Recorded Future Posts Assessment on Geopolitical and Supply Chain Risks From the Huawei Monoculture

Bob Gourley June 10, 2019

I’ve been reading cyber threat intelligence assessments since the beginnings of the digital age. Not sure if I’ve seen a million of them but it sure seems like I have. I feel like the one I just read by Priscilla Moriuchi at Recorded Future is one of the best and I would like to endorse it to you for your review.

You really need to read the full report so I will not really summarize it here. But I will provide a couple of anecdotes on why it is so important.

The subject is Huawei. More specifically, the report deals with the supply chain risks posed to nations, companies and individuals who use Huawei products and services. Huawei is widely known in the tech community for years of aggressive unfair competition in pursuit of networking contracts around the globe. They moved from networking equipment into many other fields including production of smartphones and other mobile devices. They are a major builder of next-generation cellular networks (5G).

Many national security professionals or technologists point out the security issues with Huawei. The fact that they are influenced by a country where the rule of law is subservient to the Chinese Communist Party (CCP) means they should be treated with suspicion. Globally, governments have hinted that there are many other risks and there have been public releases of some of their rationale there, but given that citizens of open societies don’t always trust their own governments the information being released by governments is not always treated as valid.

One highly respected enterprise technologist recently asked me: “Are you really afraid of Huawei?” I replied: “I am not afraid but the fact is they are under the influence of a Communist party that does not have our interests in mind.” I can’t say I was able to change the mind of my friend, but might have, if I had been armed with the insights provided by Recorded Future.

During a recent visit to Japan I was placed in the uncomfortable position of having to tell many senior executives about the risks they are taking by working with many CCP controlled firms, including Huawei. Agreements with telecom companies and vendors are giving Huawei smart phones premium placement in most consumer facing stores, for example. The risks Japan is taking will be hard to mitigate and the relationships being established will be hard to reverse. But, if they are informed by facts they can make better decisions. This is another reason I was glad to see this report.

With that said, I would recommend you take time to read the entire report. I’ve decided to read it enough times to commit it to memory. Find it at:

https://www.recordedfuture.com/huawei-technology-risks/

We track Recorded Future in the CTOvision Guide to Technology as a Cybersecurity Firm with a focus on Cyber Threat Intelligence

Definitive Guide to Threat Intelligence

Bob Gourley October 11, 2018

It is a fact of modern life, every organization that uses technology is under attack from cyber criminals. This new fact of life has given rise to the need for actionable cyber threat intelligence. Cyber threat intelligence helps organizations of all sizes optimize defenses and protect what is most important.

If you are establishing a cyber threat intelligence program for your organization, or if you already have a cyber threat intelligence program and are wondering if you are leveraging best practices, there is a new reference I would like to bring to your attention.

Recorded Future has just released a new handbook that I consider the definitive guide to operational cyber threat intelligence. The book, titled “The Threat Intelligence Handbook A Practical Guide for Security Teams to Unlocking the Power of Intelligence” provides insights and lessons learned from real work cyber intelligence practitioners in a way that can help accelerate the standup of your threat intelligence team or optimize the activities of your existing SOC. The lessons learned and best practices captured here can help your organization prioritize defenses, improve vulnerability management, and fight fraud. While the book can help raise your defenses we all know that adversaries will continue to seek ways to surprise us and one of the most powerful contributions the book will make is to incident response teams. For those organizations that are of the size and scale to use internal “hunt teams” as part of your defenses the book will help you put in place methods to keep those hunt teams up to date on the latest adversary tools and methodologies.

Overall the book will help organizations efficiently focus on mitigating relevant risks. It has my strongest possible endorsement.

The PDF copy of the book is free to download. To read it visit: https://go.recordedfuture.com/book

Technologies To See At DoDIIS

Bob Gourley July 30, 2018

The DoDIIS Conference is almost upon us. August 12-15, 2018, members of the defense intelligence community will gather in Omaha for several days to listen to the latest in mission needs and requirements from key government leaders and to witness demonstrations of cutting edge IT on a very well attended expo floor.

If you have not registered to attend yet do so now here: 2018 DoDIIS Worldwide Conference

One of the challenges we have mentioned before is the overwhelming amount of innovation that will be on the expo floor. We recommend everyone put thought into who to spend time with before the event. We recommend reviewing the full list of exhibitors to get a gist of who is going to be there, then refine your intent on who to spend time with by considering your requirements and how these firms might potentially address them. It is also important to build in time for serendipity of course, but a bit of planning in advance can make this a much more productive conference.

As another input to your planning we reviewed every company with an eye towards potential positive/disruptive innovation in national security missions. idea of where you should spend your time. The list of who you see should be shaped by your own requirements of course, but we have a list below that may help. The list below are the tech firms we want to bring your attention to. In my view they are coming with innovations that could be very positive for the many important missions of defense intelligence.

The CTOvision List Of Must See Tech At DoDIIS

Alteryx: We like Alteryx for their focus on ease of use for business intelligence use cases, especially around self-service data analytics.
Amazon Web Services: We all know them but with their continuous innovation it is important to track the latest. Ask them about Kinesis for data and video.
Appian: They enable any company to be a software company. Would love to see more of this in government agencies.
Atlassian: Every developer seems to love them, largely because they remove friction in fielding real capabilities. Great collaboration for techies.
Attivo Networks: Advanced deception technology.
Anomali: Threat intelligence identifying threats to networks.
Basis Technology: Continues to innovate around language.
Blue Prism: Pioneers in robotic process automation and digititizing
Bricata: Innovative next generation intrusion prevention, detection, response
Carahsoft: Removing friction for government decision-makers. See at DoDIIS for access to 100’s of great technologies
Cloudera: The absolute leader in fielding enterprise data solutions that scale and operate at speed. Modern platform for machine learning and analytics optimized for the cloud.
Data Robot: Automating tasks for data scientists. Great capability.
Fidelis Cybersecurity: Providing a new platform to detect, investigate and stop advanced cyber attacks.
Palantir: Transforming the way organizations use data.
Percipient.ai: Artificial Intelligence for national security missions.
PFP Cybersecurity: If you want to make it hard on nation states trying to hack you, use these guys.
Recorded Future: Fast insights into cyber threats put in context of your enterprise needs.
VMware: Accelerating digital transformation for the enterprise.

By the way, we track these and many other hot technology firms in the CTOvision Disruptive Technology Finder . Use that to kickstart your market research.

Also see:

Iran’s Hacker Hierarchy Exposed: The Islamic Republic of Iran Makes Maximum Use of Contractors and Universities to Conduct Cyber Operations

Bob Gourley May 12, 2018

On 9 May Levi Gundert, Sanil Chohan, and Greg Lesnewich of Recorded Future provided a detailed assessment on the nature of the cyber threat from Iran titled: Iran’s Hacker Hierarchy Exposed. This report was widely cited in the press and immediately raised the bar for quality in strategic cyber threat intelligence (I saw several other reports from other sources but none held a candle to this one).

You should review the report so you can judge the quality yourself, but here are a few reasons I liked it:

It was not based on a single source (I hate it when analysts try to assess something based only on what is seen in forensic data). This report was based on multiple relevant sources that went far beyond just technical data. Sources also included interviews with trusted people with unique access.
The report provided historical context. History does not always predict the future, but it is important context. Previous research by other firms in the ecosystem, as well as the FBI, is also cited.
It is informed by cultural dynamics best provided by experienced analysts who know their material.
The report provides actionable warnings with justification for the warnings.

Some of the key insights:

There have been times when Iran has abandoned caution. We may be in a similar situation now.
In the past this has resulted in problems controlling the scope and scale of destructive attacks.
There are over 50 estimated contractors vying for Iranian government offensive cyber projects.
Targets in the U.S. may include a wide range of organizations, including banks, financial services, government departments, critical infrastructure providers and oil and energy.

That is just a brief summary. I most strongly encourage you to read the entire report at: Iran’s Hacker Hierarchy Exposed.

Now, what do you do about this threat?

You need to understand that no one is coming to save you. You need to take steps to raise your defenses now, at work and at home. There are things you can do to make it much harder for adversaries to have their way with you. Every company is different, but we have a list of best practices in cybersecurity that we most strongly recommend you review. There is almost certainly some low cost configuration changes you can put in place right now to improve your defenses.

For more on these topics see the CTOvision Guide to National Security Technology and

Truly Useful Artificial Intelligence Tools You Can Use Today

Bob Gourley December 28, 2015

Are you looking for useful artificial intelligence tools? We know you, dear readers, have been tracking the megatrend of artificial intelligence. There are many issues in this trend that should inform your day-to-day decision-making (we examine AI issues as part of our CAMBRIC construct to help put the trend in the context of other major thrusts in the tech world).

Most AI solutions today are fielded by the big players in IT. For example, Apple’s Siri or the capabilities they embedded directly in iOS9, or Google’s many savvy search solutions or Amazon’s very smart recommendations. Amazon’s Echo is also, like Siri, connecting to a very smart cloud capability that takes advantage of AI. AI capabilities are also being programmed into robotic solutions including self driving cars. IBM is also investing heavily in AI, with Watson the most famous result.

We expect to see a new wave of AI solutions that deliver value from smaller start-up companies as well. This is a very crowded space, with plenty of VC funding for entrepreneurs with capabilities in a wide-range of AI disciplines. Most of these firms seem to be on one of two paths: Success, which will mean being acquired by Facebook, Apple, Microsoft or IBM, or failure, which will see them acquired by the same firms for a lower price for their talent. Either way the innovation continues.

We are also on the lookout for hot firms that are not providing capabilities as part of other offerings or don’t seem to be on a path to be acquired by one of the big guys. This part of the market is very likely going to take off, since open source platforms and open cloud API’s and services like Prediction.io are making it so easy for others to create and field AI.

Here is a short list of capabilities we recommend all enterprise technologists track. The list is by no means comprehensive, but is definitely representative of what is available now:

Artificial Intelligence On Your Phone:

Siri: Part of Apple’s iOS, watchOS and tvOS. Intelligent personal assistant.
Cortana: Microsoft’s intelligent personal assistant. Designed for Windows mobile but now on Android and a limited version runs on Apple iOS. Also works on desktops and Xbox One.
Google Now: Available within Google Search mobile app for Android and iOS as well as the Google Chrome web browser on other devices. Delegates requests to web services powered by Google.

Artificial Intelligence From The Cloud:

Really most all of the AI on your phone and desktops is communicating with cloud services, so keep in mind most solutions are a blend that highly leverage cloud capabilities. But we needed a place to talk about Echo and Watson and soon many others, so:

Watson: A technology platform that uses natural language processing and machine learning to reveal insights from large amounts of data.
Echo: The device you buy is mostly a speaker and microphone with some commodity IT to connect it to the cloud. The real smarts come from Amazon Web Services.

For Personal and Business Use:

x.ai: Let AI coordinate schedules for you. Your own personal scheduler.
CrystalKnows: Using AI to help you know the best way to communicate with others.
RecordedFuture: Leverages natural language processing at massive scale in real time to collect and understand over 700,000 web sources to seek understanding.
Tamr: Unique approaches to Big Data leveraging machine learning.
LegalRobot: Automating legal document review in ways that can serve people and businesses.
Intraspexion: Uses Deep Learning as the core of an early warning system to investigate and prevent potential litigation.
EverLaw: The power of mobile, machine learning and cloud computing delivered as a SaaS.

Artificial Intelligence For Developers:

Vicarious: Building the next generation of AI algorithms.
Soar is a general cognitive architecture for developing systems that exhibit intelligent behavior.
Prediction.io is a service with easy to use, open templates for a variety of advanced AI workloads.
Jade: Java Agent Development Framework. Simplifies multi-agent system development.
Protege: A free, open-source ontology editor and framework for building intelligent systems.
h2o.ai: Build smarter machine learning/AI applications that are fast and scalable.
Seldon: An open, enterprise-grade machine learning platform that adds intelligence to organizations.
SigOpt: Run experiments and make better products with less trial and error.
Scaled Inference: Cloud based models and an inference engine to help in model selection.
OpenCV: Open source computer vision, a library of programming functions aimed mainly at computer vision.

Artificial Intelligence For Healthcare:

Enlitic: Deep learning for healthcare and data driven medicine.
Metamind.io: Automatic image recognition with many use cases, including medicine.
Zebra Medical Vision: Closing the gaps between research and result for patients with data and AI.
Deep Genomics: Machine learning and AI transforming precision medicine, genetic testing, diagnostics and therapies.
Atomwise: Using AI and analytics to predict medicines and discover drugs.
Flatiron.com: AI and Machine Learning delivering insights on treatments.

Artificial Intelligence For Robotics:

Mttr.net: Building flying vehicles powered by intelligent software.
Skycatch: Software for fully autonomous aerial systems.
IdentifiedTech: Industrial mapping drone automation.

Artificial Intelligence For Space:

SpaceKnow: Using AI to track global economic trends from Space.
OrbitalInsight: Space trends for understanding global issues.

Artificial Intelligence For Marketing and Customer Interaction:

DigitalGenius: Computer driven conversation with customers in ways that scale and serve.
Conversica: AI to help you find your next customer, including automated email conversations to qualify leads.

We know this is not a complete list. Please let us know who you think we should include. Contact us here.

For more see:

What should I know about blockchain?

What artificial intelligence tools are really useful

How can I have a career in data science?

How can I select a Cloud Access Security Broker (CASB)?

How can I stop ransomware?

How can our military use advanced technology smartly?

How can we improve cybersecurity?

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies – A fast overview of Artificial Intelligence companies we believe are poised to cause the most positive disruption in the enterprise.

Big Data Companies – Reference to the greatest, most disruptive Big Data companies in the tech ecosystem.

Business Intelligence Companies – We assess these to be the Business Intelligence Companies most impactful for delivering real decision advantage.

Cybersecurity Companies – We apply our deep expertise in cybersecurity to assessing the best across multiple categories including:

Cloud Computing Companies – We include both platform and software as a service providers, capturing only the most innovative and disruptive.

Collaborative Tool Companies – These are the firms that help humans connect to humans to create, manage and lead.

Infrastructure Companies – Critical enterprise foundations for business agility.

IoT Companies – Internet of Things and Industrial Internet of Things are here. How do you manage them?

Mobile Companies – Help manage, configure, secure and optimize these very powerful capabilities.

Robotics Companies – Including innovations in Robotic Process Automation, Drones, and industrial robotics.

Services Companies – We only track a few, the ones we really know well.

Tech Titans – These are the big players. We track the tech titans closely since their capabilities change continuously.

VC, PE and Finance Companies – Keeping an eye on the investors can give indications of coming developments.

You can also use our topical pages to get up to speed quickly on the current status of the major megatrends. See our pages on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, Cybersecurity and Blockchain and Cryptocurrencies.

We also provide special pages focused on high interest topics, including Science Fiction, Entertainment, Cyber War, Tech Careers, Training and Education and Tech Tips.

Recorded Future Provides Awareness Into Issue of Government Credentials On The Open Web

Bob Gourley July 7, 2015

RF-desktop Recorded Future provides real time threat intelligence to cyber defenders as well as business executives seeking insights to inform decisions. They leverage a patented Web Intelligence Engine over with billions of indexed facts (and more added daily) to analyze the open web to provide insights.

One category of the many sites they ingest is paste sites. These sites are web applications designed to allow users to store and share plain text. They are regularly used to hold and share small working documents by programmers/developers/systems administrators as well as academics and students. In practice, paste sites are also used as a dumping ground for stolen credentials. By applying algorithms over paste sites as well as over 650,000 other sources on the web, Recorded Future can provide enterprises with early warning that credentials have been compromised.

In a report titled “Government Credentials on the Open Web” Recorded Future provides insights and analysis showing 47 US government agencies across 89 unique domains have credentials leaked and made available to potential adversaries. Analysis and additional reporting by the government indicates that many of these agencies do not require multi-factor authentication, meaning lost credentials are a particularly risky threat in those cases.

We downloaded and reviewed the report and then sought to replicate the analysis and learn more by direct use of the Recorded Future application.

We began our evaluation by doing very simple queries of all paste type sites based on government email domains (for example, opm.gov). Starting with simple searches was a great way to generate foundational context. Immediately the visualizations of Recorded Future provided not just results on opm.gov domains but context around related data in the records. For example, a dump to paste sites from Dec 2013 which held opm.gov credentials also held credentials for 8 additional federal entities plus many of their key contractors and Recorded Future summarized the significance of that visually. It also provides a link to the data that was in the paste.

When miscreants steal or break passwords and paste them online it is an immediate threat and with this tool we can see it happening in very plain ways. We can also see the horrid state of user passwords. Here are a few that stood out: monkey, Marlene, brianna, turtles, dallaskid, redskins, buffy123, turkey. These are all horrible passwords!

I also conducted analysis around other domains, including organizations where I have worked in the past and those of many friends and associates. In almost every case there was information that would be of some use to adversaries who might use the information in phishing attacks and in some cases there was clear indication that passwords had been compromised.

Any organization that has leaked credentials is at increased risk, so using this method is a great way to inform defenders of the nature of threats and to take action to mitigate threats.

This same method can be used to look for indications of other types of leaked information, including supplier lists, contract data, customer lists, intellectual property, business strategies and other information meant to be protected. Which leads to the bottom line conclusion: Organizations should use the automation of Recorded Future to enhance situational awareness and drive continued action to improve security and reduce risks.

For more see: “Government Credentials on the Open Web”

The Use of Recorded Future for Cyber Security Professionals(Opens in a new browser tab)

An Introduction to Recorded Future: An ability to leverage the predictive power of the web(Opens in a new browser tab)

The Insider Threat Worst-Case Scenario(Opens in a new browser tab)

FBI Provides An Update On #SonyHack Investigation Including Some Tech Details On Attribution

Lessons Learned: Are you one of the Fortune 500’s Unfortunate 221?

Bob Gourley October 29, 2014

The Recorded Future Special Intelligence Desk has just released a new Threat Intelligence Report we found to be full of important context and actionable information for enterprise cyber defenders.

The report, titled The Fortune 500’s Unfortunate 221, is available for download here.

This report is important for two key reasons:

It shows a clear example of the strategic benefit of cyber intelligence to enterprise cyber defense. This is information from outside the enterprise that should drive some key internal decisions and actions.
The report contributes to the strategic situational awareness of a growing problem, the exposure of account credentials in ways enabling adversaries to gain unauthorized access to enterprise resources.

Big Data = Dropping the Big One?

AdamElkus October 18, 2013

Eminent network scientist Laszlo Barabasi recently penned an op-ed calling on fellow scientists to spearhead the ethical use of big data. Comparing big data to the atom bomb, Barabasi persuasively argued that the technology and methodologies he and other social network theorists had created had far outstripped societal controls on its use.

Barabasi’s op-ed is part of a growing backlash against big data technologies and methodologies While Barabasi and historian of science George Dyson have the historical perspective, technical insight, and scientific stature to write insightfully about the problems of pervasive data collection and algorithms that structure human decisions, other criticisms have been less than edifying. Frustrated Harvard Business Review blogger Andrew McAfee recently called on pundits to “stop sounding ignorant about big data.” Big data, McAfee points out, is held to unrealistic standards and often the victim of strawmanning. Critics expect big data to eliminate uncertainty (spoiler: it doesn’t), falsely overestimate the power of qualitative thinking, make broad criticisms against quantification itself, and overestimate the willingness of big data advocates to automate important decisions. Listening to some critics talk, you’d think that Palantir or Recorded Future = Skynet.

While insightful in many aspects, Barabasi’s op-ed also fails to fully investigate the real implications of his Hadoop ~ ICBM analogy. Many scientists sought to influence the use of nuclear weapons, understandably believing themselves the most well-informed about the dangers they posed. However, even the most effective of their well-meaning efforts were superseded by Cold War politics. It is within the American political system — teetering between fear of terrorism, fear of big government, love of capitalism, and fear of capitalism — that big data’s societal impact will be decided. And if the rising tide of anti-science sentiment is any proof, politicians couldn’t care less about science or the men and women who practice it. Scientists are no longer viewed as unimpeachable figures of authority — and to some extent it’s doubtful they ever really were in predictably populist America.

Second, if big data is a weapon of mass destruction, you aren’t going to see Hans Blix suddenly busting down the doors of startups for snap inspections of Apache software or NoSQL. The only thing inherently more “dual use” than offensive cyber tools are big data technologies and methodologies. They are quickly becoming an integral part of modern business, academic research, and intelligence practice. Barabasi and others are correct that in a world in which the individual is more vulnerable than ever to government and corporate usage of data science, we arguably should try to mitigate current and potential harm. The problem with analogizing data to nukes (besides the fact that Google never destroyed a Japanese city) is that the former are clumsy weapons of last resort that even bitter enemies had a stake in controlling and the latter are ubiquitous aspects of modern life.

While Barabasi and others may have pioneered the techniques industry and government demand, big data has long since ceased to be a purely academic endeavor. The men and women who use them mostly aren’t scientists. Big data is heavily driven by corporate and government needs. Even the most talented PhDs often leave the academy to pursue higher salaries and greater freedom in the corporate world. Perhaps the best big data analogy is not to the atomic science of Einstein or Oppenheimer, but to the mathematics of Newton, Leibnitz, and Fourier. Were they alive today, even these eminent scientists would be powerless to prevent their mathematics from being used for military operations research on how to kill more efficiently or from being inputted into faulty and investor-bankrupting financial models. A Taylor Series or a differential equation — once out in the wild — belongs to anyone with a pen, paper, and calculator. Likewise, with open-source tools like Python machine learning library scikit-learn, anyone with the requisite technical training can utilize some canonical data science techniques.

Big data is certainly both marvelous and terrifying. It offers the opportunity to make money, make new scientific discoveries, and enhance political endeavors from development to national security. It also puts the individual at the mercy of companies and governments. But at the end of the day it is “neither a atomic bomb nor a holy grail.” It should neither be held to unrealistic standards nor feared as a weapon of mass destruction. And everyone who cares about the ethics of data — from the scientist to the layperson — must understand that control over its use is a function of the messy and dysfunctional domestic political scene and the anarchic international system.

Recorded Future Posts Assessment on Geopolitical and Supply Chain Risks From the Huawei Monoculture

Definitive Guide to Threat Intelligence

Technologies To See At DoDIIS

Iran’s Hacker Hierarchy Exposed: The Islamic Republic of Iran Makes Maximum Use of Contractors and Universities to Conduct Cyber Operations