After returning from BlackHat and shaking off the effects of the late nights and early mornings, we've had time to reflect on the central themes that emerged at this year’s premier hacker conference.
AI Goes Mainstream... With Mainstream Challenges
AI was a focal point at BlackHat, underscoring its shift from novelty to practical application. This transition brings with it a range of security risks. Presentations varied from leveraging Large Language Models (LLMs) for more efficient security response and threat hunting, to strategies for thwarting AI-generated vulnerabilities. Despite the widespread adoption of AI by security teams, many still struggle to grasp its varied implications on their overall security posture.
The increase in AI tools and applications inevitably leads to heightened AI-related risks. The growing concern of the potential misuse of AI-assisted offensive cyber operations is just one example of the challenges developers and security teams are facing in the AI generation. Developing skills around generative AI privacy as well as threat analysis with AI are fundamental components of protecting organizational risks introduced by artificial intelligence and large language models.
Cloud Security Remains Crucial
An alarming trend is the increased abuse of cloud-based services from giants like Microsoft and Google by hacking groups for command and control and data extraction. The use of ubiquitous services like Google Drive and Microsoft OneDrive for malicious communications complicates detection efforts, making cloud security a top priority for enterprises.
Although it is impossible to entirely eliminate cloud environment risks, adopting best practices to minimize and manage these risks is essential for the success of cloud infrastructure.
Lessons from the CrowdStrike Incident
Last month’s CrowdStrike incident was still fresh on the minds of conference attendees, underscoring the need for the industry to brace for more supply-chain attacks and to implement robust cyber resilience plans. Such incidents, combined with the widespread use of cloud infrastructure, highlight the critical importance of recognizing vulnerabilities and proactively minimizing these threats.
The CrowdStrike incident emphasized the necessity of a "secure-by-design" approach, where security is integrated into the development process from the outset. Understanding how to evaluate risk as part of a supplier selection, examine third-party security, practices, and protocols, as well as developing incident response plans are all crucial to mitigating risks associated with the supply chain.
The Imperative of Training
Central to addressing these issues is the need for effective training to minimize and manage risks and this year’s BlackHat had plenty of courses to offer. We heard from many attendees that training for secure software development is a key priority. But when it comes to bringing that training back to their organizations, they face similar challenges. From the challenge of focusing their developers on security to overcoming one-size-fits all training platforms, many conference attendees told us that they have struggled to find a solution that meets their needs.
Challenges in secure software training include maintaining learner engagement, improving progress tracking, personalizing communication, reducing course dropout rates, minimizing administrative overhead, and providing a customized user experience. Incorporating hands-on training within the learning framework, along with skills assessments and targeted development plans, remains a significant hurdle.
At CMD+CTRL, we help organizations uplevel their software security with more secure, resilient code. Our solutions help eliminate skills gaps, mitigate risk, achieve compliance, and drive productivity. With features like our new nudges and notifications capabilities, we’re always working to increase learner engagement and ensure teams get the most out of their secure software training.
Visit cmdnctrlsecurity.com to learn how we can help you launch a best-in-class security program.