Run LLM Models on Macbook – Part II

Protect your intellectual property by running GenAI models locally

This is a continuation of my previous blog post on running open source models locally. In this blog we add Open WebUI as a web interface to provide the end user similar experience as ChatGPT.

Following is a short summary of why run local models locally.

Why Run Open-Source GenAI Models Locally?

Running open-source GenAI models locally provides several benefits:

  1. Data Protection: Keep sensitive information within your organization’s control. By processing data locally, you can keep sensitive information from leaving your organization’s premises, reducing the risk of data breaches and intellectual property theft.
  2. Increased Control: With full control over the deployment environment, you can tailor the setup to meet your specific requirements, ensuring that your models are used as intended.
  3. Improved Performance: Running GenAI models locally allows for faster processing times and reduced latency, making them more suitable for real-time applications.
  4. Enhance Security: Reduce the risk of data breaches and intellectual property theft by processing data locally.

Open Source License Requirements

Please check the licensing requirements for the open source model you are going to use as it may be quite different depending upon the model you use. The license may also be different depending on the type of use (personal, educational, commercial, etc.)

Step-by-Step Process

Follow these three simple steps to install and run multiple LLMs locally.

Step 1: Set up Ollama

Ollama is an open source project that enables you to run large language models (LLMs) locally without going through too much hassle. It is available at GItHub (see references below)

Open terminal window on Macbook and use the following commands:

mkdir llm
cd llm
curl -L https://ollama.com/download/ollama-darwin-arm64 -o ./ollama
chmod u+x ollama 
./ollama

Step 2: Download LLM model you want to run

Go to a new terminal windows and pull llama3

./ollama pull llama3

Step 3: Run the Model

Once the model is downloaded, you can run it and use prompts on the command line. Following is a typical session with one prompt and its response:

./ollama run llama3

Step 4: Install Open WebUI

Use the following steps to install Open WebUI.

python3 -m venv venv
 . venv/bin/activate  
pip install open-webui

The first line creates a new Python environment. The second line activates this environment and the third line installs Open WebUI.

Step 5: Run Open WebUI

Use the following command to run Open WebUI.

open-webui serve

You will see a bunch of messages appear on the terminal window as shows in the screenshot below. 

Now point your web browser to http://0.0.0.0:8080 or http://localhost:8080 where you have to create an account the first time you use Open WebUI. You are ready to ask questions using this web interface. On the top-left corner of the following screenshot, select one of the installed models from step 2 and then enter prompt for that model.

If you have multiple models installed locally, you can use the same prompt to check how they respond differently.

References

Subscribe to Blog

Subscribe to blog to get email notification of new posts

Recent blog posts

Posted in AI | Tagged , , , | Comments Off on Run LLM Models on Macbook – Part II

Post-Quantum Cryptography Resources

Open Source Software Libraries and Organizations working to future proof security of data 

This blog post provides essential resources for security professionals and software developers looking to secure data in the post-quantum era. It highlights key organizations such as NIST, the Linux Foundation, and the Post-Quantum Cryptography Alliance, which are leading efforts in quantum-resistant cryptography. Additionally, it introduces open-source libraries that facilitate the implementation of quantum-safe encryption algorithms, offering practical tools for integrating cutting-edge security measures into your systems.

NIST Post-Quantum Cryptography Research

The NIST Post-Quantum Cryptography project focuses on developing and standardizing cryptographic algorithms that are secure against the threats posed by quantum computing. This initiative aims to identify and endorse new cryptographic algorithms that can protect data and communications in a future where quantum computers might break current encryption methods. The project involves a multi-phase process, including a public evaluation and selection process to ensure that the chosen algorithms are both secure and practical for widespread use. NIST’s goal is to establish new standards for cryptography that will ensure data security well into the future.

Main webpage: https://csrc.nist.gov/projects/post-quantum-cryptography

NIST Released Three Post-Quantum Encryption Standards

After 8 years of work, the National Institute of Standards and Technology (NIST) has released its first three finalized post-quantum encryption standards, marking a significant step in securing data against future quantum computing threats. These standards include algorithms designed to protect digital information from being compromised by quantum computers, which have the potential to break traditional encryption methods. The new standards are intended to ensure long-term data security and support the transition to quantum-resistant cryptographic systems. 

Main webpage: The announcement page

Following are links to the finalized standards:

OpenQuantum Safe

The Open Quantum Safe (OQS) project is dedicated to developing and promoting quantum-resistant cryptographic algorithms and tools to safeguard data against the potential threats posed by quantum computing. It provides an open-source platform for the research and implementation of cryptographic algorithms that are resistant to quantum attacks. The OQS project aims to advance the security of information systems by offering resources, software libraries, and a community-driven approach to integrating quantum-safe algorithms into existing security frameworks.

Post Quantum Cryptography Alliance

The Post-Quantum Cryptography Consortium (PQCA) is focused on advancing the adoption and development of cryptographic systems that are secure against the potential threats posed by quantum computing. The consortium collaborates with industry leaders, researchers, and institutions to facilitate the transition to quantum-resistant cryptographic algorithms. It provides resources, guidelines, and support to help organizations implement and evaluate post-quantum cryptographic solutions, ensuring robust security in a future where quantum computers could compromise current encryption methods.

Open Quantum Safe provider for OpenSSL

The OQS Provider on GitHub is an open-source project that integrates quantum-safe cryptographic algorithms into the Open Quantum Safe (OQS) framework, such as OpenSSL. It provides a modular interface for incorporating post-quantum cryptographic algorithms into existing cryptographic libraries and systems. The OQS Provider enables developers to test and deploy quantum-resistant algorithms by offering an implementation of these algorithms as a provider for cryptographic operations. The project aims to facilitate the evaluation and adoption of quantum-safe cryptography within various software environments.

Summary

The post highlights essential resources for security professionals and software developers to secure data in the post-quantum era. It mentions key organizations such as NIST, the Linux Foundation, and the Post-Quantum Cryptography Alliance (PQCA), which are leading efforts in quantum-resistant cryptography. The blog also introduces open-source libraries that facilitate the implementation of quantum-safe encryption algorithms, including Open Quantum Safe (OQS) and its provider for OpenSSL. Specifically, it notes NIST’s release of three post-quantum encryption standards, FIPS 203-205, and provides links to these standards. Additionally, it summarizes OQS as an open-source project dedicated to developing and promoting quantum-resistant cryptographic algorithms and tools, and PQCA as a consortium focused on advancing the adoption and development of cryptographic systems secure against quantum threats.

Subscribe to Blog

Posted in AI, InfoSec, Quantum | Comments Off on Post-Quantum Cryptography Resources

Run LLM Models on a Macbook

As the use of GenAI models becomes increasingly prevalent, it’s crucial for organizations to ensure the security and ownership of their intellectual property. One way to achieve this is by running open-source GenAI models locally on your own infrastructure.

Why Run Open-Source GenAI Models Locally?

Running open-source GenAI models locally provides several benefits:

  1. Data Protection: Keep sensitive information within your organization’s control. By processing data locally, you can keep sensitive information from leaving your organization’s premises, reducing the risk of data breaches and intellectual property theft.
  2. Increased Control: With full control over the deployment environment, you can tailor the setup to meet your specific requirements, ensuring that your models are used as intended.
  3. Improved Performance: Running GenAI models locally allows for faster processing times and reduced latency, making them more suitable for real-time applications.
  4. Enhance Security: Reduce the risk of data breaches and intellectual property theft by processing data locally.

Open Source License Requirements

Please check the licensing requirements for the open source model you are going to use as it may be quite different for each model. The license may also be different depending on the type of use (personal, educational, commercial, etc.)

Step-by-Step Process

Follow these three simple steps to install and run multiple LLMs locally.

Step 1: Set up Ollama

Ollama is an open source project that enables you to run large language models (LLMs) locally without going through too much hassle. It is available at GItHub (see references below)

Open terminal window on Macbook and use the following commands:

mkdir llm
cd llm
curl -L https://ollama.com/download/ollama-darwin-arm64 -o ./ollama
chmod u+x ollama 
./ollama

Step 2: Download LLM model you want to run

Go to a new terminal windows and pull llama3

./ollama pull llama3

Step 3: Run the Model

Once the model is downloaded, you can run it and use prompts on the command line. Following is a typical session with one prompt and its response:

./ollama run llama3
>>> who wrote harry potter?

The Harry Potter series was written by J.K. Rowling (Joanne Kathleen Rowling). She is a British author, screenwriter, and 

philanthropist best known for creating the beloved Harry Potter fantasy series.

Rowling began writing the first book in the series, “Harry Potter and the Philosopher’s Stone” (published as “Harry Potter 

and the Sorcerer’s Stone” in the United States), while she was a student at the University of Exeter. The book was published 

in 1997 and became a worldwide bestseller.

The subsequent books in the series were:

1. “Harry Potter and the Chamber of Secrets” (1998)

2. “Harry Potter and the Prisoner of Azkaban” (1999)

3. “Harry Potter and the Goblet of Fire” (2000)

4. “Harry Potter and the Order of the Phoenix” (2003)

5. “Harry Potter and the Half-Blood Prince” (2005)

6. “Harry Potter and the Deathly Hallows” (2007)

The Harry Potter series has since been adapted into a successful film franchise, as well as stage plays, video games, and 

other media. J.K. Rowling’s creation has become a cultural phenomenon, inspiring countless fans around the world.

Rowling has also written several companion books to the series, including “Fantastic Beasts and Where to Find Them” (2001) 

and “The Tales of Beedle the Bard” (2008). She has also published several novels for adults, including “The Casual Vacancy” 

(2012) and “The Cuckoo’s Calling” (2013), under the pseudonym Robert Galbraith.

>>>

If you have completed the above three steps, you are on your way to start using LLMs locally on your Macbook. No need to have Internet connectivity or send data to a third party chatbot. Ollama supports many LLMs and the list is available on its Github page. You can “pull” any of these models and test them locally.

Running open-source GenAI models locally provides a secure and controlled environment for developing and deploying AI-powered applications. By maintaining ownership and control over your data, you can protect your intellectual property while still leveraging the benefits of GenAI technology.

In a next blog post, I will discuss using a web interface with Ollama.

References

https://github.com/ollama 
https://github.com/ollama/ollama
https://ollama.com/library

Subscribe to My Blog

Latest Blog Posts

Posted in AI | Comments Off on Run LLM Models on a Macbook

Navigating the Landscape of Risk Management Frameworks

In the realm of information security, the quest to effectively manage risk is paramount. However, amidst the myriad of frameworks available, distinguishing between those explicitly designed for risk management and those that serve as broader guidelines can be a daunting task. A recent survey conducted over a 24-hour period on April 20-21, 2024, offers illuminating insights into the landscape of risk management frameworks, shedding light on prevalent practices and perceptions within the industry. Following is an image showing the results of this survey:

Despite the survey question’s slight ambiguity, the responses gleaned from 259 votes and 5591 impressions on LinkedIn provide valuable glimpses into the strategies employed by information security teams. It becomes evident that a multitude of frameworks are being utilized, even ones not originally intended as strict “risk management frameworks”.

Towering above the rest in popularity is the NIST Cybersecurity Framework (NIST CSF), a stalwart in the field renowned for its comprehensive approach to cybersecurity. Originating from an initiative aimed at safeguarding critical infrastructure, NIST CSF has transcended its initial scope to emerge as a go-to resource for managing cybersecurity risk across diverse organizational landscapes.

When probed further about why individuals perceive NIST CSF as a risk management framework, one respondent succinctly encapsulated the sentiment: “The goal of CSF and pretty much any control framework is to manage and reduce risk.” Indeed, the preface of NIST CSF explicitly states its purpose as assisting organizations in managing and mitigating cybersecurity risks, underscoring its relevance in the risk management arena.

However, it’s important to acknowledge dissenting voices within the survey responses. While many recognize NIST CSF as a formidable tool for risk management, others contend that it falls short of being a dedicated risk management framework. Instead, frameworks such as ISO/IEC 27005:2022 and NIST SP800-30 are hailed as the true champions of risk management, offering more specialized approaches tailored to the intricacies of risk assessment and mitigation.

Moreover, respondents highlight the need to delineate between distinct categories of frameworks, including:

  • Security Program Management such as NIST CSF
  • Risk Management such as NIST RMF
  • Control Frameworks (such as NIST 800-53)

This clarification is essential in preventing confusion and ensuring that organizations select the most appropriate framework for their specific needs.

Further complexity arises with the mention of FAIR (Factor Analysis of Information Risk), heralded as a risk assessment methodology rather than a traditional risk management framework. While some dismiss FAIR due to its perceived lack of widespread adoption, others emphasize its value in providing a structured approach to assessing and quantifying information risk.

In conclusion, the survey findings underscore the nuanced landscape of risk management frameworks, characterized by a diversity of approaches and perspectives. While NIST CSF reigns supreme in popularity and utility, it’s essential for organizations to critically evaluate their needs and objectives before selecting a framework (especially when it comes to SEC breach notification/reporting on Form 8K). By fostering a deeper understanding of the distinctions between various frameworks and methodologies, information security teams can navigate the complex terrain of risk management with confidence and clarity.

Subscribe to blog

Recent Posts

Posted in Risk Management | Tagged , , , | Comments Off on Navigating the Landscape of Risk Management Frameworks

CISO MindMap 2024: What do InfoSec Professionals Really Do?

Many individuals outside the realm of cybersecurity often underestimate the intricacies involved in a security professional’s role. Since its inception in 2012, the CISO MindMap has served as a valuable educational resource, offering insights into CISO responsibilities and aiding security professionals in crafting and enhancing their security programs. Continuously adapting to reflect the evolving landscape of cybersecurity, the CISO MindMap has been updated to accommodate the latest developments in the field. Here is the most recent iteration of the CISO MindMap for 2024, featuring numerous enhancements and fresh recommendations for the year 2024-25.

Don’t forget to review recommendations for 2024-25 described below and to subscribe to my blog.

Click here to download high resolution PDF version of the CISO MindMap 2024

Summary of Changes to 2024 CISO MindMap

With time, the responsibilities of security professionals are only increasing. Why? Technology is changing fast, bringing new ways of doing business, continuous adoption of Cloud, and extremely fast evolving GenAI technology with many applications. Not only the Infosec professionals are “expected” to deeply understand these technologies, they are also tasked with providing policies/guidance on how to secure them. For this reason, every year you find new things on the CISO MindMap. At the same time, some items are changed or removed from the CISO MindMap depending upon their relevance. In the latest CISO MindMap, modified and new items are marked in red color for your convenience.

Other noticeable changes include:

  • Artificial Intelligence and GenAI – MindMap now has a dedicated section on Artificial Intelligence and GenAI, reflecting insights from security leaders. GenAI’s rapid development is exciting, but measured caution is advised until the field matures further. 
  • Removing Redundancy and Overlaps – Removed some redundancies and overlaps in different sections. I also moved some elements of the MindMap to more relevant categories.
  • Security Team Branding – An integral aspect of the CISO’s role involves effectively advocating for information security across diverse stakeholders. Drawing from valuable insights provided by experienced CISOs, we have expanded the section on ‘Security Branding’ in response to their feedback. This includes essential skills such as negotiation, executive engagement, strategic prioritization, and tactful decision-making. These are identified as key areas where new CISOs often encounter challenges, and thus, warrant special attention.
  • Expiration Date – A common issue is that many professionals still have older CISO MindMap copies. Like last year, I added an “expiration date” to let people know when they should stop using a particular version. The expiration date for the 2024 CISO MindMap is the end of June 2025. The next version will be published before the current version expires.

CISO MindMap Updates Methodology

Every update to the CISO MindMap undergoes thorough consideration, research, and attention to detail. In addition to my ongoing engagements with industry leaders, various methods are employed to ensure we capture the pulse of the cybersecurity landscape:

  • Conducting interviews with experts
  • Distributing surveys to gather insights
  • Leveraging LinkedIn for targeted questions and discussions
  • Analyzing feedback and comments from previous versions of the CISO MindMap
  • Staying abreast of industry news and conducting in-depth analysis

Furthermore, I’d like to express my gratitude to the contributors whose valuable insights have enriched this endeavor. The ‘Acknowledgments‘ section of this blog post includes their names and LinkedIn profiles as a token of appreciation.

Are you Accountable for Everything in the CISO MindMap?

Security is inherently a collaborative effort, and the role of the CISO entails providing consultative guidance in various areas outlined within the CISO MindMap. It’s crucial to discern between areas where direct ownership and accountability are necessary and those where consultation is the primary function. Within any organization, numerous stakeholders are involved, and a common pitfall is the lack of clearly defined boundaries for each role.

My recommendation is to establish a RACI (Responsible, Accountable, Consulted, Informed) matrix, which serves as a standardized methodology for delineating roles and responsibilities among stakeholders [6]. By mapping out tasks and corresponding roles within this framework, clarity is achieved, ensuring that each stakeholder understands their level of involvement and contribution to the overall security landscape.

Focus Areas and Recommendations for 2024-2025

Each year, I offer my recommendations as a practitioner, drawing insights from discussions with information security leaders. My approach strives for objectivity, steering clear of hype and focusing solely on data-driven research. Though unintended biases may exist, the goal remains to propose actionable steps viable within a short to mid-range timeframe. These recommendations do not constitute future predictions; rather, they address the immediate needs for enhancing security programs.

Selecting a concise set of recommendations is always a challenge for me. While the list provided below may be longer than I’d prefer, I aim to offer a comprehensive array of considerations for your reflection. Followers of the MindMap will notice both recurring suggestions from previous years and novel additions, providing a blend of continuity and fresh insights.

I’m genuinely interested in hearing your perspective on these recommendations and understanding whether they resonate with your experiences and insights. Your feedback, whether in agreement or disagreement, provides valuable insights that can help refine and improve our approach to addressing security challenges. So, please feel free to share your thoughts and insights on these recommendations—whether you support them or have reservations—so we can engage in a constructive dialogue to further enhance our security strategies.

Recommendation 1: Adopt a Cautious Approach Towards GenAI

GenAI has become a focal point of discussion, rapidly evolving within the technological landscape. The Wall Street Journal reported Amazon’s unprecedented investment in an AI startup, reflecting the significant momentum in this domain. In 2023, investments in Generative AI companies exceeded $29 billion [1]. Furthermore, numerous open-source solutions are emerging within the GenAI market [2]. Amidst the buzz, it’s important to maintain a discerning approach.

Security professionals approach GenAI from three primary perspectives:

  1. Utilization within security practices: Emphasizing enhanced productivity and the exploration of automation opportunities for routine tasks.
  2. Safeguarding GenAI in corporate environments: Establishing GenAI centers of excellence to ensure governance, policy adherence, and protection against potential attacks. Aligning business and cybersecurity strategies to accommodate GenAI.
  3. Monitoring malicious use of GenAI: While not yet a cause for alarm, it’s essential to remain vigilant regarding the evolving applications of GenAI for malicious purposes.

Although every security vendor touts AI integration within their products and services, it’s prudent to avoid succumbing to hype and refrain from significant investments in GenAI technology for security purposes at this stage. It’s anticipated that over the next 12-18 months, clear market leaders will emerge from the current phase of hype and use cases for Cybersecurity will be better defined. At this stage, it is better to educate oneself and explore use cases such as automation and productivity enhancement.

Recommendation 2: Consolidate and Rationalize Security Tools

No matter the size of your InfoSec budget, it is prudent to take a more critical look at security programs and find ways of ways for program management. An average organization is using a large number of technologies, by some estimates as high as 47, according to a Ponemon survey. Yet many security leaders don’t know if Cybersecurity tools are working. Accumulating more security tools doesn’t necessarily lower risk; rather, it amplifies the necessity for maintaining expertise within security teams. There is a need for consolidation and rationalization of security tools by deeply exploring Return on Investment (ROI) of these tools. When rationalizing the need for tools, consider factors such as functionality overlap, available expertise within the team to effectively utilize the tool, and the innovation on the side of vendors. You may be surprised to find shelfware. In some cases open source tools may work just fine as well.

Recommendation 3: Cyber Resilience – Go Beyond Incident Response

Building upon last year’s recommendation, it’s evident that in numerous organizations, security incident response remains separate from business continuity and disaster recovery functions. It’s imperative to assess ransomware defenses, detection, and response capabilities comprehensively. Conducting a business impact analysis is essential to identify critical processes, applications, and data.

Moreover, testing the ability to restore systems and data within an acceptable timeframe is crucial. Merely possessing backups is insufficient; the capability to rebuild impacted systems and restore backups promptly is vital for restoring normal business operations following security incidents.

Recommendation 4: Build a Brand for Security Team

The role of a CISO is inherently public-facing, demanding continuous engagement with technology and business leaders. While the message being conveyed holds significance, the credibility of the messenger is equally vital. To better serve the interests of the business, it’s imperative to equip security team members with skills beyond technical expertise, especially those who are aspiring to be leadership roles in future.

This includes training in business acumen, value creation, influencing without authority, and enhancing human experience. Emphasizing these aspects is not new; however, it’s crucial to maintain focus on the fact that information security teams operate within a broader context and must facilitate business objectives while collaborating effectively with others.

Skills such as negotiation, compromise, and strategic decision-making play pivotal roles in establishing both personal and team credibility, ultimately contributing to the enhancement of the overall brand.

Recommendation 5: Maximize Business Value of Security Controls

The proliferation of security and compliance controls often creates friction between security and other technology teams. However, not all controls carry equal weight, and some may offer minimal value in terms of risk reduction and business enhancement. It is advisable to conduct a thorough assessment of each control, evaluating its effectiveness and business impact.

CISOs should devise a strategy to phase out low-value controls within the next 12-18 months, thereby eliminating unnecessary maintenance costs. This proactive approach ensures resources are allocated efficiently, focusing efforts on controls that truly contribute to mitigating risks and driving business value

How to Use CISO MindMap?

Have you ever been asked to explain what you do as a security professional? The CISO MindMap offers a comprehensive solution for addressing this question and clarifying the intricacies of the role. Many professionals have attested to its efficacy in elucidating the complexities of the CISO position, particularly when communicating with a business audience.

Here are some ways in which the CISO MindMap proves to be immensely valuable:

  • Facilitating conversations with fellow technology professionals.
  • Instrumental in the design and refinement of security programs.
  • Adopted by certain security vendors for raising awareness.
  • Employed in CISO group discussions and community meetings.
  • Aiding aspiring security professionals in understanding the industry landscape and charting their career paths.
  • Serving as an educational and awareness-raising tool.

Obviously there is a lot on this MindMap. The stress on people who have these responsibilities is real. If nothing else, this MindMap should help leaders recognize that stress and do something about it. I covered this topic (stress) in my latest book Cybersecurity Arm Wrestling: Winning the perpetual fight against crime by building a modern Security Operations Center (SOC) as well.

What are They Saying?

Following are some comments on CISO MindMap LinkedIn post from 2023.

  • Michael Restivo – “One of the most valuable documents around. Love this Rafeeq.”
  • Chris Novak – “Always a great asset! Thanks for all that you do for the cybersecurity community!”
  • Muath AlHomoud – “Great insight Rafeeq Rehman always inspiring”
  • Christophe Foulon – “Insightful as always, Rafeeq Rehman”
  • Matthew P. – “Thanks for updating this. I think this makes a really useful tool when talking to the next generation about careers in security being able to demonstrate the breadth of what we can get involved in is quite eye opening”
  • David Elfering – “Thank you! I review security programs as part of my work; your outline is fantastic. As a CISO, I regularly reviewed it, and as a consultant/advisor, I can see even more clearly how others would benefit.”
  • Alan Ng – “Thanks for all the heart and sweat poured into this awesome mindmap and recommendations! It is a great resource!”
  • Stefan Jäschke – “Terrific work Rafeeq Rehman – thanks for giving back to the community consistently over the years in so many ways.”
  • Arvind Javali – “I listened to your podcast interview on CISO mindmap, very insightful, thanks for sharing”
  • Ashoka Reddy – “Thank you, Rafeeq Rehman, for the knowledge, insight, time, and effort you have put into creating and sharing the #CISOMindMap. For #InformationSecurityManagers this is a gold standard that is priceless. It’s a little overwhelming to the point of being funny, but you’ve mapped my professional brain pretty nicely. For #BusinessLeaders this gives oversight to how we protect organizations, revealing our value and responsibilities.“
  • Jas Puar – “Great timing. I’ve been looking at the 2022 version recently for some inspiration. Glad the 2023 version is available. The role is becoming bigger (cutting deeper across the entire business) and therefore more critical every year. More needs to be done to educate and raise awareness to change the direction of travel, otherwise an already thankless role, will very soon become an impossible one. Keep up the great work!”
  • Steve Lodin – “Thanks again for your continued work here. I look at and keep a copy of every version you release!”
  • Fernando Montenegro – “Really nice work, forwarded it to others. I really enjoy the “expiration date” aspect.”
  • Georgeo X. Pulikkathara – “Rafeeq Rehman, good work on the CISO MindMap. My assessment is that this is a good framework for CISOs to approach all the areas we need to consider.”
  • Rob Mukherjee – “This is brilliant, thanks Rafeeq. And couldn’t agree more with your comment in the first focus area. “Understand that merely having a backup is not enough. Ability to rebuild impacted systems and restore backups in a timely manner is crucial.” Spot on!! Think “restore”, not just backup!”

Acknowledgments

In addition to numerous infosec leaders who provide their input, we have a LinkedIn Group to gather suggestions and comments from the community. While many provided feedback, the following is a list of people and organizations who provided “specific suggestions” for improvements (in no particular order). If I missed anyone, please send me a message to make corrections.

  1. Jack Jones 
  2. Gary Hayslip
  3. Michael Restivo
  4. Wes Sobbott
  5. Muath AlHomoud  
  6. Ross Young
  7. Ross McNaughton 
  8. Gerard Onorato 
  9. Tony DeAngelo  
  10. James J Azar  
  11. Chris Hughes 
  12. Izhar Mujaddidi
  13. Nadeem Iftikhar 
  14. Ismail Cattaneo  
  15. Andres Ricardo Almanza Junco  
  16. Jack Jones 
  17. Chad Sturgill  
  18. Omar Khawaja  
  19. Rodolphe Simonetti 
  20. Scott Hawk  
  21. Hisham Zahid 
  22. Jerich Beason  
  23. M Kashif Bukhari  
  24. Chris Castaldo
  25. Atif Yusuf
  26. Jon Rogers  
  27. Andi Baritchi 
  28. Ricky Mehra
  29. Ahmed Kamel
  30. Tobias Ander
  31. Indy Dhami
  32. Matthew Thompson
  33. Marc Vael
  34. Christophe Foulon

Your input is highly appreciated!

References

[1] Wall Street Journal, Amazon Invests $2.7 Billions More in AI Startup, [link] 

[2] Wall Street Journal, Open-Source Companies Are Sharing Their AI Free. Can They Crack OpenAI’s Dominance?, [link]

[3] NIST AI Risk Management Framework [link]

[4] Deloitte, Proactive Risk Management in Generative AI [link]

[5] Deloitte, The implications of Generative AI for businesses [link]

[6] CIO, The RACI matrix [link]

Copyright © 2012-2024 – Permission to use

This MindMap is copyrighted material. However it is absolutely free for all personal, business and professional purposes (like water and air). There are no strings attached, as long as it is not altered and not used to make money. When using this MindMap, please cite the source properly so that recipients can receive future updates.

Subscribe to Blog

To keep updated with new versions of CISO MindMap and other posts, subscribe to my blog here:

Recent Posts

Posted in cisomindmap | Tagged , , , , , | Comments Off on CISO MindMap 2024: What do InfoSec Professionals Really Do?

Building Generative AI (GenAI) Applications

Four key considerations for business executives

Harnessing the potential of Generative AI (GenAI) to create user applications that drive business value may appear daunting, yet it doesn’t need to be. With the GenAI field advancing swiftly and offering a plethora of options, understanding the following four fundamental areas can provide clarity for business leaders:

  1. User Interface (UI) Design for Prompt Interaction – GenAI applications typically rely on user prompts to generate responses. A well-designed UI, effective prompt engineering, rigorous testing, and user training are crucial aspects. Tailoring the UI to enable users to establish “context” for GenAI responses is paramount.
  1. Implementing Prompt and Response Filtering – Establishing controls to govern how GenAI models respond to prompts and filtering out undesirable content is essential. This ensures that the generated responses align with organizational standards and objectives. The focus should be on providing guardrails in case the GenAI models deviate from safety standards.
  1. Selecting a Baseline GenAI Model – Choosing the right baseline GenAI model is pivotal. These pre-trained deep learning models serve as the foundation and offer a starting point for application development. Careful consideration of factors such as application type, cost, and computational requirements is imperative when selecting from a range of commercial and open-source options.
  1. Fine-Tuning for Optimal Performance – Enhancing the performance of baseline models through fine-tuning is indispensable. Fine-tuning involves leveraging additional data to adapt the baseline model to specific use cases, such as generating journalistic essays, customer support, legal documents, etc. Organizations should deliberate on how they intend to fine-tune GenAI models to align with their unique requirements.

While building GenAI applications entails inherent complexity, focusing on these considerations provides a valuable blueprint for developing high-quality user applications driven by Generative AI technology.

Subscribe to Blog

Recent Posts

Posted in AI, Leadership | Tagged , , | Comments Off on Building Generative AI (GenAI) Applications

Security Hygiene

While responsibilities of leaders in information security are very extensive as shown in the CISO MindMap, following are seven foundational and “must-have” capabilities that every information security program should have. If any of these capabilities is missing, the first priority should be to build it before considering more advanced level program development.

  1. Governance – Create or update foundational security policies, standards and procedures. This may vary significantly based upon organizational maturity, compliance needs, size of the organization, and risk tolerance. Create success metrics. Perform regular audits to measure effectiveness of security. Align security program with business objectives.
  2. Risk Management Process – At minimum, every organization must have a process for identifying, assessing, documenting, reporting, prioritization, and mitigating risk. This may be as simple as using a spreadsheet or as complex as using a sophisticated GRC tool.
  3. Asset Management – A process for identifying assets including hardware, software, network, applications, Cloud and others. An asset is anything that your organization relies on conducting its business.
  4. Network Security – Employ fundamental network security countermeasures such as network and web application firewalls, network segmentation, remote access VPN, and network threat detection capabilities.
  5. Endpoint Detection and Response – Use tools for endpoint protection, data protection, anti malware, that can provide protection against data theft and ransomware.
  6. Vulnerability Management Program – A program must include network and application scanning, vulnerability identification, penetration testing, patch management, tracking and closing vulnerabilities and linking with the risk management process. Many open source tools are available to overcome budget issues.
  7. Threat Detection and Response – Ability to detect threats using automated tools, logs, and other mechanisms, create an incident response process. Build an internal coalition for recovering from security incidents in a timely manner. Build relationships with local law enforcement. Tabletop exercises are a good mechanism to test capability for incident response, identify gaps and make improvements.

Building these capabilities requires people, effective processes, and relevant tools. A CISO should identify gaps, make a plan, request for budget and set targets/goals to build these capabilities.

Subscribe to Blogs

Recent Posts

Posted in InfoSec | Tagged , , , , | Comments Off on Security Hygiene

Third Party Risk Management – Considerations for creating a program standard

What is a Third Party

Third parties generally refer to external entities with whom you enter into contractual agreements to deliver products or services. These external partners may offer essential services to support your business operations or extend services to your clientele on your behalf. Examples of third parties encompass a diverse range of entities, such as internet service providers, financial institutions, software vendors, building maintenance companies, and others.

Reasons for Managing Third Party Risk

  • Breach Liability – A security incident with third parties may impact your business operations. If third parties have access to your data or your customers’s data, you may be liable for handling data breaches that occurred on a third party network.
  • Compliance – Many data privacy regulations require compliance wherever the data is stored, processed and utilized. A third party having access to privacy related data may be part of the scope of work you have to do to meet regulatory compliance.
  • Resilience of Supply Chain – Disruptions in supply chain may be detrimental to your business. Managing third party risk is essential for a reliable supply chain.

Have a Risk Management Program

If you have a corporate information security risk management program, it can provide you a basis for managing third party risk. Managing the lifecycle for third parties is very similar in many ways to managing other information security risks. Make third party risk as part of the overall risk management program and follow a risk management lifecycle starting from risk identification, categorization, assessment, mitigation and closure.

Define Third Party Risk Management Standard and Processes

Building a third party risk management standard should be one of the first steps for CISOs. A standard provides clarity and consistency for all stakeholders and goes a long way towards achieving maturity. Following are some of the components that should be part of the standard.

  1. Clearly define purpose of the standard
  2. Define categories for third parties
  3. Contractual arrangement with third parties
  4. Onboarding and offboarding of third parties
  5. Perform assessments for a third party
  6. Frequently assessments will be performed
  7. Monitoring and oversight of third party risk
  8. Third party compliance management
  9. Define a list of artifacts needed from third parties and the frequency at which these are required.
  10. Define third party “trust levels” and minimum technical requirements for each level. This will help determine which of the third parties can be given access to network, data, and other assets based upon the trust level.
  11. A RACI matrix for all stakeholders

Categorize Third Parties

Some third parties carry significantly more risk than others, and need more attention for risk management. Categorization of third parties may be based upon factors such as:

  • Criticality for business operations – Who is critical to your business processes such that without this third party business will cease to function.
  • Access to data – Who has access to your corporate, employee or your customer data.
  • Direct connectivity to network or Cloud – Who has direct connectivity into your network or to your Cloud environments with possibility of a breach on the third party environment can directly spill over into your environment.
  • Type of relationships with the third party – Do you consume services, use source code or software libraries, use a third party for data processing, and so on.

Based upon these and other factors, you can define a list of categories to prioritize assessments.

Automation and Tools

Historically simple tools such as questionnaires and spreadsheets have been used for third party risk assessment. To reduce management overhead, some information for third parties can be collected and assessed with automated tools and publicly available information.

Subscribe to blog

Recent Posts

Posted in Leadership | Tagged , , | Comments Off on Third Party Risk Management – Considerations for creating a program standard

No-Hype Use of LLMs in Cybersecurity

Three use cases of Large Language Models (LLMs) to save time and immediately enhance productivity

While there is tremendous hype around LLMs, many people in Cybersecurity are still struggling to put news tools like ChatGPT and Google Bard to practice. This is a brief article to discuss use cases that will save time and quickly enhance your productivity in carrying out common tasks.

  1. Create Bash Scripts to automate Cyber Security tasks
  2. Super fast SIEM use cases development
  3. Assistance in Security Awareness Program

Use Case 1: Automate Cybersecurity Tasks with bash Scripts

Many Cybersecurity professionals need automating simple tasks using scripts that would otherwise take a large amount of time and work. ChatGPT can create bash shell scripts quickly that you can adapt to your needs. Let us assume your policy requires disabling username/password authentication to SSH and allows only key based authentication. The following example shows how ChatGPT creates a script to accomplish it on a large number of servers. Carefully take a look at the prompt and response

User Prompt

“create a bash shell script that to check if SSH login using username and password is enabled on a large number of Linux servers. Assume key based login is enabled on these servers for a user with username “super_secret_admin”. The list of server IP addresses is stored in a file servers.txt, one IP address per line.”

ChatGPT Response

“To check if SSH login using a username and password is enabled on a list of Linux servers where key-based login is enabled for the user “super_secret_admin,” you can use a Bash script that reads the list of server IP addresses from a file and remotely checks the SSH server configuration for the “super_secret_admin” user. Here’s a sample script for this task:

#!/bin/bash

# Specify the path to the file containing server IP addresses

server_list_file="servers.txt"

# Specify the SSH username (super_secret_admin user)

ssh_user="super_secret_admin"

# Function to check if SSH password authentication is enabled for the super_secret_admin user

check_ssh_password_auth() {

    server_ip="$1"

    ssh_config_file="/etc/ssh/sshd_config"

    # Use SSH to remotely fetch the SSH server configuration

    ssh_config=$(ssh -o BatchMode=yes -o ConnectTimeout=5 "$ssh_user@$server_ip" "cat $ssh_config_file")

    # Check if PasswordAuthentication is set to yes in the sshd_config

    if [[ "$ssh_config" =~ "PasswordAuthentication yes" ]]; then

        echo "SSH password authentication is enabled for $ssh_user on $server_ip."

    else

        echo "SSH password authentication is not enabled for $ssh_user on $server_ip."

    fi

}

# Main script

if [ -f "$server_list_file" ]; then

    while read -r server_ip; do

        echo "Checking SSH configuration on $server_ip..."

        check_ssh_password_auth "$server_ip"

    done < "$server_list_file"

else

    echo "Server list file not found."

fi

Replace “super_secret_admin” with the appropriate SSH username you want to check for password authentication.

Ensure that the SSH key of the machine running this script has access to the servers you are checking. The script reads server IP addresses from the servers.txt file, one per line, and then connects to each server to check the sshd_config file for the presence of “PasswordAuthentication yes” for the “super_secret_admin” user to determine if password authentication is enabled.

You can run this script with the command bash script.sh. It will check each server listed in the servers.txt file.

Make sure you have the necessary permissions and approvals to perform remote checks on these servers.“

Here is a partial screenshot of this prompt and response.

Note that you can fine tune the prompt if the result does not meet your needs. Also note that you still need knowledge of Bash scripting to make sure the generated script meets your needs and that you are able to make manual fine tuning to the script, if needed. ChatGPT is your assistant, not your replacement!

Use Case 2: Super Fast SIEM Use Case Development

LLM tools are also very useful to quickly fine tune SIEM rules and enhance detection capabilities in Security Operations Centers (SOC). The following simple example shows how quickly ChatGPT created Splunk code for detecting directory traversal attacks. 

The next screenshot shows Google Bard response to the same prompt with a different answer.

Use of these tools can greatly enhance speed of SIEM tuning and detection capability. The work that usually needs days can be accomplished in hours.

Use Case 3: Assistance in Security Awareness Program

Writing good communication is an art and many of us in the Cybersecurity field are not very skillful in written communication. Fortunately now we have ChatGPT to come to our assistance. Please see the following prompt and response in crafting a communication to your specific audience.

User Prompt

“Craft a brief email for executive management team members highlighting importance of security awareness month and actions that the board should take during this month.”

ChatGPT Response

“Subject: Security Awareness Month: Enhancing Our Organization’s Resilience

Dear Members of the Executive Management Team,

I trust this message finds you well. As we usher in Security Awareness Month, I want to underscore the critical importance of this initiative and outline the actions that our Board of Directors should consider to reinforce our commitment to cybersecurity.

Security Awareness Month serves as a yearly reminder of the dynamic and ever-evolving nature of security risks within our industry. It is a timely opportunity to focus our efforts on strengthening our organization’s security posture. To this end, I recommend the following actions for our Board’s consideration during this month:

1. **Increased Employee Vigilance**: Encourage all staff to maintain a heightened level of awareness when it comes to security threats. The mantra “See something, say something” should be reinforced throughout our organization.

2. **Education and Training**: Support and participate in security awareness training sessions for our employees. Highlight the importance of robust password management, data protection, and secure online practices.

3. **Policy and Procedure Review**: Conduct a thorough examination of our existing security policies and procedures. Identify areas where revisions or improvements are needed to address emerging threats.

4. **Incident Response Simulation**: Consider organizing a tabletop exercise to test our incident response plan. Ensure that all Board members and key staff are well-prepared in the event of a security incident.

5. **Expert Insights**: Explore the possibility of inviting external security experts to provide insights on emerging threats and best practices in security. Their perspective can be invaluable in fortifying our defenses.

6. **Stakeholder Communication**: Maintain transparent communication with our stakeholders, including customers and partners, regarding our dedication to security and the measures we are implementing to safeguard their data.

7. **Resource Allocation**: Evaluate and approve the allocation of necessary resources for our security initiatives. Invest in technologies and training programs that enhance our ability to mitigate threats effectively.

8. **Regular Updates**: Ensure that our Board members are well-informed about the progress of our security initiatives and receive regular reports on security-related incidents and trends.

By collectively embracing these actions during Security Awareness Month, we will not only strengthen our resilience against potential security threats but also reinforce our unwavering commitment to the security of our organization and the trust of our stakeholders.

Your support and involvement in these efforts are invaluable. Thank you for your commitment to the security and success of our organization.

Best regards,

[Your Name]

[Your Title]

[Your Contact Information]”

Let us say this text is too long for your purpose. A follow-up prompt, as shown below, makes it much shorter. 

Using LLM tools as your assistance in a security awareness program is a great help.

Check Your Corporate Policy for LLM Use

Before using LLM tools, check your corporate policy. The tool may store your prompts and use them to enhance capabilities of the model. If you put any sensitive information in the prompt, it may result in unintentional data leakage. Use these tools with caution and in accordance with your corporate policies.

Recent Posts

Subscribe to Blog

Posted in AI, InfoSec, Leadership, SOC | Tagged , , , , , | Comments Off on No-Hype Use of LLMs in Cybersecurity

A New CISO’s TODO List

When a CISO joins a new organization, it is important to start with basics. Following is a TODO list for every new CISO.

  1. Understand the business – where revenue comes from, who are major customers, meet internal stakeholders.
  2. Review CISO budget – How much is the budget, where it is spent (people, technology, services).
  3. Know team members – Get to know team members. In case of a large team, get to know key leaders but meet individual contributors to understand their challenges.
  4. Identify compliance and regulatory needs – Before creating strategy, list all compliance needs, their current status, next audit cycle timeline.
  5. Understand technology foundation
    1. Policy, standards and governance structure.
    2. Critical assets and asset management (what to protect).
    3. Identify key technologies used for protection (end point, network, applications, Cloud, Identity and access management).
    4. Security operations, threat detection, incident response
  6. Key vendors – Contact key vendors and identify how to get their help.
  7. Develop Strategy and Metrics – What needs to be done to build a security program, risk management strategy, and how to measure progress.
  8. Security team branding – Create a plan for marketing and branding of the security team.

Subscribe to Blog

Posted in InfoSec, Leadership | Tagged | Comments Off on A New CISO’s TODO List