The National Security Agency (NSA), in partnership with the Cybersecurity and Infrastructure Security Agency (CISA), have highlighted the ten most common cybersecurity misconfigurations in large organizations. In their join cybersecurity advisory (CSA), they also detail the tactics, techniques, and procedures (TTPs) actors use to exploit these misconfigurations. From the report: Through NSA and CISA Red and Blue team assessments, as well as through the activities of NSA and CISA Hunt and Incident Response teams, the agencies identified the following 10 most common network misconfigurations:
1. Default configurations of software and applications
2. Improper separation of user/administrator privilege
3. Insufficient internal network monitoring
4. Lack of network segmentation
5. Poor patch management
6. Bypass of system access controls
7. Weak or misconfigured multifactor authentication (MFA) methods
8. Insufficient access control lists (ACLs) on network shares and services
9. Poor credential hygiene
10. Unrestricted code execution

NSA and CISA encourage network defenders to implement the recommendations found within the Mitigations section of this advisory — including the following — to reduce the risk of malicious actors exploiting the identified misconfigurations: Remove default credentials and harden configurations; Disable unused services and implement access controls; Update regularly and automate patching, prioritizing patching of known exploited vulnerabilities; and Reduce, restrict, audit, and monitor administrative accounts and privileges.

NSA and CISA urge software manufacturers to take ownership of improving security outcomes of their customers by embracing secure-by-design and-default tactics, including: Embedding security controls into product architecture from the start of development and throughout the entire software development lifecycle (SDLC); Eliminating default passwords; Providing high-quality audit logs to customers at no extra charge; and Mandating MFA, ideally phishing-resistant, for privileged users and making MFA a default rather than opt-in feature. A PDF version of the report can be downloaded here (PDF).

Read more of this story at Slashdot.

Source: Slashdot – NSA Shares Top Ten Cybersecurity Misconfigurations

An anonymous reader quotes a report from Ars Technica: Getty Images CEO Craig Peters told the Verge that he has found a solution to one of AI’s biggest copyright problems: creators suing because AI models were trained on their original works without consent or compensation. To prove it’s possible for AI makers to respect artists’ copyrights, Getty built an AI tool using only licensed data that’s designed to reward creators more and more as the tool becomes more popular over time. “I think a world that doesn’t reward investment in intellectual property is a pretty sad world,” Peters told The Verge. The conversation happened at Vox Media’s Code Conference 2023, with Peters explaining why Getty Images — which manages “the world’s largest privately held visual archive” — has a unique perspective on this divisive issue.

In February, Getty Images sued Stability AI over copyright concerns regarding the AI company’s image generator, Stable Diffusion. Getty alleged that Stable Diffusion was trained on 12 million Getty images and even imitated Getty’s watermark — controversially seeming to add a layer of Getty’s authenticity to fake AI images. Now, Getty has rolled out its own AI image generator that has been trained in ways that are unlike most of the popular image generators out there. Peters told The Verge that because of Getty’s ongoing mission to capture the world’s most iconic images, “Generative AI by Getty Images” was intentionally designed to avoid major copyright concerns swirling around AI images — and compensate Getty creators fairly.

Rather than crawling the web for data to feed its AI model, Getty’s tool is trained exclusively on images that Getty owns the rights to, Peters said. The tool was created out of rising demand from Getty Images customers who want access to AI generators that don’t carry copyright risks. […] With that as the goal, Peters told Code Conference attendees that the tool is “entirely commercially safe” and “cannot produce third-party intellectual property” or deepfakes because the AI model would have no references from which to produce such risky content. Getty’s AI tool “doesn’t know what the Pope is,” Peters told The Verge. “It doesn’t know what [Balenciaga] is, and it can’t produce a merging of the two.” Peters also said that if there are any lawsuits over AI images generated by Getty, then Getty will cover any legal costs for customers. “We actually put our indemnification around that so that if there are any issues, which we’re confident there won’t be, we’ll stand behind that,” Peters said. When asked how Getty creators will be paid for AI training data, Peters said that there currently isn’t a tool for Getty to assess which artist deserves credit every time an AI image is generated. “Instead, Getty will rely on a fixed model that Peters said determines ‘what proportion of the training set does your content represent? And then, how has that content performed in our licensing world over time? It’s kind of a proxy for quality and quantity. So, it’s kind of a blend of the two,'” reports Ars.

“Importantly, Peters suggested that Getty isn’t married to using this rewards system and would adapt its methods for rewarding creators by continually monitoring how customers are using the AI tool.”

Read more of this story at Slashdot.

Source: Slashdot – Getty Images Built a ‘Socially Responsible’ AI Tool That Rewards Artists

Atari just announced preorders for a physical cartridge for the company’s once-ubiquitous 2600 console. From a report: A gaming console that counts 1982 as its most successful year is releasing another new cartridge in the year 2023. The game-in-question is called Save Mary and was actually developed during the console’s golden years, before being shelved when the 2600 went the way of the dodo. Save Mary was in development for two whole years, which is a lifetime in the generation of gaming that preceded the NES. The normal timeframe to produce a game back then was six to nine months, with some notorious titles taking just five or six weeks. Save Mary was originally developed by veteran Atari staffer Tod Frye, the guy behind the 2600 version of Pac-Man and the Swordquest series.

Read more of this story at Slashdot.

Source: Slashdot – Atari Releasing New Cartridge For Its 46-Year-Old 2600 Console