La scadenza si avvicina: il 18 ottobre entrerà in vigore la nuova Direttiva NIS2, una normativa che porterà cambiamenti radicali nel panorama della cybersicurezza in Europa. Le organizzazioni che non si adegueranno rischiano sanzioni salatissime, con multe che possono arrivare fino a 10 milioni di euro o il 2% del fatturato globale annuo, a seconda di quale importo sia maggiore. La domanda che tutte le aziende si pongono è: cos’è la NIS2 e come garantire di essere conformi entro la scadenza?

Cos’è la Direttiva NIS2 e perché è importante?

La Direttiva NIS2 (Network and Information Security) è stata introdotta dall’Unione Europea con l’obiettivo di rafforzare la resilienza e la sicurezza delle infrastrutture digitali critiche all’interno degli Stati Membri. Questa nuova regolamentazione, ufficialmente nota come Direttiva Europea 2022/2555, rappresenta un’evoluzione significativa rispetto alla sua predecessora, la NIS1, e affronta in modo più completo le sfide attuali poste dalla crescente minaccia di attacchi cibernetici su larga scala.

La direttiva stabilisce regole chiare e dettagliate per proteggere le infrastrutture vitali, richiedendo misure di sicurezza più rigorose e un livello di protezione più uniforme tra i paesi membri. Uno degli aspetti più innovativi della NIS2 è l’ampliamento del suo ambito di applicazione: ora vengono inclusi anche settori che prima non erano considerati cruciali, come l’industria chimica, la gestione dei rifiuti, e persino i servizi digitali e postali. Questo riflette l’importanza crescente che la sicurezza delle informazioni ha assunto in tutte le aree dell’economia digitale.

Le organizzazioni coinvolte sono suddivise in due gruppi principali:

• Soggetti importanti: questa categoria include una vasta gamma di settori come i servizi digitali, l’industria chimica, l’agroalimentare, la gestione dei rifiuti e i servizi postali, settori che pur non essendo fondamentali per la sopravvivenza immediata della società, sono comunque critici per il buon funzionamento delle economie e delle comunità.
• Soggetti essenziali: sono enti e aziende che operano in settori di importanza strategica come l’energia, la sanità, il settore finanziario, i trasporti, le infrastrutture digitali, le risorse idriche, lo spazio e la difesa.

Perché la conformità alla NIS2 non è negoziabile

La Direttiva NIS2 impone un sistema sanzionatorio molto severo per la mancata conformità. Le multe per i soggetti importanti possono raggiungere i 7 milioni di euro o l’1,4% del fatturato annuo globale. Per i soggetti essenziali, invece, le sanzioni arrivano fino a 10 milioni di euro o al 2% del fatturato. Inoltre, le organizzazioni che non ottemperano ai nuovi requisiti possono affrontare un significativo danno reputazionale, minando la fiducia dei clienti e degli investitori.

A differenza di altre normative, come il GDPR, la NIS2 impone controlli non solo sulla protezione dei dati personali, ma su tutto lo spettro delle infrastrutture IT, richiedendo alle organizzazioni di adottare misure preventive per garantire la continuità operativa e la resilienza contro incidenti e attacchi cibernetici.

Le principali misure per ottenere la conformità alla NIS2

Essere conformi alla NIS2 non significa semplicemente implementare qualche misura di sicurezza aggiuntiva. È necessario un approccio sistemico che coinvolga vari aspetti della gestione dei rischi IT. Tra le misure obbligatorie ci sono:

• Strategie di gestione del rischio cibernetico: identificare, valutare e mitigare i rischi legati alla sicurezza informatica.
• Protezione della supply chain: monitorare e proteggere l’intera catena di approvvigionamento da potenziali vulnerabilità.
• Continuità operativa e piani di ripristino: assicurarsi che le operazioni aziendali possano continuare anche in caso di un grave incidente.
• Gestione degli incidenti di sicurezza: creare piani di risposta rapida e strutturata in caso di attacchi o violazioni della sicurezza.
• Uso avanzato della crittografia e dell’autenticazione: adottare tecnologie come l’autenticazione a più fattori e la cifratura dei dati per proteggere informazioni sensibili.

Cubbit: una soluzione cloud innovativa per la compliance alla NIS2

Quando si tratta di garantire la conformità alla NIS2, l’adozione di soluzioni cloud sicure è fondamentale. Cubbit, una giovane e dinamica azienda italiana fondata a Bologna, sta rivoluzionando il mondo del cloud storage con il suo modello geo-distribuito.

A differenza dei fornitori di cloud tradizionali che concentrano i dati in pochi data center, Cubbit adotta un approccio completamente decentralizzato. I dati sono frammentati, crittografati e distribuiti su più nodi all’interno di un unico Paese, a scelta dell’utente, eliminando il rischio che la caduta di un singolo nodo comprometta la disponibilità dei dati.

Questa architettura garantisce una durabilità dei dati fino a 15 9, un livello di affidabilità diecimila volte superiore rispetto agli 11 9 offerti dalle soluzioni tradizionali. Inoltre, Cubbit offre un controllo senza precedenti sulla data residency, consentendo alle aziende di selezionare con precisione dove i loro dati vengono archiviati, in pieno rispetto delle normative NIS2 e GDPR.

Cubbit non si limita a offrire un’infrastruttura cloud sicura. Ha anche implementato avanzate tecnologie di protezione dai ransomware, come il versioning dei file e l’object lock, che impedisce la modifica o la cancellazione dei dati. Grazie a queste soluzioni, le organizzazioni possono recuperare versioni non compromesse dei file e proteggersi sia dagli attacchi malevoli che dagli errori umani.

Certificazioni di sicurezza e standard di eccellenza

Per offrire la massima tranquillità ai suoi clienti, Cubbit è soggetto a audit e certificazioni internazionali di terze parti, tra cui:

• ISO 9001:2015 per i sistemi di gestione della qualità
• ISO/IEC 27001:2013 per la sicurezza delle informazioni
• ISO/IEC 27017:2015 per la sicurezza nel cloud
• ISO/IEC 27018:2019 per la privacy e la protezione dei dati personali nel cloud
• Cybersecurity Made in Europe Label, una garanzia di qualità e affidabilità europea.

Cubbit è inoltre disponibile sulla piattaforma MePa e possiede la qualifica ACN (ex AgID), rendendolo idoneo per operare con enti pubblici e organizzazioni del settore privato che necessitano di livelli di sicurezza estremamente elevati.

Preparati alla NIS2 con Cubbit

Il tempo per adeguarsi alla NIS2 sta per scadere, e le conseguenze della non conformità possono essere devastanti. Cubbit rappresenta la soluzione ideale per le aziende che cercano un cloud sicuro, conforme e flessibile, capace di adattarsi ai nuovi requisiti normativi senza compromettere l’efficienza operativa.

Non aspettare oltre: visita il nostro sito web e scopri come Cubbit può supportare la tua organizzazione nella transizione verso la compliance NIS2, garantendo la protezione dei tuoi dati e la continuità delle operazioni aziendali.

L'articolo Guida alla conformità alla NIS2: La scadenza è a ottobre 2024 proviene da il blog della sicurezza informatica.

Artificial intelligence (AI) seems to be doing everything these days. Making images, making videos, and replacing most of us real human writers if you believe the hype. Maybe it’s all over! And yet, we persist, to write about yet another job taken over by AI: creating video games.

The research paper is entitled “Video Game Generation: A Practical Study using Mario.” The basic idea is whether a generative AI model can create an interactive video game by first training it on an existing game.

MarioVGG, as it is called, is a “text-to-video model.” It hasn’t built the Mario game that you’re familiar with, though. It takes player commands as text inputs—such as “run, or “jump”—and then outputs video frames showing the result in the ‘game.’ The model was trained on a dataset of frame-by-frame Super Mario Brothers game play, combined with data on user inputs at the time. The model shows an ability to generate believable video output for given player inputs, including basic game physics, item interactions, and collisions. It’s able to do this in a chained way, so that it can reasonably simulate a player making multiple actions and moving through a level of the game.

It’s not like playing a real Mario game yet, by any means. Regardless, the AI model has shown an ability to replicate the world of the game in a way that behaves relatively consistently with its established rules. If you’re in the field of video game development, though, you probably don’t have a lot to worry about just yet—you probably moved past making basic Mario clones years ago, so you’ve got quite an edge for now!

hackaday.com/2024/10/02/creati…

Introduction

In the ever-evolving landscape of cybersecurity, logs, that is information collected from various sources like network devices, endpoints, and applications, plays a crucial role in identifying and responding to threats. By analyzing this data, organizations can detect anomalies, pinpoint malicious activity, and mitigate potential cyberattacks before they cause significant damage. However, the sheer volume and complexity of logs often make them challenging to analyze effectively.

This is where machine learning (ML) comes into play. ML, a subset of artificial intelligence (AI), with its ability to process and analyze large datasets, offers a powerful solution to enhance threat detection capabilities. ML enables faster and more accurate identification of cyberthreats, helping organizations stay ahead of increasingly sophisticated attackers.

At Kaspersky, we have been using ML algorithms in our solutions for close on 20 years, and we have formulated ethical principles for the development and use of AI/ML. We utilize a variety of ML models and methods that are key to automating threat detection, anomaly recognition, and enhancing the accuracy of malware identification. In this post, we will share our experience hunting for new threats by processing Kaspersky Security Network (KSN) global threat data with ML tools to identify subtle new Indicators of Compromise (IoCs). We will also discuss challenges in implementing machine learning and interpreting threat hunting results.

The Kaspersky Security Network (KSN) infrastructure is designed to receive and process complex global cyberthreat data, transforming it into actionable threat intelligence that powers our products. A key source of threat-related data comes from voluntary contributions by our customers. To find out more, read about the principles of Kaspersky Security Network and our privacy policy.

The role of ML in global threat log analysis

Machine learning enables systems to learn from data and improve their performance over time without being explicitly programmed. When applied to cybersecurity logs, ML excels at analyzing large and complex datasets. It can automatically identify patterns, detect anomalies, and predict potential threats. When applied to our KSN global threat logs, ML can help predict and identify new threats.

One of the ML algorithms particularly well-suited for this task is Random Forest. This algorithm works by constructing multiple decision trees during training and assigning classes by the majority vote of the trees during scanning. Random Forest is especially effective in handling non-linear data, reducing the risk of overfitting, and providing insights into the importance of various features in the dataset. Random Forest is highly effective at identifying patterns, but this strength can lead to challenges in interpretability, particularly with larger models. It may produce positive results that are difficult to understand or explain due to the complexity of the decision-making process. Nevertheless, the benefits make it an excellent choice for analyzing logs and uncovering hidden cyberthreats.

ML Random Forest process

Reconstructing reality: the benefits of using ML in cybersecurity

Continuous learning allows ML models to detect subtle and novel cyberthreats, providing more robust defense. ML then acts to “reconstruct the cyber-reality” by transforming raw telemetry data into actionable insights that reflect the true state of a network or system’s security.

Reconstructing reality using logs: a depiction

The ability of ML-powered technology to analyze vast amounts of data in real time ensures that potential threats are identified and addressed more quickly, minimizing the window of vulnerability. Additionally, the adaptability of ML means that as new attack vectors emerge, models can still provide some level of protection without requiring updates, unlike traditional systems that often need constant rule revisions. This leads to a more proactive and effective cybersecurity posture, allowing organizations to stay ahead of increasingly sophisticated cyberattacks.

Ultimately, the ability of ML to partially reconstruct the cyber-reality from logs helps organizations stay ahead of cyberthreats by offering a clearer, more precise view of their security posture, enabling faster and better informed decision-making.

Methodology and challenges

The goal of the ML model presented in this study is to evaluate new logs and identify anomalous behavior. For that to be done, a clean dataset should be prepared, and the model needs to be configured with the right options to best perform its objectives. The model is then trained and tested, before being deployed to examine larger amounts of data.

Nearly every organization possesses unique datasets that can be leveraged to enhance and improve services. However, with this opportunity comes the critical responsibility of adhering to compliance standards and legal requirements. This responsibility is a key reason why we cannot disclose all the details of the training process and algorithms involved. Below we discuss the steps we have taken to achieve the goal, as well as the challenges you might encounter while training and applying similar models.

The dataset

A machine learning dataset is a collection of data used to train, validate, and test ML models. A dataset consist of various examples, each containing features (input variables) and, in supervised learning tasks, corresponding labels (output variables or targets).

Our dataset has been collected from, and is representative of, a large variety of previously investigated incidents. It describes advanced malware activities that we have observed in attacks by a variety of threat actors. More information about APT threat actors we track can be found here. The dataset contains a variety of indicators of malicious activities that were verified manually after being automatically collected to reduce the risk of inaccuracy.

A well-prepared dataset is foundational to the success of any ML project. The choice of dataset, its quality, and how it is prepared and split into training, validation, and test sets can significantly impact the model’s ability to learn and generalize new data. The adage of “garbage in, garbage out” applies here: if the dataset is flawed or poorly curated, the ML model’s predictions will also be unreliable.

Preprocessing

Preprocessing is a crucial step in a machine learning pipeline where raw data is transformed into a format suitable for training an ML model. This process involves cleaning the data, handling missing values, transforming variables into a scaled and normalized numerical representation, and ensuring that the data is in a consistent and standardized format. Effective preprocessing can significantly improve the performance and accuracy of an ML model.

One popular method we used for this transformation is term frequency–inverse document frequency (TF–IDF), which is a statistical measure used in natural language processing to evaluate the importance of a word in a document relative to a collection of documents. TF–IDF transforms raw text data into a set of machine-readable numerical features, which can be then fed to an ML model.

Implementation and training of the model

When dealing with text data, a common approach is to first transform the raw text into numerical features using techniques like TF–IDF and then apply an ML algorithm such as Random Forest to classify or analyze the data. TF–IDF is known to be efficient and versatile, while Random Forest is known for accuracy, reduced overfitting, and an ability to capture complex, non-linear relationships between features. The combination of TF–IDF with Random Forest allows handling high-dimensional data, while also providing robustness and scalability, very much needed to handle data with millions of entries daily.

A machine learning model reaches maturity when it performs consistently well on the kind of tasks it was designed for, meeting the performance criteria set during its development. Maturity is typically indicated by the following factors:

• Stable performance: The model exhibits consistent and satisfactory performance on both training and validation datasets.
• Generalization: The model generalizes well to new, unseen data, maintaining performance levels similar to those observed during testing.
• Diminishing returns from more training: After a certain point, adding more training data or fine-tuning the model further does not lead to significant improvements.

It is worth noting that model training does not necessarily end when it achieves maturity. To maintain model maturity, incremental learning is often needed, which means an ongoing process of updating and refining the machine learning model by incorporating new data over time. This approach is particularly important in dynamic fields where data distributions and patterns can shift, leading to the need for models that can keep up with these changes, which is exactly the case with the cybersecurity threat landscape.

During the development of our model, a target accuracy of 99% was set as a primary performance goal. Once the model achieved this level of accuracy, additional steps were implemented to further refine the output. These steps involved classifying the outcome in specific cases that required manual investigation.

Deployment and computational costs

When a model is ready, it can be integrated into a production environment where it can start making predictions on new data. This could be through an API, embedded in an application, or as part of a larger system. Continuous monitoring of the model’s performance to detect issues such as “concept drift” is essential to avoid degradation in accuracy, ensure reliable predictions, and maintain the model’s relevance in changing environments.

At the same time, both choices of TF–IDF and Random Forest can be computationally intensive. TF–IDF vectorization can lead to very large and sparse matrices. Random Forest models can become demanding when dealing with high-dimensional data and large datasets.

However, with the right capacities and hyperparameter fine-tuning, an optimal ML framework can be reached to permit the model to achieve its potential without sacrificing accuracy or efficiency. Example TF–IDF parameters that we found useful include frequency thresholds to allow, maximum features to extract, ngram range to match. Example Random Forest parameters that we found useful include the number of estimators, depth of the trees, split and leaf samples, and quality and impurity measurements.

Interpretability of results

In ML, and depending on the algorithm used, interpreting the model to understand how it makes predictions could be possible. This could involve analyzing the importance of features, visualizing decision trees, or using other evaluation tools.

However efficient, each model has its limitations that are important to know. Random Forests can be less interpretable than other models, especially with large numbers of input features. TF–IDF by design tends to give higher importance to rare items, which can sometimes be noisy or irrelevant in real-world applications. These feature limitations were acknowledged during development and considered in model fine-tuning.

The outcomes of machine learning during model training play a crucial role in guiding the development, refinement, and optimization of the model. These outcomes provide valuable feedback that helps data scientists and ML engineers make informed decisions to improve the model’s performance, guide adjustments, and ensure the final model is robust, generalizes well, and meets the desired criteria.

Findings: new cyberthreats discovered

As we started this study, we kept in mind that the usage of ML in log analysis enables the discovery of previously unknown cyberthreats by analyzing vast amounts of data and uncovering patterns. The model can process and learn from millions of data points in real time, pointing out subtle indicators that may signal the presence of a new or advanced threat. However, the results we got exceeded our expectations: the model revealed thousands of new advanced threats. As of H1 2024, ML findings represented 25% added detections of APT-related activities.

Here are a few examples of indicators of compromise found using ML in the past year. Once inspected, these indicators were quickly revealed to be part of malicious activity. The incidents involving these IoCs are not further investigated here, but our analysis of these and similar findings has been published (for example, here and here) or will be, in other posts on this site or in private threat intelligence reports.

Future directions

The future of using ML for telemetry analysis holds exciting possibilities, with several advancements on the horizon that could further enhance threat detection capabilities. One promising area is the integration of deep learning techniques, which can automatically extract and learn complex patterns from raw data. We already use deep learning in some of our products, and applying it to threat hunting could potentially further improve detection accuracy and uncover even more sophisticated threats.

Another area of exploration is reinforcement learning, where models can continuously adapt and improve by interacting with dynamic cybersecurity environments. This could lead to more proactive defense mechanisms that not only detect but also respond to threats in real time.

Additionally, federated learning presents a significant opportunity for collaborative threat detection across organizations while preserving data privacy. By allowing models to learn from decentralized data without sharing the actual data, federated learning could facilitate the creation of more robust and generalizable threat detection models.

Conclusion

The integration of ML into cybersecurity has already demonstrated its transformative potential by enabling the detection of novel cyberthreats that traditional methods might overlook. Through the analysis of vast and complex logs, ML models can identify subtle patterns and IoCs, providing organizations with a powerful tool to enhance their security posture. The examples of cyberthreats discovered over the past year underscore the efficacy of ML in uncovering threats across various industries, from government to finance.

These technologies will not only improve detection accuracy but also enable more proactive and collaborative defense strategies, allowing organizations to stay ahead of the ever-evolving cyberthreat landscape.

In this post, we have evaluated the utilization of ML models on our KSN global threat data, which has led us to reveal thousands of new advanced threats. The journey of refining ML models through meticulous dataset preparation, preprocessing, and model implementation has highlighted the importance of leveraging these technologies to build robust, adaptable, and scalable solutions.

As we continue to explore and enhance these capabilities, the potential for machine learning to reshape cybersecurity and protect against increasingly sophisticated threats becomes ever more apparent. The future of cybersecurity lies in our ability to ethically harness these tools effectively, ensuring a safer digital environment for all.

securelist.com/machine-learnin…

Un giovane di 24 anni è stato arrestato al termine di una indagine coordinata dalla Direzione Nazionale Antimafia e dal pool reati informatici della Procura di Napoli. Il giovane, un informatico originario di Gela, è accusato di aver violato ripetutamente i sistemi informatici del Ministero della Giustizia e di diverse aziende di rilevanza nazionale.

L’indagine, che si è protratta per diversi anni e ha coinvolto numerose procure italiane, ha rivelato come il 24enne fosse in grado di accedere a fascicoli di indagine coperti da segreto investigativo. Utilizzando avanzate competenze tecniche, l’hacker riusciva non solo a penetrare i sistemi protetti, ma anche a ottenere informazioni altamente sensibili, mettendo a rischio la sicurezza nazionale.

La scoperta degli attacchi informatici è avvenuta grazie al lavoro del pool specializzato della Procura di Napoli, il primo a rilevare anomalie nei sistemi del Ministero. Da lì è partita l’inchiesta, che ha portato alla collaborazione tra diverse procure, permettendo di tracciare l’attività criminale del giovane hacker.

L’uomo, impiegato come informatico, viveva tra Gela e Roma e operava utilizzando almeno cinque identità coperte per evitare di essere scoperto. Le sue azioni non si limitavano alla semplice intrusione nei sistemi: le sue competenze gli avrebbero permesso di bloccarli, mettendo potenzialmente a rischio l’operatività di enti cruciali per la sicurezza del Paese.

L’arresto segna un importante passo in avanti nella lotta contro la criminalità informatica in Italia, un settore in cui le minacce sono in continua evoluzione e richiedono la costante collaborazione tra le autorità nazionali e internazionali.

L’inchiesta prosegue per determinare l’ampiezza delle informazioni sottratte e l’eventuale coinvolgimento di altre persone nel vasto schema di intrusione digitale orchestrato dal giovane hacker.

L'articolo Arrestato l’Hacker 24enne che ha violato il Ministero della Giustizia e Importanti Aziende Italiane proviene da il blog della sicurezza informatica.

L’unica sicurezza che il decreto 1660 implementa è la sicurezza dei governi liberticidi di fare quello che vogliono rimanendo indisturbati, impunemente al riparo da qualunque protesta.

FIRMARE per FERMARE il DDL1660:

slowforward.net/2024/10/01/fer…

#ddl1660 #DDL1660 #ddl #DdlSicurezza1660 #neofascismo #statodipolizia