November 29, 2020 - securitylinkindia

International

Fujitsu Strengthens Cyber-Security with AI Technology to Protect Against Deception Attacks

MassMediaLink India LLP SecurityLink IndiaNovember 29, 2020November 14, 2024012 mins

Fujitsu Laboratories Ltd. recently announced the development of a technology to make AI models more robust against deception attacks. The technology protects against attempts to use forged attack data to trick AI models into making a deliberate misjudgment when AI is used for sequential data consisting of multiple elements. With the use of AI technologies progressing in various fields in recent years, the risk of attacks that intentionally interfere with AI’s ability to make correct judgements represents a source of growing concern. Many suitable conventional security resistance enhancement technologies exist for media data like images and sound. Their application to sequential data such as communication logs and service usage history remains insufficient, however, because of the challenges posed by preparing simulated attack data and the loss of accuracy. To overcome these challenges, Fujitsu has developed a robustness enhancement technology for AI models applicable to sequential data. This technology automatically generates a large amount of data simulating an attack and combines it with the original training data set to improve resistance to potential deception attacks while maintaining the accuracy of judgment. By applying this technology to an AI model developed by Fujitsu to judge the necessity of countermeasures against cyber-attacks, it was confirmed that misjudgment of about 88% can be prevented in our own attack test data. Details of this technology was announced at the Computer Security Symposium 2020 held from October 26 (Monday) to October 29 (Thursday). Background I n recent years, AI has been increasingly used to analyze a vast range of data in fields as varied as medicine, social infrastructure, and agriculture. Nevertheless, the existence of security threats peculiar to AI represent a growing threat. Examples include attaching small stickers to road signs to confuse recognition systems, and intentionally trying to trick AI models with slightly changed attack data in order to prevent correct judgment. To help avoid these types of threats, an adversarial training technique has emerged in which simulated attack data created in advance is added to training data so that the AI model is not fooled when it encounters malicious actors. Previous technologies remain insufficient for dealing with the challenges posed by sequential data, however. AI has a wide range of applications for this type of data, including for detection of cyber-attacks and credit card fraud, and so a growing need exists to develop technologies that can be applied to sequential data to strengthen resistance against deception attacks. Issues One way that cyber-attacks can be detected is through the analysis of communication log data. For instance, when an attacker logs in from the first terminal to another terminal, executes written malware, and performs a series of attack operations to spread infection, an AI model can detect the attack from the communication log of such operations. However, attackers disguise attacks by mixing them between legitimate administrative operations, such as collecting server logs or applying patches, which can lead to false negatives in the AI detection model. In order to apply the adversarial training techniques to such series of data, it is necessary to automatically generate a large amount of data simulating a deception attack as training data. In the case of media data such as images, it is possible to generate simulated attack data easily without damaging the characteristics of the original data by processing the data in units of pixels that cannot be discriminated by humans. However, in the case of sequential data, it is not clear which element affects the characteristics of the original data, so if you simply process a part of the data, the characteristics of the original data may be lost (Figure 1). For example, the communication log data used to detect a cyber-attack is a series of log lines consisting of various elements such as the source of communication, the destination of communication, the account used, the execution command, and the command arguments. In addition, even if simulated attack data can be generated, when it’s used to train AI, it is necessary to be careful not to decrease the judgment accuracy for the original attack data. Newly Developed Technology Fujitsu has developed a technology that can automatically generate simulated attack data for training, which can be applied to AI models that analyze sequential data and enable training with less deterioration in the accuracy of attack detection. The features of the developed technology are as follows: Automatic generation of simulated attack data When creating simulated attack data, we first prepare the original attack data as a base and the data used for impersonation. In the case of cyber-attacks, the attacker wants to disguise malicious operations as benign operations, so the base data is the communication log data of the malicious operation, and the data used for the disguise is the communication log data of the benign operation. Next, the communication log data of benign operations used for the impersonation is analyzed by the AI model before the countermeasure, and the data with the impersonation effect which is easy to be judged as the benign operation is extracted referring to the result. This extracted data is combined with the communication log data of the base malicious operation, and it is generated as simulated attack data. Since the communication log data of the base malicious operation remains unchanged, a large amount of simulated attack data can be generated automatically without losing its original characteristics (Figure 2). Ensemble adversarial training techniques Using the original learning data set and the simulated attack data set generated with the new technique described above, two kinds of AI models are constructed – an AI model which works accurately for the original learning data and an AI model which works accurately for deception attack data (Figure 3) and the decision results of the two AI models are integrated by ensemble learning using features indicative of possible deception attack data. In the case a cyber-attack is detected, it becomes possible to use ensemble learning to automatically and appropriately train AI models to decide which AI model’s decision should be…

International

Honeywell Introduces Virtual Reality-Based Simulator to Optimize Training for Industrial Workers

MassMediaLink India LLP SecurityLink IndiaNovember 29, 2020November 14, 202403 mins

Honeywell recently introduced an advanced industrial training solution that combines 3D immersive technology with industry-leading operator training simulation to create a collaborative learning environment for plant operators and field technicians. Honeywell’s Immersive Field Simulator is a virtual reality (VR) and mixed reality-based training tool that incorporates a digital twin of the physical plant to provide targeted, on-demand, skill-based training for workers. “Faced with increasingly complex technology and an experienced workforce nearing retirement, operators need robust technical training and development solutions that accurately depict real-world environments,” said Pramesh Maheshwari, Vice President and General Manager, Lifecycle Solutions and Services, Honeywell Process Solutions, “Traditional training approaches often fail to meet the mark when it comes to helping panel and field operators and maintenance technicians in process plants become better at their jobs. The result can be reliability issues and increased operational incidents.” The Immersive Field Simulator offers a smooth, virtual walk-through to familiarize workers with the plant. It includes avatars that represent virtual team members. The simulator’s cloud-hosted, device-agnostic platform, which incorporates flexible 3D models, grows with the user as plant operations change. The simulator is customizable to meet specific instructional needs and project team members and plant subject matter experts can easily create customized training modules. Honeywell’s Immersive Field Simulator transforms training for today’s digital-native workforce, enabling employees to learn by doing while increasing knowledge retention, minimizing situations that can result in operational downtime improving competencies across a variety of areas. “With our end-to-end solution, console and field operators can practice different operating and safety scenarios, including rare but critical situations, in a safe, simulated environment,” said Maheshwari, “This approach significantly improves upon current training tools and methods. VR-based training boosts confidence and retention while improving overall professional skills. Experience shows that students using VR can learn significantly faster than in the classroom.” Honeywell’s Competency Management program, which includes the simulator training, is built upon decades of workers’ experiences using integrated control and safety systems. Honeywell has incorporated this experience into state-of-the-art competency-based offerings that improve worker performance and safety.

International

Rising to Meet the INTERPOL Digital Security Challenge

MassMediaLink India LLP SecurityLink IndiaNovember 29, 2020November 14, 202406 mins

Imagine that a well-known company has been hit by a cyberattack – criminals have conducted a business email compromise (BEC) scam against the company, compromising the email of the CEO to trick an employee into making a payment of USD 100 million to an account controlled by the criminals. Now imagine you are a police officer working at the INTERPOL National Central Bureau (NCB) in your country, and you are asked to work with cybercrime investigators as well as other digital forensics examiners around the world to investigate the incident. Although this is a fictional scenario, BEC fraud is a very real crime threat which police worldwide face on an increasingly regular basis. Real-world investigation This BEC scam was the premise of the fourth INTERPOL Digital Security Challenge – where teams of experts pool their knowledge and expertise in a race against the clock to investigate a simulated real-world cybercrime incident and gather evidence to identify the perpetrators. For the first time, the event was held virtually due to the COVID-19 pandemic. During the challenge, the 100 participating cybercrime and digital forensics experts from 50 countries had to analyse infected computers and contents of the BEC email messages received by the fictional company to uncover evidence of the malware used and the email servers which had been compromised. After linking the malware to a command and control (C2) server, the teams identified clues that would help narrow down the whereabouts of the cybercriminals and takedown the server. Adding an additional layer to the scenario, the criminals filmed the police takedown using drones and compromised the personal details of the officers involved. But one of the drones was captured, so the teams conducted digital forensic examinations to gather data from the device which identified the criminals’ location. A computer seized at this location was also analysed for further information on the cybercriminals’ activities. Craig Jones, INTERPOL’s Director of Cybercrime, underscored the importance of providing hands-on experience in using the latest techniques and technological tools for investigating cybercrime. “In the ever-changing world of cybercrime, theoretical knowledge is only one component of a successful investigation,” said Mr Jones. “Practical exercises like the Digital Security Challenge, which replicate the situations investigators will face in the real world, are great opportunities to gain the critical technical capabilities necessary to follow the digital trails left by cybercriminals,” concluded Mr Jones. Cybercrime investigations are becoming more and more complex and operational exercises such as the Digital Security Challenge, which simulate some of the hurdles that investigators face every day, are vital for the development of our capacities. Public-private partnership The five-day (12-16 October) event was organized in close collaboration with private industry partners NEC Corporation and Cyber Defence Institute. Throughout the simulated investigation, virtual training sessions were conducted to develop participants’ practical knowledge on relevant topics including malware analysis, drone forensics and BEC fraud. For the first time, NEC and Cyber Defense Institute joined the Challenge. Isao Okada, General Manager said, “We strongly believe this kind of event can help attendees gain the technical capabilities required to fight the latest cyber crimes.” First held in 2016, the Digital Security Challenge helps police worldwide develop the skills necessary to tackle the latest cybercrime threats. Previous editions simulated cyber blackmail involving Bitcoin, a ransomware attack, and the hacking of ‘Internet of Things,’ or IoT, devices.

Feature

People Do People Things: The Future of Security is Human

MassMediaLink India LLP SecurityLink IndiaNovember 29, 2020November 14, 202407 mins

As 2020 comes to an end, the importance of understanding the relationship between humans and technology is at an all-time high. Widespread shifts in the fabric of our society, prompted by the ongoing pandemic, exposed weaknesses in security tools and protocols for remote workers, highlighted issues of network reliability and accessibility, and demanded that humans find innovative ways to keep organizations running. While the fallout from the pandemic is unignorable, the ability for people to respond to seemingly endless challenges has been nothing short of remarkable. The year 2021 will continue to reflect human resilience and ingenuity. It will be the year of workarounds and self-serving insider threats, where people find ways to accomplish their goals despite dealing with personal and professional adversity. Workarounds, shortcuts, and creative work strategies are simultaneously a celebration of human creativity and a risk for organizations who are desperately trying to maintain visibility of their assets. Ultimately, people sharing data and accessing corporate networks in new and potentially unsanctioned ways carries quite a bit of risk – especially for organizations that are new to managing remote workers. The result of these changes is that successful cybersecurity strategies will stop trying to use technology as a unilateral force to control human behavior. Rather, organizations will come to terms with the reality that adding more and more technology or security does not lead to behavioral conformity, especially not conformity that aligns with security principles and adequate cyber hygiene. In fact, additional layers of security may push more people outside of the guiderails due to increasingly aggravating security friction that blocks them from completing tasks or easily accessing critical organizational assets. Understanding precedes predicting In light of this, understanding how people adapt to, respond to, and inform their environments is critical for organizations heading into the new year. For far too long, the tech world has created products with the assumption that people will use them in an expected or uniform way, or that people would conform to the rules and constraints laid out by well-meaning engineering teams. If we’ve learned anything from 2020, it is that people are not always predictable, and making assumptions about human behavior is a dangerous game to play. What’s surfaced is that expectations, guidelines, best practices, and even commands will yield every type of behavioral response – from rigid compliance to retaliatory noncompliance. What can we do? We can learn more about what motivates behavior, and how people ultimately choose to behave. We can also commit to designing and implementing security practices and tools that work with humans instead of against them. To do this, however, we have to focus on measuring and understanding behavior instead of focusing exclusively on detecting compromises and vulnerabilities. For instance, we know that people’s immediate needs often outweigh potential negative consequences – especially when the consequences do not have a direct, individual, and immediate impact. This means that when we need to accomplish our goals we often take the easiest route. Unfortunately, the easiest route is often riskier than the ‘ideal’ route. When faced with frustrating, security-heavy file and data sharing tools, we may turn to sharing via personal cloud applications. Making rules to stop people from engaging in this type of behavior is not working – so rather, we have to better understand these behaviors to find ways to mitigate their risk to organizations and organizational assets. Building behavioral understanding into systems Within the cybersecurity industry, observing and understanding behaviors must come with context. What may appear at first glance like an obviously malicious act likely to lead to data loss – for example an engineer requesting access to multiple sensitive data repositories over the course of two days – could simply be a person getting their job done. Our engineer may be doing this because she’s been added to several new projects and needs to be able to collaborate with her new team. We want people to be able to do their jobs within the constraints of our corporate network and policies, so blocking them would only encourage the human tendency to find an easier (and less secure) route for getting their jobs done. With an interdisciplinary research team, pulling experts from security, counter-intelligence, IT, and behavioral sciences together, behavioral understanding can be built into cybersecurity systems. And this is the first important step for finally starting to move cybersecurity left of breach – designing security for the human element.

Feature

Improved Alarm Accuracy with AcuSense Technology It Makes You Feel Safer

MassMediaLink India LLP SecurityLink IndiaNovember 29, 2020November 14, 202407 mins

Video surveillance has evolved from a simple requirement for clear images to video content analysis (VCA) for improved management. Now, with deep learning, security solutions are enabled with sophisticated intelligence and efficiency at a whole new level. Prama Hikvision’s AcuSense is newly born out of this, which makes advanced VCA and deep learning capabilities available to small and medium businesses, and residential customers for the first time. Small and medium businesses have many of the same surveillance and security requirements as larger organizations. They need to identify and react to perimeter breaches in real time, and they need to automate footage searches to fast locate true events. Another example could be the security and protection for your residential area. Why you need accurate alarms? I magine, when you need to look into the security of your house, the first line you probably would consider is its perimeter. The idea is to prevent intruders from breaking in. However, conventional surveillance system may not do the job well enough. Why? Conventional surveillance systems provide certain detection features enabled by video content analysis (VCA) such as motion detection, line-crossing detection and intrusion detection, but they would simply compound all event detections, triggering frequent alarms when an object is detected. This could be an animal, a shadow, or other natural movements – we call them false alarms. As a result, you need to spend time to investigate each one, potentially delaying any necessary response and generally affecting efficiency. So being able to identify the real threats – the presence of a human or a vehicle – would greatly improve the accuracy of perimeter VCA functions. Prama Hikvision’s hassle-free AcuSense technology can help achieve this goal, and give you a cost-effective way to protect your locations and assets. Enhanced alarm accuracy saves time and worries Employed with advanced VCA and deep learning algorithms, Prama Hikvision AcuSense helps you maximize security with efficient human and vehicle detection by categorizing alarm information into human, vehicle, and other objects. With high accuracy, the system disregards alarms triggered by other objects such as rain or leaves, and delivers alarms that are associated with human or vehicle detection. With Prama Hikvision’s AcuSense, you also get a ‘quick target search’ feature that allows security personnel or local police to find footage quickly in the event of a security incident. This saves many hours rather than searching for footage manually. Efficient alerts and video clips help you in the know Now re-imagine your perimeter security system armed with Prama Hikvision’s AcuSense technology. Video surveillance is in operation when an intruder tries to sneak on a windy and rainy day. The intruder probably thought such bad weather would do him a favor, as there are no witnesses near your house. But this is not the case. The security camera incorporated with AcuSense precisely captures the intruder entering your front yard. At the same time, you receive a message on your smartphone and view the video feeds. With this verified alarm, action can be taken straight away. Prama Hikvision’s AcuSense prevents problems before they escalate into would-be emergencies. Our fully-integrated video surveillance makes it easy for you to see and capture important activity with video alerts, live feeds and 24/7 digital video recording – all easily viewed from your Hik-Connect app. Prama Hikvision AcuSense key features False alarm reduction: Reduces false alarms triggered by inanimate objects to a minimum, vastly improves alarm efficiency and saving costs; Quick target search: More efficient and effective file searching based on human and vehicle classification, preventing security personnel from having to search through footage manually; Strobe light and audio alarm: Wards off potential intruders by combing siren with flashing light. Prama Hikvision’s AcuSense technology can be found in our EasyIP and Turbo HD product ranges, which provide the ideal security solutions for small factories, residential estate and villas, small hotels, and gas stations, indoor and outdoor, to name a few.

Feature

Challenges and Solutions to Managing a Fire Detection System in a Hospital

MassMediaLink India LLP SecurityLink IndiaNovember 29, 2020November 14, 2024133 mins

There are over 1200 NHS hospitals across the UK, spread across 223 NHS trusts, ranging in age and complexity. Very few of them are single stand-alone buildings, instead the sites usually represent complicated infrastructure networks, that have grown and developed over a few decades. This in turn increases the complexity of the fire detection system across the whole site. The challenges in managing fire detection system in such structures can be associated with: Cost of ownership: Management of aging system and replacement components availability. Contracts locked to a single supplier of the fire protection services. Structural challenges: Management of different detection systems within one hospital. Management of works and renovations in the hospital, while ensuring uninterrupted fire safety. Protection of temporary structures. Maintenance of challenging wards that do not allow for interruption of services. Management of full or partial fire system upgrades. Evacuation and fire strategy: Buildings cannot be fully evacuated. Complex fire safety strategies employed. Fire spread information is routinely used. System performance issues within specific environments: False alarms. HPV cleaning. COVID-19 nebulising spray. Contingency wards protection. Cost of ownership Many of the challenges associated with the management of an aging system and immutable maintenance contracts could quite often have been avoided if the new sites were delivered with consideration for future building evolution, system lifecycle and the total cost of ownership. Fire detection equipment is generally expected to last 10 years (FIA guidance on the life expectancy of a fire detection & alarm system issue 1). However, the same equipment will often remain in place for up to 25 years. In a national survey carried out with healthcare fire officers, 50% of respondents described their system as between 10-20 years old, with a further 13% saying it was over 20 years old. Old systems tend to be difficult to manage due to reduced system reliability. Varied faults can cause false alarms and unnecessary disruption to hospital operation, and this can result in fines. The biggest issues come when the system cannot be maintained any longer due to component obsolescence or due to becoming unsupported by the manufacturer. A system renovation often only replaces sections of the system. Equipment such as detector heads and the control panel are likely to be replaced only if proven to be troublesome or prone to false alarms. Ideally the fire detection system will have forward and backwards compatibility meaning that a modern control panel can replace the ageing one without changing the detectors and modern higher reliability detectors can be used in the current control panel to address false alarms. Thus, areas of the system can be updated and will work seamlessly with the original system. This gives the ability to manage specific issues and to be able to renovate the system in phases, spreading the cost and minimising disruption. It also ensures that even if some components have been made obsolete, there is a modern replacement available, that will work reliably on the old infrastructure. Otherwise, it is possible that the whole system will require a full and immediate overhaul due to an unforeseen component obsolescence or non-compliance. The cost and complexity of renovation itself can vary dramatically depending on the type of system installed. Some NHS sites in the past have experienced very high cost of ownership for closed protocol systems. Closed protocol can be described as a system where only a single supplier of installation and maintenance services is authorised to work with the fire system. The ownership of systems like this means that the building owner is locked into a contract and the only way out is a full system replacement. The cost of replacement usually deters end users from changing a manufacturer and therefore they usually don’t have a choice but to carry on managing a system that is expensive to run and limited in choice of service suppliers. By avoiding closed protocol solutions, a competitive tendering process can be encouraged between different fire protection service providers. A fire system that allows the customer to choose between any qualified engineer to service/ install a system is known as Open Protocol. The original cost for these systems can be higher than the closed alternative, but once the total cost of ownership is considered, over the lifetime of a system, open protocol solutions tend to be more cost effective and flexible, allowing the building owner to choose between service providers that suits their requirements and quite often between control panel manufacturers. The total cost of ownership is often overlooked due to differences in managing capital and operational expenditure within NHS trusts, nevertheless, it is paramount to ensuring the best system is chosen for the building and is future-proofed, as well as the best possible financial outcome for the NHS. Structural challenges There are usually a number of construction and renovation works happening across a hospital complex at any one time, which often creates additional challenges for the fire system. Any works being carried out must be done without any downtime and minimal disruption as hospitals are operational 24 hours a day 365 days a year. Contractors can create copious amounts of dust that can set off smoke detectors, causing false alarms. This combined with maintenance work being carried out at night can cause a headache for healthcare estates staff as personnel must be called out of hours to correct it. One option to prevent these false alarms while ensuring fire safety is to temporarily replace smoke detectors for heat detectors in the area being worked in. Heat detectors or CO/ heat detectors are not prone to contamination and therefore are less likely to falsely activate due to dust. It is important to consider that smoke detectors’ coverage area is larger than a heat detectors and therefore a point for point replacement will result in a loss of coverage. Another option is to use a multisensor with multiple modes of sensitivity such as Apollo Soteria, this detector is much more resilient to false alarms due to its advanced chamber…