Cybersecurity Science with Shawn Riley

Introduction In today's world, technology plays an integral role in businesses' success. However, with technological advancements comes the risk of cyber-attacks, making it essential for businesses to prioritize their cybersecurity. Misconfigurations, which refer to errors or incorrect settings made in system configurations, are common vulnerabilities that can lead to data breaches, loss of business, and legal penalties. Identifying these security-relevant misconfigurations is crucial for businesses to mitigate risks, but it can be challenging, especially in complex IT environments. This paper will explore how businesses can identify security-relevant misconfigurations and the challenges involved. Additionally, we will discuss how TTP-level cyber threat susceptibility assessments using MITRE ATT&CK can help businesses identify and prioritize these vulnerabilities. How Do We Know What Misconfigurations Are Security Relevant? Misconfigurations can occur at various levels of t...

As the threat landscape continues to evolve and become more complex, organizations need to have a comprehensive approach to managing their cybersecurity risks. One effective approach is to implement a Continuous Threat Exposure Management Program that includes a TTP (tactics, techniques, and procedures) level Cyber Threat Susceptibility Assessment. By leveraging a Digital Cyber Twin with Machine Reasoning for TTP level Cyber Threat Susceptibility Assessment, organizations can continuously collect and analyze data from both the attack surface and the threat landscape, and update risk management strategies in real-time. This enables an evolutionary approach to holistic cyber risk management, by allowing organizations to stay ahead of the curve and respond to emerging threats quickly and effectively. Here's how the Digital Cyber Twin mobilizes defense teams across an organization: The Digital Cyber Twin uses a TTP level Cyber Threat Susceptibility Assessment to build attack path scena...

As the digital world continues to expand, organizations are facing an increasing number of cyber threats. To effectively manage and mitigate these threats, a continuous threat exposure management program is essential. The Digital Cyber Twin can be used to perform cyber threat susceptibility assessments on the organization's IT enterprise. In this article, we will explore the ten key aspects of cyber threat modeling and how they support the Digital Cyber Twin in performing a better cyber threat susceptibility assessment of the organization. Intent: Understanding the intent of an attacker is critical in cyber threat modeling. The Digital Cyber Twin can use this information to identify the types of attacks that may be carried out and the potential impact they could have on the organization. This allows the Digital Cyber Twin to develop targeted threat mitigation strategies. Capability: Understanding the overall capability of the adversary is important in prioritizing mitigation effort...

Introduction Artificial Intelligence (AI) is a rapidly evolving field, with many subfields and techniques for building intelligent systems. One of the most promising subfields is Machine Reasoning, which uses symbolic representations and logical reasoning to draw conclusions from data. In the field of cybersecurity, machine reasoning can be used to build a virtual attacker that can simulate millions of cyber attacks to determine specific attack scenarios against an organization, and calculate the risk from these attacks. In this article, we will explore what machine reasoning is, how it can be used to build a virtual attacker, and what challenges need to be addressed to make it work. Machine Learning vs. Machine Reasoning Before diving into machine reasoning, it is important to distinguish it from machine learning, which is often used interchangeably with AI. Machine learning is a statistical method that involves the analysis of large amounts of data to identify hidden patterns and bui...

In today's rapidly evolving digital landscape, cyber threats and attacks are becoming increasingly sophisticated and widespread, and organizations across all industries and sizes are at risk. To protect themselves, many organizations are turning to risk management approaches that enable a comprehensive view of their cyber risk, including TTP (tactics, techniques, and procedures) level Cyber Threat Susceptibility Assessments (CTSA). However, conducting these assessments can be challenging, especially in a dynamic and constantly changing threat environment. That's where using a Digital Cyber Twin with Machine Reasoning comes in. A Digital Cyber Twin is a virtual replica of a physical asset or system, which can be used to simulate and analyze the performance of the real-world asset in a safe and controlled environment. Machine Reasoning involves using algorithms and models to make sense of complex data, and is used to enable a more dynamic and adaptive approach to cyber risk manag...

Digital Cyber Twins are sophisticated virtual representations of physical assets, systems, and processes that are constructed through the use of data. These digital replicas differ from virtualized IT such as containers, which are purely technological solutions, in that they offer a comprehensive understanding of an organization's attack surface and threat landscape, essential for effective and efficient continuous cyber threat susceptibility analysis and continuous risk assessment. The integration of different types, formats, and sources of security information, necessary to construct the digital cyber twin, is facilitated through traditional Knowledge Representation & Reasoning techniques. These techniques provide a more accurate and comprehensive representation of the threat landscape, allowing for effective and informed decision-making. The digital cyber twin serves as a unified representation of an organization's security posture, making it easier to identify and prior...

As organizations seek to improve their cybersecurity posture and mitigate the risk of cyber threats, there are a variety of tools and approaches available for assessing and managing risk. Two common approaches are vulnerability scanning and TTP (tactics, techniques, and procedures) level Cyber Threat Susceptibility Assessments. While vulnerability scanning can be a useful tool for identifying known software and hardware vulnerabilities, a TTP level Cyber Threat Susceptibility Assessment combined with vulnerability scanning offers a more comprehensive and holistic way to measure risk. Vulnerability scanning involves the automated identification and assessment of known software and hardware vulnerabilities. This approach relies on a database of Common Vulnerabilities and Exposures (CVEs) to identify and prioritize vulnerabilities. While vulnerability scanning can be a useful tool for identifying known vulnerabilities, it does not necessarily provide a comprehensive view of an organizatio...

In the current digital era, data breaches are becoming increasingly common and pose a significant threat to organizations of all sizes and industries. Cybercriminals are becoming more sophisticated, and their methods of attack are becoming increasingly advanced, making it imperative for organizations to adopt a proactive approach to cybersecurity. Resiliency engineering is a proactive approach that assumes that a data breach has already occurred and focuses on planning to mitigate the damage, minimize the time it takes to recover, and prevent future attacks. Cyber Threat Susceptibility Analysis (CTSA) plays a critical role in resiliency engineering as it helps organizations understand their potential vulnerabilities to cyber threats and the impact that these threats could have on their operations. By conducting a CTSA, organizations can prioritize their cybersecurity efforts, identify areas for improvement, and prepare for the aftermath of a cyber attack. CTSA should be a continuous pr...