do not maintain artifacts from the OSC. The OSCs artifacts must be hashed, and the value provided to the assessor for submission into CMMC eMASS. That hash value contains no sensitive information." Why is this important? Well the OSC is the Organization Seeking Certification. Just an item to note that the OSC will be hashing and retaining evidence for the certification assessment. Elsewhere in the rule it says that evidence will be maintained for 6 years as requested by the Department of Justice. https://lnkd.in/gh3WXheV

30

6 Comments

HC3 issues alert on #vulnerabilities in #certaOracle products; Microsoft warns of Russian spear-phishing campaign #spearphishing #motherrussia #russian #sovietunion #spearattack The Health Sector Cybersecurity Coordination Center on Oct. 28 released a report on the "Miracle Exploit," a set of critical vulnerabilities affecting Oracle applications. "These vulnerabilities give an attacker the ability to execute remote code on victim systems without authentication or detection," said Scott Gee, AHA deputy national advisor of cybersecurity and risk. "Organizations using affected Oracle products are advised to apply patches urgently to avoid exploitation." The health sector and others Oct. 29 were also alerted to an unrelated threat from a Russian cyber actor called "Midnight Blizzard," who has been observed conducting a spear phishing campaign delivering phishing emails to targets in various sectors. According to Microsoft, the campaign is likely used to gather information from targets. The alert includes additional information, mitigations, hunting queries and indicators of compromise. Midnight Blizzard was observed impersonating Microsoft employees and sending emails with social engineering lures related to Microsoft, Amazon Web Services and the concept of Zero Trust. Successful attacks provide the threat actor with sensitive information from the compromised device as the threat actor-controlled server maps the victims’ local device resources to their server. “These phishing emails are well-crafted and targeted to the recipient,” said Gee. “From a cybersecurity perspective, some best practices can help to mitigate both of these dangerous attacks. Effective patch management prevents the Oracle vulnerability and training allows users to recognize phishing emails and — more importantly — not click on unknown links in emails, preventing the phishing attack. Both of these preventative measures are listed in the essential Cybersecurity Performance Goals. The AHA strongly recommends that all health care organizations, including third party suppliers, implement the voluntary CPGs. These guidelines will help to harden your defenses against cyberattacks.” https://lnkd.in/d2HvZe_w

7

#CWDaily: #CISA adds three #vulnerabilities to its Known Exploited Vulnerabilities Catalog. Researchers from Ben-Gurion University in #Israel develop new techniques to exfiltrate #data from air-gapped computers. In our latest #ThreatVector segment, David Moulton, Director of Thought Leadership at Palo Alto Networks Unit 42, sits down with Ryan Barger, Director of Offensive Security Services, to explore how #AI is revolutionizing offensive #security. Check it out here! https://lnkd.in/eXNA7WBp

2

The #NSA and the #FBI, along with agencies from the governments of Canada, the UK, New Zealand, and Australia, released guidelines for deploying #AI in high-value environments. While focused on government efforts, the guidelines are excellent for private companies deploying AI. If you're considering deploying AI in your environment, these are worth reviewing. https://lnkd.in/gvMeAzWk

2

A commodity malware called STRRAT (aka Strigoi Master) that is available for $80 on underground resources has been tricking multiple organizations in Kazakhstan into getting hacked. The malware allows hackers to take control of corporate computers and hijack restricted data, and its use is propagated by the threat activity cluster named Bloody Wolf. The cyberattacks employ phishing emails as an initial access vector, impersonating the Ministry of Finance of the Republic of Kazakhstan and other agencies to trick recipients into opening PDF attachments. To make the attack more legitimate, a second link points to a web page associated with the country's government website that urges visitors to install Java in order to ensure that the portal is operational. The hackers have resorted to employing legitimate web services such as Pastebin to communicate with the compromised system making it possible to evade network security solutions. #kazakhbusiness #kazakhstan #strrat #bloodywolf #pastebin #dataleak #dataleakage #databreach #cyberbreach #cyberattack #cybersecurity #securityoperations #securityoperationscenter #informationsecurity #infosec #threatintelligence #networksecurity #networkforensics #NDR #IDS #hackers #ransomware #malware #phishing #DDOS #bruteforce #vulnerability Read more: https://lnkd.in/gK8VzU7z

3

Some acronyms shouldn't stand alone. When you combine DSPM with DDR, you get a more robust security posture and a real dream data team. 🛡️ Learn more about protecting *and* getting the most out of your data in our blog: https://bit.ly/3W7DK9v #DDR #DSPM #SecurityFirst #Data #DataSecurity

3