About jforsythe

This blog was authored by Jesse Ralston, NetSec CTO, with contributing authors: Jaimin Patel, Dennis Payton, James Kline, Victor Aranda, Rich Campagna, Francesco Vigo Palo Alto Networks is collaborating with NVIDIA to deliver the first ever joint reference architecture for AI security with NVIDIA NIM. Enterprises can safely build and run intelligent automation (IA) technologies with a reference architecture that secures generative AI deployments built on NVIDIA NIM in enterprise environments with Palo Alto Networks AI Runtime Security technologies.    Generative AI is rapidly transforming modern enterprises, and existing comprehensive solutions around securing AI are in rapid flux and minimally deployed. Securing generative AI applications requires defense in depth as there’s no single point solution. This reference architecture represents a holistic approach to securing generative AI applications that aligns with and addresses many of the AI security risks defined by the Open Worldwide Application Security Project (OWASP).    Growth in adoption for generative AI across enterprises is exploding faster than any previous disruptive technology—faster than the internet, mobile phones, SaaS applications, and even the public cloud, which has enabled this explosion. There’s a critical lack of security tools available today that both recognize and understand generative AI applications, AI models, and internal enterprise data. Moreover, the lack of visibility into user interaction and brand-new threats associated with AI ecosystems adds to the complexity of securing enterprise AI.   As enterprises increasingly adopt intelligent automation (IA) technologies, such as those based on NVIDIA full-stack accelerated computing, to streamline operations and enhance productivity, the need for a robust security reference architecture becomes paramount. The convergence of AI, GenAI, machine learning, and robotic process automation presents unprecedented opportunities for business transformation and also introduces complex security challenges. A well-defined security reference architecture serves as a foundational framework to guide enterprises in implementing and maintaining a secure IA ecosystem.    Generative AI is transforming every industry. NVIDIA NIM inference microservices are foundational to quick enterprise deployments of generative AI across on-premises and public cloud infrastructure. Securing these environments will be critically important to safely secure enterprises as they adopt generative AI solutions and require the same speed of deployment as AI adoption.   “Enterprises are fast-tracking generative AI development with NVIDIA NIM to run state-of-the-art models at full performance,” said Justin Boitano, vice president, Enterprise Products, NVIDIA. “Monitoring NVIDIA NIM with Palo Alto’s generative AI firewall provides security teams visibility into prompts, data access patterns and responses to help protect modern generative AI applications.”   NVIDIA NIM is a collection of easy-to-use microservices for accelerating the deployment of generative AI. These are foundational to how enterprises deploy generative AI across a wide range of available generative AI models and infrastructures from public clouds to on-premises environments.   AI Runtime Security from Palo Alto Networks is purpose-built to discover, protect, and defend against enterprise AI and LLM vulnerabilities, exploits, and attacks. AI Runtime Security combines continuous runtime threat analysis of AI apps, models, and datasets with AI-powered security to stop attackers in their tracks.  Stop zero-day threats in zero time anywhere AI applications run.  Protect AI apps, models, and data from foundational threats and brand-new threats to AI ecosystems at runtime with no code changes Reject prompt injections, malicious responses, LLM denial-of-service, training data poisoning, malicious URLs, command and control, embedded unsafe URLs, and lateral threat movement    Palo Alto Networks NVIDIA NIM: First-Ever Reference Architecture for AI Runtime Security     Palo Alto Networks delivers a reference architecture for securing NVIDIA-powered generative AI deployments for the enterprise. A detailed design guide, “Securing generative AI Applications,” serves as a reference architecture that enables data scientists and developers to continue to innovate quickly as they further adopt intelligent automation (IA) technologies while also giving enterprises the oversight and control they need to do so securely.   This guide provides an architectural overview for using Palo Alto Networks AI Runtime Security with NIM, providing visibility, control, and protection to your generative AI applications operating in public clouds or private data center architectures. With this reference architecture, you’ll be able to:   Securely innovate and gain a competitive edge: Generative AI is a powerful driver of innovation, enabling the creation and delivery of solutions and directly contributing to competitive advantages. Its adoption can quickly transform a company’s offerings and position it as an industry pioneer and desirable employer, attracting customers and talent alike. Palo Alto Networks AI Runtime Security allows you to quickly innovate while keeping your organization and data secure. Customize for market relevance: Generative AI empowers businesses to tailor solutions that cater to industry-specific requirements. By training models on domain-specific data, companies can generate outputs that accurately reflect industry jargon and context, enhancing relevance and effectiveness. Deliver cost-efficiency and scalability: Although initial investments in generative AI might be considerable, the long-term reduction in operational expenses could be significant. By developing proprietary AI solutions, organizations can minimize dependencies on external AI service providers, resulting in cost savings and greater control over integration and scalability and with existing systems. Maintain performance: Control over model updates and data handling enables alignment with strategic objectives. By maintaining autonomy over AI systems, companies can robustly adjust and scale their AI capabilities in accordance with their strategic growth and operational needs. Secure data sovereignty and maintain IP ownership: In-house generative AI development allows for the retention of intellectual property rights and adherence to data governance standards. This is particularly critical in regulated industries where data privacy and protection are paramount.   Get started today with “Securing Your generative AI Applications” with this comprehensive holistic reference architecture. For more information, see the AI Runtime Security webpage.   ... View more

We have some exciting community news to share: Threat Vector, a Unit 42 podcast, is now on LIVEcommunity!   Threat Vector is your compass in the world of cyberthreats. Listen to this biweekly podcast to learn about unique threat intelligence, cutting-edge techniques, and real-world case studies. In each episode, you'll hear engaging discussions— with Unit 42’s threat intelligence experts, incident responders, proactive security consultants, and other industry luminaries — that equip you with the knowledge and insight to proactively prepare and stay ahead in the ever-evolving threat landscape.   The latest episode features a discussion between David Moulton, Threat Vector host, and Sam Rubin, VP and Global Head of Operations at Unit 42, about Sam's testimony to the US Congress on the multifaceted landscape of ransomware attacks, AI, and automation, and the need for more cybersecurity education. Listen now: Public Meets Private: Forging the Future of Cyber Defense Unpacking Congressional Testimony from Sam Rubin.    Subscribe to the Threat Vector page today to be alerted when new episodes are published!     ... View more

LIVEcommunity is thrilled to share a new feature: a reminder to log in or register to get the best community experience possible!   If you’re not logged in, you will notice a new prompt in the upper right corner of our site, guiding you to sign in or register to join our community.        By registering, you'll unlock a world of benefits, including the ability to: Access exclusive content about Palo Alto Networks products including timely advisories, new feature updates, product adoption guides, and more  Connect with more than 360,000 other members — IT and cybersecurity experts from around the world Subscribe to specific  areas so you never never miss an update or a post of importance or interest to you Engage with technical documentation, how-to videos, podcasts, webinars and more related to Palo Alto Networks products Personalize your community experience with the ability to customize your profile, settings and other community features   Register or sign in now to engage with Palo Alto Networks global online community today! Got a question about logging in or registering? Find answers here: LIVEcommunity Registration and Login Assistance. ... View more

UPDATE 11/8/23 11:43 a.m. EST: LIVEcommunity’s System Update will be delayed. This means your use of LIVEcommunity will not be impacted this week (11/8-9), and you can proceed with business as usual.   Thank you again for your patience and stay tuned for future updates.   Please don’t hesitate to reach out to the LIVEcommunity team if you have any questions: community@paloaltonetworks.com. ... View more

  Did you know that you can help your fellow community members by accepting solutions when a reply answers your question? Accepted solutions are a super-helpful resource in the community, and we want to make sure our members understand how this feature works!    Accepted solutions help build knowledge in LIVEcommunity. You can mark more than one reply as a solution on your post, making it easier for others to find and giving credit to all posts/posters who contributed to solving a problem or providing information. Accepting a solution is also a nice way to give a virtual high five to other community members for sharing their knowledge!   Why Do Accepted Solutions Matter?   By marking a reply as an Accepted Solution, you contribute to a treasure trove of knowledge. You're not only saying "Thank you!" to the helpful responders, but making it easier for others with a similar question.    Accepting solutions empowers others to discover valuable content without diving into lengthy discussions. Every time you accept a solution, you're helping surface that fix for other community members who might have the same query as you!   How Do I Accept a Solution?    It's simple! If a response to your discussion post helps solve your problem, simply click the "Accept As Solution " button next to the reply — or replies — that resolved your issue.    Discussions with Accepted Solutions have a green checkmark to the left of their title, making it easy for readers to spot; plus, discussions that have been solved show first in search results.      Now that you're equipped with the knowledge to embrace solutions, join the LIVEcommunity and unlock the true potential of shared wisdom! Let's achieve greatness, one solution at a time.   Thank you for being part of LIVEcommunity!   ... View more

This post was authored by Arik Day, a Palo Alto Networks Security Architect     Living Off the Land (LOTL) attacks are used by attackers to evade detection by the system's own native utilities, scripting languages, or trusted applications, rather than resorting to custom or malicious code that may raise suspicion. The use of native tools (Living Off the Land binaries, or LOLBins) also makes LOTL attacks far harder to detect via traditional detection methods.   Real world examples of how LOTL attacks are executed can be found in multiple threat research reports, like the Threat Brief: Ongoing Russia and Ukraine Cyber Activity published by Unit 42 that shows a usage of techniques that are documented in LOLBAS (Living Off the Land Binaries and Scripts) feed by WhisperGate Malware.   The report highlights the utilization of the LOLbin ‘wscript.exe’ to execute a VBS script, which in turn invokes PowerShell to establish a Windows Defender exclusion path. Wscript.exe is just one example of the many LOLbins documented in the LOLBAS feed.   The Importance of Early Detection: Preventing Damage from Living Off The Land Attacks   Since identifying LOTL attacks can be a highly complex task, these attacks can enable bad actors to persistently access systems, siphon off sensitive data, or move laterally within a network without drawing attention to themselves. To prevent data breaches and protect crucial assets, including intellectual property, personal information, and other sensitive data, from unauthorized access or exposure, it is imperative to have efficient methods in place to detect LOTL attacks.   What is the Living Off the Land Binaries and Scripts (LOLBAS) Project?   The LOLBAS project catalogs the binaries, scripts, and libraries of common operating systems that can be utilized for executing Living Off The Land techniques. Within the LOLBAS repository, all available LOLBins can be imported as tool type indicators into the Cortex XSOAR Threat Intelligence Management module (TIM) via the LOLBAS Feed Integration. Each LOLBin tool contains the following information:   LOLBin name MITRE ATT&CK reference to the relevant attack patterns LOLBin paths Detections - links to Sigma and YARA rules if they exist Commands - template of a malicious use of the tool   Fig 1: LOLBin tool indicator layout Fig 1: LOLBin tool indicator layout   Utilizing LOLBAS for Command-Line Analysis   The goal is to verify whether the provided LOLBin command line argument exhibits similarity to the known malicious patterns outlined in the LOLBAS repository. By comparing the given argument to the documented patterns of potentially harmful activities, we aim to identify any potentially malicious behavior associated with the LOLBin command. This analysis helps ensure the security and integrity of system operations by proactively detecting potential threats.   For example: Comparison between the following mshta.exe LOLBin command-line argument that is part of a security incident:   And the mshta.exe malicious argument pattern from LOLBAS:   Key Playbook Automations   StringSimilarity   The StringSimilarity automation uses the SequenceMatcher class that is part of Python’s difflib module to compare between strings and return similarity scores from 0 to 1(1 is identical). The automation outputs all of the strings that have a score equal or greater than a given threshold.   Fig 2: StringSimilarity automation Inputs   Fig 3: StringSimilarity output   Playbook - Search For Suspicious LOLBin Executions   The generic playbook “Command-line Analysis” is enhanced with the sub-playbook “Search For Suspicious LOLBin Executions”. The sub-playbook will execute the following steps:   Receive the relevant process names and process command-line arguments from its inputs Search if the Process image name exists in LOLBAS Feed Compare the provided command line arguments with the template of a malicious use in the tool from LOLBAS Feed If the similarity score is equal or greater than the given threshold, the provided command line argument will be set to the playbook outputs Finding suspicious LOLBin execution will affect the Command-Line Analysis playbook’s final verdict   Fig 4: Search for Suspicious LOLBin Executions playbook   Harnessing the power of LOLBAS for command-line analysis in conjunction with XSOAR provides a robust approach to enhancing security and detecting potential threats. LOLBAS serves as a valuable resource for documenting legitimate binaries and scripts that can be repurposed for Living Off The Land techniques. Integrating the LOLBAS feed into XSOAR's Threat Intelligence Management module allows for seamless ingestion of LOLBins as tool indicators, enabling efficient analysis and identification of suspicious command-line activities. By leveraging this combination of LOLBAS and XSOAR, organizations can strengthen their security posture and stay one step ahead of potential adversaries in the ever-evolving landscape of cybersecurity.   GLOSSARY Living Off the Land (LOTL): threat actors using legitimate system tools during an attack Living Off the Land binaries (LOLBins): The native tools used by threat actors in an attack. Living Off the Land Binaries and Scripts (LOLBAS): A catalog of the binaries, scripts, and libraries of common operating systems that can be utilized for executing Living Off The Land techniques.   ... View more

LIVEcommunity is pleased to announce the 2023-24 Cyber Elite Program!    Cyber Elite members are LIVEcommunity super-users and cybersecurity experts who are generous in sharing their insights and expertise to help others in LIVEcommunity.    Want to know how to tell who is a Cyber Elite expert? Look for the Cyber Elite trophy icon next to a username when interacting in LIVEcommunity forums.    Join Us in Welcoming Our 2023-24 Cyber Elite Experts!  ... View more

  LIVEcommunity is pleased to announce the 2023-24 Cyber Elite Program!    Palo Alto Networks launched the LIVEcommunity Cyber Elite program in summer 2020 as a way to recognize members from around the globe who demonstrate excellence in their participation and contributions to the community. The result is a small but robust team of super-users who are eager to help, supply solutions, and troubleshoot with their fellow cybersecurity professionals looking for answers in LIVEcommunity.    Want to know who's part of the Cyber Elite program? Just look for the Cyber Elite trophy icon next to a username when interacting in LIVEcommunity forums.     The Cyber Elite program has not only been a successful way to celebrate our most engaged and enthusiastic experts, but a path for encouraging interaction, information-sharing, and technical assistance among all LIVEcommunity members.    Your 2023-24 Cyber Elite Members   Please join us in welcoming the 2023-24 Cyber Elite members:    @aleksandar.astardzhiev  @SteveCantwell @OtakarKlier @MP18 @SutareMayur @BPry @Reaper @PavelK @TomYoung  @Raido_Rattameister (new!)   Thank you to these key members, whose contributions have been enumerated by the following stats from the past year:   1,280 Likes Received 2,918 Posts Published 513 Accepted Solutions   Our members are the heart and soul of LIVEcommunity, and we’re grateful to have our Cyber Elite experts onboard! Through the Cyber Elite program, the entire community is the beneficiary of their insightful technical expertise, content, and solutions — all of which help in daily problem-solving and the sharing of knowledge and valuable tips.    For more details about LIVEcommunity's Cyber Elite program and the expert members who help shape our community, visit the Cyber Elite program page.   Interested in Becoming a Cyber Elite Member? To begin your Cyber Elite journey, register in LIVEcommunity, share your knowledge and expertise, engage in discussions, provide answers, and help your peers in the community.    Thanks for being part of LIVEcommunity!   ... View more