Active Defense

Cybersecurity has witnessed a dramatic evolution over the decades, particularly in the realm of deception technologies. What began as static honeypots has now transformed into sophisticated, AI-driven active and preemptive defense systems. Here’s a look at this journey, tracing key innovations that have reshaped how organizations outsmart attackers.

In this two-part blog series, we examine how advancements in artificial intelligence (AI) are transforming the cybersecurity landscape. In our first article, we discuss how threat actors now employ AI to automate the creation of code exploits for known (one-day) and unknown (zero-day) vulnerabilities. This capability not only quickens the pace of attacks but also significantly enlarges their potential impact. In our upcoming blog, we will address AI-enabled polymorphic malware and ransomware, designed to slip past traditional, signature-based detections. The emergence of such technologies calls for a revolutionary approach to cyber defense strategies to effectively counter these evolving threats.

Earlier this month, we witnessed ( Reuters, TechCrunch, Washington Post, CNN etc. ) the US Department of Energy, several other government agencies, banks and other commercial organizations were hit in a global hacking campaign that exploited a vulnerability in widely used file-transfer software called MOVEit by Progress Software.

The ever-shifting landscape of cyber threats demands constant adaptation and expertise from security professionals. This is where Large Language Models (LLMs) are making a transformative impact. By enabling the development of specialized AI assistants, LLMs empower professionals to work smarter and faster. Here at Acalvio Technologies, we have harnessed the power of LLMs to create an AI Assistant that transforms the way security professionals leverage standardized cybersecurity frameworks. Imagine an assistant that sifts through data to identify threats, and even helps develop effective response strategies – all powered by the vast knowledge and contextual understanding of LLMs. Of course, challenges remain. The computational power required and the need for specialized training present hurdles. However, the potential benefits are undeniable. Leveraging the wealth of cybersecurity defensive knowledge sources, the Acalvio AI Assistant provides comprehensive, real-time, up-to-date answers, thereby enhancing user efficiency and effectiveness. This blog post delves into the process of building a LLM based AI assistant. We’ll discuss the key components involved, including LLMs, datasets, RAG technology, vector databases, and how we evaluate the final product.

As discussed in this whitepaper, the MITRE ATT&CK framework is a critical technology resource that can help you systematically evaluate your security measures against the potential threats you may encounter. Understanding the weaknesses in your current cybersecurity posture is a crucial step in protecting your digital assets.

Today, Honeywell and Acalvio announced the launch of Honeywell Threat Defense Platform (HTDP) Powered by Acalvio. HTDP brings a new approach in the ongoing effort to secure Operation Technology (OT) networks including those networks running the health and safety systems in the buildings where we live, work and play. In a recent report, “Protecting Operational Technology in Facilities from Cyber Threats”, Honeywell notes that less than half (44%) of surveyed facility managers “have a cybersecurity system in place to protect their OT systems from potential threats”. This new partnership with Acalvio brings the most advanced form of cyber defense, known as Active Defense, to the security portfolio of Honeywell Building Technologies (HBT). For those without a cyber defense system, HTDP provides state-of-the-art capabilities for your initial foray into cyber security. For those with a cyber security program, well, your building’s defenses have just received a significant upgrade!

Today we are pleased to announce that Acalvio’s cloud-based ShadowPlex Active Defense platform has been awarded FedRAMP Ready status by the US Government’s General Services Administration. This award demonstrates to federal agencies, and the broader security community, Acalvio’s commitment to offering threat management solutions for even the most demanding environments. ShadowPlex is the first Deception solution to attain FedRAMP Ready status in the FedRAMP Marketplace, which gives federal agencies the assurance they need to proceed with evaluations or initial purchases of our solution. FedRAMP was initiated in 2011 as a national government-wide program to define mandatory security standards for cloud services. The intent was to accelerate federal government cloud adoption by establishing a marketplace for secure cloud service providers (CSPs). “FedRAMP Ready” requires CSPs to submit to an audit of dozens of security controls by an authorized third-party auditor (3PAO). The controls are under NIST 800-53 guidance, one of the most stringent controls sets in existence. “The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector”, says President Biden’s May 2021 Executive Order. FedRAMP has been tasked with Federal cloud-security strategy for Cloud Services. Federal agencies are under constant attack and require Active Defense strategies that go beyond passive approaches Acalvio ShadowPlex not only adheres to the strict FedRAMP security controls, but also helps implement stronger cyber security standards for Federal departments and agencies by providing Active Defense. Acalvio has passed the control evaluation at the FedRAMP Moderate level for our SaaS-based ShadowPlex Deception service, placing us in Ready status. The 3PAO has attested to our security capabilities, and a Readiness Assessment Report has been reviewed and deemed acceptable by the FedRAMP Program Management Office. We invite federal agencies and other public sector entities to trial and deploy the solution with confidence.

That just focusing security defenses on the most common means of penetrating an organization doesn’t cut it. Sure, you should guard against phishing, fortify your DMZ and Internet-facing applications, train your staff, and so on. That will at least give you a credible response if you get hacked and you’re asked what you were doing to prevent it (which I admit is nothing to sneeze at!). However as we’ve seen, that won’t keep you safe.

If you’re reading this blog, you likely know the basics of the cyber kill chain. You might even be able to name a few of the seven stages in the kill chain, which lays out the steps adversaries take to attack and exploit their victims. Where you might have a lot more difficulty is in explaining two things: how attackers actually execute these steps, and what you’re doing to detect and mitigate them.