Security Boulevard

As the political landscape heats up, so does the activity in the cyber threat domain. High-profile events such as inaugurations often become a prime opportunity for cybercriminals to launch malicious campaigns. With Trump’s upcoming inauguration on January 20th, our research sheds light on the digital threats tied to such politically charged events, focusing on previous […]

The post Trump’s Digital Footprint: Unveiling Malicious Campaigns Amid Political Milestones appeared first on VERITI.

The post Trump’s Digital Footprint: Unveiling Malicious Campaigns Amid Political Milestones appeared first on Security Boulevard.

The ticketing industry is under constant threat from malicious bots, with bad actors targeting these platforms for financial gain. Bots accounted for 31.1% of all traffic to entertainment platforms in 2024, with attacks ranging from scalping and credential stuffing to carding operations. When one public museum experienced a surge in fraudulent transactions, they turned to […]

The post How Imperva Protects the Arts Industry from Ticketing Abuse by Carding Bots appeared first on Blog.

The post How Imperva Protects the Arts Industry from Ticketing Abuse by Carding Bots appeared first on Security Boulevard.

image by Meta.AI lampooning humanless SOC

My former “colleagues” have written several serious pieces of research about why a SOC without humans will never happen (“Predict 2025: There Will Never Be an Autonomous SOC”, “The “Autonomous SOC” Is A Pipe Dream”, “Stop Trying To Take Humans Out Of Security Operations”). But I wanted to write a funny companion to this called “How to Talk to Idiots Who Believe in ‘Humanless SOC’.” Here it is, but it is definitely a rant and not technical guidance, mind you.

I think most of us will encounter people who believe that a Security Operations Center (SOC) fully staffed by machines and with no humans anywhere will actually happen. Now, I think those people are delusional, but it is interesting to try to study those delusions. Try to psychoanalyze them, perhaps. Maybe this points to some suppressed childhood trauma, I dunno…

Years ago, I had an old and wise mentor who explained everything weird in the (human) universe by a unique (for each occurrence) blend of two forces: corruption and stupidity. Perhaps this can be applied here? Some may believe this out of ignorance (see more on this below) while others choose to believe it because their VC funding depends on it…

Anyhow, let’s look at the extreme fringe of a fringe. You may meet people who think that artificial intelligence today is so advanced that human presence inside the SOC is not necessary. Today! They actually think AI can already replace all humans in a SOC! Some of them even have a demo ready, powered by … ahem … “a demo-ready AI” that works — you guessed it! — in a demo. Sadly, it will never deliver even a tiny fraction of the promised benefits once confronted with a real-world, messy environments full of outdated systems, API-less data stores, tribal knowledge, junior IT people, and sprinkled with human incompetence…

Similarly, some people have never seen how a large enterprise functions, so they make assumptions about automation possibilities that are just wildly off. They struggle to grasp the complexity of a “typical” (ha! as if!) enterprise “layered cake” environment, with its layers of technology ranging from 1970s mainframes to modern serverless and gen AI systems.

To elaborate on the lack of enterprise environment knowledge, what makes it even worse is common reliance on tribal knowledge of unique systems — knowledge that only exists in the minds of specific individuals. It’s very difficult, if not impossible, for any automated system (whether AI-powered or not) to make decisions based on context that simply isn’t present in computers…

In other cases, an utter lack of understanding of how modern (and especially not-so-modern) security operations centers, and detection and response teams operate comes up. Some snakeoil sellers of “humanless SOC’” rely on things like ”this needs a current asset list, we will just query CMDB or Attack Surface Manager.” Ah, a CMDB that was last updated in 2008, and an ASM that covers a third of the environment … suuure. They often promise (or, worse: ask the customer to!) to “fix these issues before deployment,” failing to acknowledge that some of these issues have persisted for decades. “Decades, Karl!” That’s like 10+ years! :-)

Yet another category of people believe in a humanless SOC based on their complete lack of understanding of threats. In fact, they shift their AI so far right (“AI SOC = better alert triage”), and neglect bad detection content altogether… And, yes, threat actors sometimes know the environment better than the defenders do. I’m optimistic that in the long term, with the wider adoption of cloud computing, the occasional attacker advantage will vanish. Defenders will collect more data on their environments and be able to keep it updated (well, I can hope, can I?) Today, however, it is just not the case.

Now, what about trying to match the quality of a bad SOC, like one run by a low-end MSSP vendor? As I alluded before, artificial intelligence today seems close to matching the quality of a bad SOC without any humans. To this, I add: If you lower the bar enough, you can match the quality of a bad SOC even without AI. Just connect your SIEM alerts to an alert distribution mechanism like email. Done! You have a really, really, really, really bad SOC, and without any humans. And without AI too!

So using this argument (“I can replicate a really bad SOC with AI”) is essentially cheating (more seriously, if one can replicate a “mediocre+” MDR but without any human “butts in seats”, this can be a decent business!)

Finally, there is one delusion that’s actually worthy of deeper analysis: the belief that AI will soon advance so rapidly and so massively that it will replace all humans in the SOC. Let’s not turn this into “are LLM a path to AGI?”; actual AI experts can debate this one. We will focus on the SOC.

Let’s start this discussion with good news. Several years ago (2021), I was a long-term optimist, but a short-term skeptic about AI in security. Now, I’m even more optimistic in the long term and cautiously optimistic in the short term. Despite my optimism, I don’t see a short-to-medium-term trajectory for AI that would lead to a humanless SOC. I do see a lot of AI use in the SOC, to be sure, but a SOC run by humans!

Notably, when we developed Autonomic Security Operations (ASO), we stressed that humans are central to modern security operations (as they are with our own D&R capabilities). We also mentioned the many tools used in such operations, including of course AI.

Where can you go from here? We can discuss what’s possible, and increased automation of your security operations center is definitely on that list. We can also explore the potential pathways that might eventually (EVENTUALLT!) lead to a humanless SOC. However, this is the world of tomorrow…

… and we are back to today!

Here are my Top Reasons Why a SOC Without Humans Will Not Happen:

1. Tribal Knowledge: Crucial knowledge for alert triage, investigation and detection authoring often exists only in someone’s head, not in any automated or even any digital system (you gen AI “agent” may read the pages of an analog notebook, to be sure, but a human is needed to shove said notebook in front of a robot’s all-seeing-eye…)
2. Adaptable Attackers: Creative attackers will continue to outsmart automated (including gen AI — powered) defenses, as they possess the ingenuity and adaptability that machines currently lack (this argument very much applies to short-to-medium term and I make no promises for long term, mind you, AGI FTW … but LATER!)
3. Security Data Quality: Many AI projects are limited by the quality of their data. Building an excellent “AI SOC” requires vast amounts of high-quality data, which is often unavailable, and this is doubly so for company-specific data (we can debate how attack-surface-agnostic you can make this in later blogs…)

These are just a few of the main reasons why a fully automated (humanless, fully autonomous, etc) SOC is not feasible in the near future. If you encounter someone who believes in this fallacy, remind them of the importance of tribal knowledge, expert intuition, attacker adaptability, and the limitations of current AI technology due to insufficient data quality. These challenges remain largely insurmountable, even with projected technological advancements.

Finally…

A critical challenge in writing this blog is my unwavering belief in the relentless pursuit of automation within a detection and response domain. Ideas like ASO (and its origins) have demonstrated that an engineering mentality and a drive to automate more activities are crucial for building a modern SOC. In fact, SRE’s job is to “automate yourself out of your job”, but here lies a paradox: humans are needed to automate humans out of a human job, yet this loop is endless…

Related posts:

• Baby ASO: A Minimal Viable Transformation for Your SOC
• Anton’s Alert Fatigue: The Study
• New Paper: “Future of SOC: Transform the ‘How’” (Paper 5)

A Brief Guide for Dealing with ‘Humanless SOC’ Idiots was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post A Brief Guide for Dealing with ‘Humanless SOC’ Idiots appeared first on Security Boulevard.

The post How Can Generative AI be Used in Cybersecurity appeared first on AI Security Automation.

The post How Can Generative AI be Used in Cybersecurity appeared first on Security Boulevard.

President Biden’s detailed executive order relating to cybersecurity is great to see.

Biden’s order reflects the importance of cybersecurity at the highest levels – it is an issue of national security and should be treated as such.

One of the … (more…)

The post GUEST ESSAY: President Biden’s cybersecurity executive order is an issue of national security first appeared on The Last Watchdog.

The post GUEST ESSAY: President Biden’s cybersecurity executive order is an issue of national security appeared first on Security Boulevard.

A business's data is one of its most valuable assets. Protecting this asset is paramount, especially in machine learning use cases. This post dives deeper into one well-known technique to protect sensitive data called redaction.

The post Top 5 risks of not redacting sensitive business information when machine learning appeared first on Security Boulevard.

Author/Presenter: Bill Graydon

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Bypass 101 appeared first on Security Boulevard.

Explore the revolutionary Grok AI system in this comprehensive guide. From its sophisticated architecture to real-world applications, discover how this advanced AI assistant integrates with the X platform while maintaining robust privacy and security measures.

The post The Comprehensive Guide to Understanding Grok AI: Architecture, Applications, and Implications appeared first on Security Boulevard.

The full compliance process for CMMC, the Cybersecurity Maturity Model Certification, culminates in an audit that validates an organization’s cybersecurity posture and its implementation of the security controls that apply to it. Throughout this process, there is a gatekeeper who performs your audit. You may have heard of them referred to as a CMMC Auditor […]

The post CMMC Auditor vs Assessor (CCA): How the Two Compare appeared first on Security Boulevard.

Gary Perkins, CISO at CISO Global Cybersecurity may seem complex, but it boils down to consistent implementation of best practices. Disabling unnecessary services, securing cloud configurations, enforcing MFA, training employees, and adopting a proactive security mindset are crucial steps to safeguarding your business. In 2025, prioritize these basics to significantly reduce your exposure to threats […]

The post Back to the Basics For 2025: Securing Your Business appeared first on CISO Global.

The post Back to the Basics For 2025: Securing Your Business appeared first on Security Boulevard.

President Biden in the last few days of his administration issued an expansive cybersecurity EO that touched on issues like software supply chain, AI, and foreign adversaries. Many approved of the effort, though there were concerns that the incoming administration will simply shelve it.

The post The Good, the Bad, and the Politics of Biden’s Cybersecurity Order appeared first on Security Boulevard.

Wow. Just Wow: Joseph Robinette Biden Jr. hits the emergency “do something” button.

The post This is HUGE: Biden’s Cybersecurity Exec. Order — Big Parting Gift to Trump appeared first on Security Boulevard.

Prepare for the March 2025 PCI DSS 4.0 compliance deadline! Secure payment data, block skimming attacks, and simplify compliance with DataDome Page Protect.

The post Why PCI Compliance is Critical for Payment Data Protection—and How DataDome Page Protect Can Help appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Uncanceled Units’ appeared first on Security Boulevard.

Cohesity has extended its Cyber Event Response Team (CERT) service to include third-party providers of incident response platforms, including Palo Alto Networks Unit 42, Arctic Wolf, Sophos, Fenix24 and Semperis.

The post Cohesity Extends Services Reach to Incident Response Platforms appeared first on Security Boulevard.

by Source Defense In 2024, Magecart attacks reached new levels of sophistication, targeting thousands of e-commerce websites worldwide. At Source Defense Research, we tracked dozens of campaigns leveraging advanced techniques, from exploiting Google Tag Manager to innovative uses of WebSockets and payment form forgeries. These attacks highlight the adaptability of attackers in the face of

The post Unveiling 2024’s Attack Trends: Insights from Source Defense Research appeared first on Source Defense.

The post Unveiling 2024’s Attack Trends: Insights from Source Defense Research appeared first on Security Boulevard.

AI in Cybersecurity: Leveraging Generative AI and AI Agents to Stay Ahead of Threats AI in Cybersecurity: Leveraging Generative AI and AI Agents to Stay Ahead of Threats Artificial Intelligence (AI) is revolutionizing the cybersecurity landscape, offering advanced tools to predict, detect, and respond to threats with unprecedented speed and accuracy. Among these advancements, Generative […]

The post AI in Cybersecurity: Leveraging Generative AI and AI Agents to Stay Ahead of Threats appeared first on Cyber security services provider, data privacy consultant | Secureflo.

The post AI in Cybersecurity: Leveraging Generative AI and AI Agents to Stay Ahead of Threats appeared first on Security Boulevard.

Authors/Presenters: Ege Feyzioglu & Andrew M

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – RFID 101 appeared first on Security Boulevard.

We created a new tool to help you install and manage BloodHound instances, BloodHound CLI!

GitHub - SpecterOps/bloodhound-cli

Written entirely in Go, this command-line tool can be cross-compiled to support Windows, macOS, and Linux, so you can use whichever operating system you like as your host system for BloodHound. You only need to have Docker installed.

BloodHound CLI dramatically simplifies installation and server management. You can use BloodHound CLI to pull logs and monitor your containers. Read on to learn more about a few of the specific commands.

$ ./bloodhound-cli
BloodHound CLI is a command line interface for managing BloodHound and
associated containers and services. Commands are grouped by their use.

Usage:
bloodhound-cli [command]

Available Commands:
completion Generate the autocompletion script for the specified shell
config Display or adjust the configuration
containers Manage BloodHound containers with subcommands
help Help about any command
install Builds containers and performs first-time setup of BloodHound
logs Fetch logs for BloodHound services
running Print a list of running BloodHound services
version Displays BloodHound CLI's version information

Flags:
-h, --help help for bloodhound-cli

Use "bloodhound-cli [command] --help" for more information about a command. Installing BloodHound

Recently, we talked with some of our community members to learn about their experiences with BloodHound Community Edition. One problem they reported was retrieving the initial password for the default admin user. Previously, installing BloodHound required pulling down the Docker YML file, running the Docker Compose commands, and monitoring the output to grab the initial password.

Now, you only need to run ./bloodhound-cli install and wait. BloodHound CLI will pull the Docker Compose file (if it doesn’t exist), randomly generate an initial password, and then display the initial credentials at the end of the installation.

$ ./bloodhound-cli install
[+] Checking the status of Docker and the Compose plugin...
[+] Starting BloodHound environment installation
[+] Downloading the production YAML file from https://raw.githubusercontent.com/SpecterOps/BloodHound_CLI/refs/heads/main/docker-compose.yml
[+] Downloading the development YAML file from https://raw.githubusercontent.com/SpecterOps/BloodHound_CLI/refs/heads/main/docker-compose.dev.yml
graph-db Pulling
app-db Pulling
bloodhound Pulling
graph-db Pulled
app-db Pulled
bloodhound Pulled
Container bloodhound_cli-graph-db-1 Running
Container bloodhound_cli-app-db-1 Running
Container bloodhound_cli-bloodhound-1 Running
Container bloodhound_cli-app-db-1 Waiting
Container bloodhound_cli-graph-db-1 Waiting
Container bloodhound_cli-app-db-1 Healthy
Container bloodhound_cli-graph-db-1 Healthy
[+] BloodHound is ready to go!
[+] You can log in as `admin` with this password: JqNmrSuFWb5k8qj5EVL0f2OtUppzmZ4Y
[+] You can get your admin password by running: bloodhound-cli config get default_password
[+] You can access the BloodHound UI at: http://127.0.0.1:8080/ui/login

You can customize your installation by setting your initial password or adjusting the default username.

Customizing BloodHound

The config command is here to help you manage your server settings. As mentioned above, you can use it to set the initial username and password manually or set any other value you need in the bloodhound.config.json file. You can also use the config and config get commands to retrieve all config or individual values.

Wrap Up

Whether you’re starting fresh with BHCE or a veteran user, BloodHound CLI makes everything simpler. The tool can manage your configuration, monitor running containers, and pull logs. We will continue developing this new tool to simplify server updates and other maintenance tasks.

You can grab the first release, v0.1.0, here:

Release BloodHound CLI v0.1.0 · SpecterOps/bloodhound-cli

Introducing BloodHound CLI was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Introducing BloodHound CLI appeared first on Security Boulevard.

Advanced persistent threats (APTs) use sophisticated tools and techniques to breach systems and maintain access—all while remaining undetected. Unlike other cyberattacks, APTs work over an extended period, using more resources to achieve specific objectives, such as stealing sensitive data or bringing down operations.

The post Advanced Persistent Threat (APT): Examples and Prevention appeared first on Security Boulevard.