Navpreet Pannu

[ad_1] Every day, millions of passengers depend on a vast, complex airport ecosystem to get from Point A to Point B. From airline check-ins and baggage handling to air traffic control and terminal operations, the aviation sector is an intricate web of interconnected third-party providers, technologies, and stakeholders. In this high-stakes environment, a cybersecurity breach is not a single point of failure, it’s a ripple effect waiting to happen. Cyber Threats Aren’t Just IT Problems – They’re Operational Crises When people think about airport cybersecurity, they often picture network firewalls at airline headquarters or secure software for booking systems. But the real threat landscape is far broader and far more vulnerable. If a catering supplier is hit with ransomware, the aircraft turnaround slows. If the baggage conveyor system is compromised, luggage piles up, delaying departures. If the security contractor experiences […]

[ad_1] Introduction Large Language Models (LLMs) have rapidly become integral to applications, but they come with some very interesting security pitfalls. Chief among these is prompt injection, where cleverly crafted inputs make an LLM bypass its instructions or leak secrets. Prompt injection in fact is so wildly popular that, OWASP now ranks prompt injection as the #1 AI security risk for modern LLM applications as shown in their OWASP GenAI top 10. We’ve provided a higher-level overview about Prompt Injection in our other blog, so in this one we’ll focus on the concept with the technical audience in mind. Here we’ll explore how LLMs can be vulnerable at the architectural level and the sophisticated ways attackers exploit them. We’ll also examine effective defenses, from system prompt design to “sandwich” prompting techniques. We’ll also discuss a few tools that can help […]

[ad_1] The rise of generative AI offers incredible opportunities for businesses. Large Language Models can automate customer service, generate insightful analytics, and accelerate content creation. But alongside these benefits comes a new category of security risk that business leaders must understand: Prompt Injection Attacks. In simple terms, a prompt injection is when someone feeds an AI model malicious or deceptive input that causes it to behave in an unintended, and often harmful way. This isn’t just a technical glitch, it’s a serious threat that can lead to brand embarrassment, data leaks, or compliance violations if not addressed. As organizations rush to adopt AI capabilities, ensuring the security of those AI systems is now a board-level concern. In this post we’ll provide a high-level overview of prompt injection risks, why they matter to your business, and how Security Innovation’s GenAI Penetration […]

[ad_1] With the advent of commercially available virtual reality headsets, such as the Meta Quest, the integration of virtual and augmented reality into our daily lives feels closer than ever before. As these devices become more common, so too will the need to secure and protect the data collected and stored by them. The intention of this blog post is to establish a baseline security testing environment for Meta Quest 2 applications and is split into three sections: Enabling Developer Mode, Establishing an Intercepting Proxy, and Injecting Frida Gadget. The Quest 2 runs on a modified version of the Android Open Source Project (AOSP) in addition to proprietary software developed by Meta, allowing the adoption of many established Android testing methods.   Enabling Developer Mode The first step of setting up a security testing environment on the Quest is to […]

[ad_1] As an IoT product manufacturer, building consumer trust in the security of your connected devices is critical for driving sales and staying competitive. Fortunately, the Federal Communications Commission (FCC) has introduced a new program to help - the US Cyber Trust Mark. The Cyber Trust Mark is a new voluntary labeling program that is obtained by demonstrating the cybersecurity of your IoT products. By earning this seal of approval, you can demonstrate to your customers that your devices meet rigorous security standards and can be trusted to protect their personal data and connected home. Retailers like Best Buy and Amazon will be collaborating with the FCC to educate consumers on this new program and increase public demand for the Cyber Trust Mark. But achieving the Cyber Trust Mark isn't a simple process. That's where Security Innovation, a Bureau Veritas […]

[ad_1] With the increasing cyber threats targeting operational technology (OT) environments, it's more important than ever to proactively assess and strengthen the security of your Industrial Control Systems (ICS). One of the most effective ways to do this is through an OT penetration test. What is an OT Penetration Test? An OT penetration test is a comprehensive security assessment that simulates real-world cyber-attacks against your ICS environment. Experienced security professionals, with deep expertise in both IT and OT systems, will attempt to gain unauthorized access and exploit vulnerabilities within your industrial control networks and devices. The team will provide you with a realistic understanding of your ICS security posture and the potential impact of a successful attack. The Benefits of OT Penetration Testing Uncover Hidden Vulnerabilities: Pen testers will identify vulnerabilities and misconfigurations that may have been overlooked by traditional […]

[ad_1] As the adoption of cloud computing continues to accelerate, cloud cybersecurity has become a top priority for security leaders. The benefits of moving to the cloud are clear: scalability, flexibility, and cost-savings. But the security challenges can be equally significant. CISOs must navigate a complex landscape of shared responsibility models, evolving threats, and rapidly changing compliance requirements. One of the key concerns today is the misconfiguration of cloud services, which can expose sensitive data and systems to unauthorized access. In fact, a Dark Reading report found that 65% of cloud security incidents are caused by customer misconfiguration, mismanagement, and mistakes. CISOs must ensure their teams have the necessary skills and processes in place to properly configure cloud infrastructure and maintain secure deployments. Another major challenge is the proliferation of cloud-based applications and the need to manage identities and access […]

[ad_1] In September 2023, the FDA's issued guidance on "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" which outlined critical recommendations for medical device manufacturers to ensure the security and safety of their products. This comprehensive guidance applies to a wide range of devices, including those with software functions, programmable logic, or connectivity capabilities. After nearly two years of helping Medical Device manufacturers work through this guidance, we thought it would be helpful to share some of the key points that comprise this guidance. One of the key principles emphasized in the guidance is that cybersecurity is an integral part of device safety and effectiveness and must be addressed throughout the total product lifecycle (TPLC). Manufacturers are expected to establish and maintain quality systems that account for cybersecurity risks, using processes such as a Secure Product […]

[ad_1] As large language models (LLMs) become increasingly prevalent in businesses and applications, the need for robust security measures has never been greater. An LLM, if not properly secured, can pose significant risks in terms of data breaches, model manipulation, and even regulatory compliance issues. This is where engaging an external security company becomes crucial. In this blog, we will explore the key considerations for companies looking to hire a security team to assess and secure their LLM-powered systems, as well as the specific tasks that should be undertaken at different stages of the LLM development lifecycle. Stage 0: Hosting Model (Physical vs Cloud) The choice of hosting model, whether physical or cloud-based, can have significant implications for the security of a large language model (LLM). Each approach comes with its own set of security considerations that must be carefully […]