Name: Cisco buys Armorblox for… GenAI? Silly Awards, RIP Metaverse, and new AI FOSS – ESW #320
Uploaded: 2023-06-08T00:00:00.000America/New_York
Description: Cisco buys Armorblox for… GenAI? Silly Awards, RIP Metaverse, and new AI FOSS – ESW #320

In this episode we briefly cover funding, and discuss Snyk's acquisition of Enso Security and Cisco's Armorblox buy. We discuss some new open source AI tools: privateGPT, llm, ttok, and strip-tags. We discuss the death of Meta's massive Metaverse movement and go DEEP down the rabbithole on the new Stop Silly Security Awards website. Artifact's AI rewrites clickbaity headlines and we wrap up by exploring a very entertaining Map of GitHub communities: <a rel="noopener" target="_blank" href="https://anvaka.github.io/map-of-github/">https://anvaka.github.io/map-of-github/</a>

Featured image for Enterprise News – ESW #320 segment from PPWorks

Join us at an upcoming Official Cyber Security Summit in a city near you! This series of one-day, invitation-only, executive level conferences are designed to educate senior cyber professionals on the latest threat landscape. We are pleased to offer our listeners $100 off admission when you use code SecWeek23 to register. Visit securityweekly.com/cybersecuritysummit to learn more and register today!

CSS Summit Graphic 2

FUNDING: Sekoia.io has Raised €35M in a New Round of Financing, a Record Amount for a European Cybersecurity Company in series A

FUNDING: Backed by $15 million Series B Funding, Blumira Launches Easy XDR Platform for Small & Medium Business

FUNDING: Galvanick Raises $10M in Seed Funding

FUNDING: Data management startup Alcion launches with $8M in funding – SiliconANGLE

FUNDING: Compliance automation startup Strike Graph lands $7M to expand certification offerings

FUNDING: Keep Aware Raises $2.4 Million to Eliminate the Browser Blind Spot with Human-Centric Security

DEFUNDING: SentinelOne stock plummets more than 35% as annual guidance slashed, layoffs planned

ACQUISITIONS: Snyk To Acquire Enso Security For Improved AppSec Visibility

ACQUISITIONS: Cisco Buys Armorblox to Bring Generative AI to Its Portfolio

NEW TOOLS: privateGPT

NEW TOOLS: llm, ttok and strip-tags—CLI tools for working with ChatGPT and other LLMs

A new podcast, focusing heavily on the intersection of GenAI and security!

NEW PODCAST: MLSecOps Podcast

I LOVE analysis like this. Pricing in the tech and security world is so often a mystery, or straight up secretive. Even when it is shared, it can often be so complex and based on unknowns that it isn't until you get hit with a bill that you realize what you're in for. 

We need more transparency in pricing.

ANALYSIS: Microsoft Sentinel Cost, Plus Defender: More Expensive Than You Think

A lot of truth to this. 

It's painfully difficult to get honest, detailed feedback on a product. When you do, it tends to be at extremes: someone is either delighted or disgusted with what you've built. For this reason, all rating systems need to be viewed with a curve. The 5s oversell how great the product is, and the 1 stars oversell how bad it is.

But it does tend to be the negative reviews that have the important feedback. You don't get much from folks that love your product the way it is, yet companies want to spend more time with these folks - they want to do case studies and promote how much they love it. Meanwhile, folks that have a problem with it are often promised fixes that never come and feel unheard.

ESSAYS: Angry customers are a gift

ESSAYS: Withholding Single Sign-On from SaaS Customers is Bad for Business and Security

An excellent essay from Mike Privette

ESSAYS: Leveraging Large Language Models (LLMs) in Business: Risk Assessment and the Imperative of Data Security

ESSAYS: Cybersecurity in Space

ESSAYS: Cybersecurity Budgets Aren’t Untouchable

Oooh, oooh, now do crypto and blockchain!

Seriously though, this is an interestingly timed article. The Quest 3 was just released starting at $500 (hundreds more than the Quest 1 or 2), and the Apple Vision Pro was just announced with a starting price of $3500. 

This obit clearly isn't for VR and AR - the article doesn't even mention the forthcoming Apple product, and everyone knew it was being released at the WWDC at the time this article was published. This is for the idea of the Metaverse, which Meta created in the form of an application called Horizon Worlds. When it became available, no one flocked to it. A year after its release, it had 200 thousand MAUs.

By comparison, 5 months after release, ChatGPT has 173 million MAUs. Nearly three orders of magnitude more.

ESSAYS: RIP Metaverse, we hardly knew ye

ESSAYS: Kelly’s Kommentary on the 2023 Verzion DBIRRRRRRR

I'm a bit torn here. There a lot of shady, seedy awards 'companies' out there. However, shaming someone is never a great way to solve a problem, especially when you don't suggest alternatives.

TRENDS: Stop Silly Security Awards

Artifact is a clever newsreader that allows you to rewrite headlines. If enough folks tag a headline as clickbaity, they'll rewrite it for everyone!

AI TRENDS: Artifact’s AI Will Rewrite Clickbaity Headlines, Though Don’t You Dare Rework Mine

A very useful and instructional explanation of how they built this feature.

AI TRENDS: Clickbait Rewriting on Artifact: Behind the Scenes

AI TRENDS: How Hackers Can Up Their Game by Using ChatGPT

This is particularly devious... and tough to protect against. This attack vector is similar to how the Log4Shell exploit works. You can distribute indirect prompt injection all over the place and then just wait for shells, as LLMs inevitably read and respond to your prompt injection payloads.

AI ATTACKS: Indirect Prompt Injection via YouTube Transcripts · Embrace The Red

<a rel="noopener" target="_blank" href="https://www.darkreading.com/ics-ot/bridgestone-ciso-lessons-ransomware-attack-acting-thinking">https://www.darkreading.com/ics-ot/bridgestone-ciso-lessons-ransomware-attack-acting-thinking</a>

POST MORTEMS: Bridgestone CISO: Lessons From Ransomware Attack Include Acting, Not Thinking

PAPERS: DarkBERT: A Language Model for the Dark Side of the Internet

At first, I thought this was going to be another website cataloguing cloud service provider vulnerabilities, but it's not that at all. Rather, this is a project going after one of my personal passions - doing breach post mortems, but specifically on cloud-related incidents.

BREACHES: Welcome to Breaches.Cloud

You know the cost of sending cargo into space is coming down when a satellite is launched into orbit just for people to try to hack!

HACKATHON: First in space: SpaceX and NASA launch satellite that hackers will attempt to infiltrate during DEF CON

Some very interesting and frankly, unbelievable results here. The SEC doesn't define "expertise" and it seems boards are taking advantage of that.

SURVEYS: Are Company Boards Prepared to Deal With Cybersecurity? Our Survey Says…

Someone had a lot of fun naming the different communities in GitHub and I love it.

SQUIRREL: Map of GitHub

Enterprise Security Weekly

News, analysis, and insights into enterprise security. We put security vendors under the microscope, and explore the latest trends that can help defenders succeed. Hosted by Adrian Sanabria. Co hosts: Katie Teitler-Santullo, Darwin Salazar, Ayman Elsawah.

Cisco buys Armorblox for… GenAI? Silly Awards, RIP Metaverse, and new AI FOSS – ESW #320

Announcements

Hosts

Related

Final fundings for 2024, Blackberry sells Cylance cheap, Product Testing Drama – ESW #388

Third-Party Risk Management – BEC Compromises and the Cloud – Michael Swinarski – CSP #167

Prioritizing Identity and Getting the Fundamentals Right – Bezawit Sumner – CSP #151