EU Data Initiatives: Developments to Watch in 2024 and Beyond

The European Union (EU) has been at the forefront of global efforts to protect privacy and personal data. Over the years, the EU has implemented several initiatives and regulations that aim to safeguard the privacy rights of its citizens. The International Association of Privacy Professionals (IAPP) has created a timeline of key dates for these EU regulations and initiatives, including those that are yet to be finalized.

Photo by freestocks.org on Pexels.com

Here are the key dates to watch out for the year 2024 and beyond:

  • February 17, 2024: The Digital Services Act (DSA), which aims to establish clear rules for online platforms and strengthen online consumer protection, will become applicable
  • Spring 2024: The AI Act is expected to be adopted
  • Mid-2024: The Data Act is expected to enter into force
  • October 18, 2024: The NIS2 directive will become applicable
  • January 17, 2025: The DORA regulation will become applicable

In conclusion, the EU’s data initiatives are set to undergo significant changes in the coming years with the implementation of regulations like the DSA, AI Act, Data Act, NIS2 directive, and DORA regulation. These initiatives aim to establish clear rules for online platforms, strengthen online consumer protection, facilitate data sharing, and more. It is crucial for organizations, including individuals, to stay up-to-date with these key dates to ensure compliance with the new regulations and to take advantage of the opportunities they present.

For a more detailed overview of the EU’s data initiatives and their key dates, check out the infographic created by the IAPP here.

Understanding Cyber Warfare Through Frameworks

Photo by Joseph Fuller on Pexels.com

Cyber warfare is a rapidly evolving field, and various frameworks have been developed to better understand and defend against cyber attacks. Several cyber kill chains have been developed to explain what an attacker might do. The most commonly used at present are the Lockheed Martin Cyber Kill Chain and the MITRE ATT&CK framework.

The Lockheed Martin Cyber Kill Chain is a seven-stage framework that describes the steps an attacker might take in a cyber attack. It includes stages for reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. 

The MITRE ATT&CK framework is a comprehensive database of tactics, techniques, and procedures used by attackers that is organized into several categories such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, and exfiltration.

The Unified Kill Chain is a framework that combines elements from the Lockheed Martin Cyber Kill Chain, the MITRE ATT&CK framework, and other frameworks to provide a more comprehensive view of cyber attacks.  It includes eighteen attack phases, which are the steps a cyberattack may progress through.

Overall, cyber warfare is highly complex and requires extensive knowledge and understanding of the different frameworks and best practices for defending against attacks. By familiarizing ourselves with these frameworks, we can better prepare ourselves for the challenges ahead and ensure our networks remain secure.

Advantages and Concerns of Using Machine Learning in Security Systems

Photo by Pixabay on Pexels.com

Machine learning (ML) has revolutionized the security market in recent years, providing organizations with advanced solutions for detecting and preventing security threats. ML algorithms are able to analyze large amounts of data and identify patterns and trends that may not be immediately apparent to human analysts. This has led to the development of numerous ML-based security systems, such as intrusion detection systems, malware detection systems, and facial recognition systems.

ML-based security systems have several advantages over traditional security systems. One of the main advantages is their ability to adapt and learn from new data, making them more effective over time. Traditional security systems rely on predetermined rules and protocols to detect threats, which can become outdated and ineffective as new threats emerge. In contrast, ML-based systems are able to continuously learn and improve their performance as they process more data. This makes them more effective at detecting and responding to new and evolving threats.

Another advantage of ML-based security systems is their ability to process large amounts of data in real time. This enables them to identify threats more quickly and accurately than human analysts, who may not have the time or resources to manually review all of the data. This makes ML-based systems more efficient and effective at detecting security threats.

Despite the numerous benefits of ML-based security systems, there are also some concerns that need to be addressed. One concern is the potential for bias in the data used to train ML algorithms. If the data used to train the algorithm is biased, the algorithm itself may be biased and produce inaccurate results. This can have serious consequences in the security context, as biased algorithms may overlook or wrongly flag certain threats. To mitigate this risk, it is important to ensure that the data used to train ML algorithms is representative and diverse and to regularly monitor and test the performance of the algorithms to identify and address any biases.

Another concern with ML-based security systems is that they are only as good as the data they are trained on. If the training data is incomplete or outdated, the system may not be able to accurately identify threats. This highlights the importance of maintaining high-quality and up-to-date training data for ML-based security systems.

Despite these concerns, the use of ML in security systems is likely to continue to grow in the coming years. As more organizations adopt ML-based security systems, it will be important to ensure that these systems are trained on high-quality data and are continuously monitored to ensure that they are performing accurately. This will require ongoing investment in data management and monitoring infrastructure, as well as the development of best practices for training and maintaining ML-based security systems.

Recently, I published an article on this topic. Take a look at it here: https://www.scitepress.org/Link.aspx?doi=10.5220/0011560100003318

Please get in touch with me if you want to discuss themes related to cyber security, information privacy, and trustworthiness, or if you want to collaborate on research or joint projects in these areas.

Exploring the Interdependencies between AI and Cybersecurity

Photo by Pixabay on Pexels.com

With the increasing prevalence of AI technology in our lives, it is important to understand the relationship between AI and cybersecurity. This relationship is complex, with a range of interdependencies between AI and cybersecurity. From the cybersecurity of AI systems to the use of AI in bolstering cyber defenses, and even the malicious use of AI, there are a number of different dimensions to explore.

  • Protecting AI Systems from Cyber Threats: As AI is increasingly used in a variety of applications, the security of the AI technology and its systems is paramount. This includes the implementation of measures such as data encryption, authentication protocols, and access control to ensure the safety and integrity of AI systems.
  • Using AI to Support Cybersecurity: AI-based technologies are being used to detect cyber threats and anomalies that may not be detected by traditional security tools. AI-powered security tools are being developed to analyze data and detect malicious activities, such as malware and phishing attacks.
  • AI-Facilitated Cybercrime: AI-powered tools can be used in malicious ways, from deepfakes used to spread misinformation to botnets used to launch DDoS attacks. The potential for malicious use of AI is a major concern for cybersecurity professionals.

In conclusion, AI and cybersecurity have a multi-dimensional relationship with a number of interdependencies. AI is being used to bolster cybersecurity, while at the same time it is being used for malicious activities. Cybersecurity professionals must be aware of the potential for malicious use of AI and ensure that the security of AI systems is maintained.

Explore the Future of Smart Home Technology with Amazon’s Dream Home

Photo by Jessica Lewis Creative on Pexels.com

From Amazon’s Echo to its Ring doorbell, the tech giant has made its way into many of our homes. But do you know what Amazon is learning about you and your family? From its smart gadgets, services, and data collection, Amazon has the potential to build a detailed profile of its users.

The data collected by Amazon can help power an “ambient intelligence” to make our home smarter, but it can also be a surveillance nightmare. Amazon may not “sell” our data to third parties, but it can use it to gain insights into our buying habits and more.

We must all decide how much of our lives we’re comfortable with Big Tech tracking us. Read the story authored by Geoffrey A. Fowler here to explore ways in which Amazon and potentially other Big Tech companies are watching us.

If you want to learn more about cyber security and smart homes, don’t hesitate to get in touch with me! I’m always happy to answer any questions and always look for collaboration opportunities.

I Had a Great Time at the WEBIST 2022 Conference

I had a wonderful time at the WEBIST 2022 conference in Malta, where I presented my research article titled “A Data-Centric Anomaly-Based Detection System for Interactive Machine Learning Setups“.

My presentation was on Thursday, October 27th, and it went really well. My audience was engaged throughout, and they asked some great questions at the end. I think they appreciated hearing about my approach to anomaly detection in interactive machine learning setups that include regular people interacting with IoT sensors for online learning purposes—which is an area that has not received much attention so far. With the help of supervised machine learning techniques, data poisoning attacks and potentially zero-day attacks can be detected with high-accuracy without requiring any hard-coded rules.

I was also honored to be selected as session chair for the Internet Technology track. The conference ran smoothly thanks to everyone’s efforts, and I am very thankful to have been chosen as chair.

I would like to thank all the organizers for a very well-organized event and the other participants for making it such a productive one.

I am looking forward to attending future WEBIST conferences and continuing to build my network.

A Great Resource to Help you Learn about Cybersecurity

I find the collection of resources from GoVanguard to be quite helpful for anyone interested in a career in cyber security, whether it be in academia or industry.

Specifically, the GoVanguard InfoSec Encyclopedia is an excellent resource for beginners and experienced professionals alike. It contains a wealth of information on various aspects of information security and is constantly being updated with new and improved content. If you are looking to get into the field of information security, or simply want to learn more about it, the GoVanguard InfoSec Encyclopedia may be a great place to start.

Here is a look at their resource list:

This repository also covers “OSINT Tools Used” and “Exploitation Enumeration and Data Recovery Tools” in addition to the aforementioned resources.

Cybersecurity and the IoT: A Guest Lecture at Lund University

Today, I was invited to give a two-hour guest lecture about cybersecurity and the IoT to Lund University students. I introduced students to some state-of-the-art attacks that target IoT devices, networks, and services.

Everything can be a target when connected to the Internet, from a benign-looking device like a smart light bulb to a sophisticated system such as an electric car. Most of these things (which are often called smart objects) tend to be connected to public clouds, making them prone to remote attacks, ranging from misconfiguration to hijacking of accounts to malicious insiders, and more.

I also highlighted that it appears to be a growing trend that fewer vulnerabilities are being reported by various nations than before, specifically fewer vulnerabilities being reported by China. This could suggest that certain nations are covertly stockpiling vulnerabilities in order to strategically exploit them, perhaps for espionage purposes, but also for more nefarious purposes.

Anyway, in case you want to learn more about cyber security and the IoT, you are welcome to get in touch.

Popular smart home brands may be allowing the police to conduct warrantless home surveillance

The security cameras in our smart homes from well-known smart home brands like Amazon and Google might not just be watching over our pets. According to an article in The Verge, they can also aid law enforcement in their investigations of crimes, but only if we do not mind the police viewing our footage without a warrant.

That implies that the police can access our private information without first presenting proof that an emergency situation exists. Police will probably only make use of this access for lawful objectives, such as preventing crime or attempting to locate a missing person in need of assistance. However, it does raise some issues regarding what may transpire when this technology becomes even more widely used and available.

What if, for instance, this access is utilized to locate and detain activists or protestors who have not breached any laws? Citizens may only exercise caution when shopping, be aware that their smart device may record personal information, and, if possible, enable end-to-end encryption.

If you have any questions about how to secure your smart home, do not hesitate to contact me.

IoT Cybersecurity: Two New Documents Published by NIST

As an IoT practitioner or device manufacturer, it is important to keep up with the latest developments in IoT cybersecurity. The National Institute of Standards and Technology (NIST) has recently released two draft documents for public comment that are relevant to the IoT.

The first is a discussion essay titled “Ideas for the Future of IoT Cybersecurity at NIST: IoT Risk Identification Complexity“. This discussion paper lays the groundwork for forward-looking talks on detecting and addressing risks for IoT devices by drawing on NIST’s earlier work in cybersecurity for the IoT (for example, NISTIR 8259).

The second is a draft NIST Internal Report (‘NISTIR’) 8425 titled “Profile of the IoT Core Baseline for Consumer IoT Products“. NISTIR 8425 recalls the consumer IoT cybersecurity criteria from NIST’s white paper on “Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products,” and incorporates them into the family of NIST’s IoT cybersecurity recommendations. 

I recommend you keep tabs on these documents, particularly NISTIR 8425.