Dark Reading

In operational technology (OT) networking, the reliability and availability of industrial processes trumps everything, even cybersecurity. But what happens when an OT networking protocol designed to ensure speedy availability of safety-critical communications also embeds a security weakness into the architecture? Without a full slate of cyber controls folded in, that reliability mechanism could itself become a vehicle for the kinds of industrial failures it's supposed to help prevent.

Chip makers are baking post-quantum cryptography acceleration into hardware as the threat of quantum systems breaking current encryption rises. The technology is still years away from the general market, but defenders are concerned about harvest-now-decrypt-later attacks that could build up stores of data until quantum computing becomes more widely available to exploit it. Security professionals and regulators encourage organizations to begin future-proofing now, and some key players are acting.

The era of digital dependence is upon us, which means enterprises can’t simply extend existing capabilities into the digital realm – the digital realm has become the process, and everything in business revolves around it, including cybersecurity.

In early July, a cyberattacker reserved a look-alike domain impersonating a popular agentic AI work platform, Paperclip, and produced both Trojanized Python packages and weaponized AI skills to compromise users' machines and steal a variety of credentials and sensitive information.

OPINION A government agency I work with lost nearly a million dollars and never heard an alarm. No ransom note, no locked-up servers. Attackers slipped into a handful of staff email accounts, watched how the agency moved money for a couple of months, and then quietly rerouted a wire meant for an affordable-housing project. Nobody caught it until the money was already gone. This wasn't a federal department or a Fortune 500 company.

OpenAI has committed to a number of security and guardrail improvements in the wake of an incident last month where cutting edge models inadvertently breached AI application store Hugging Face during a cyber capability benchmark exercise. Yet many of the newly announced controls appear less like groundbreaking safeguards and more like measures that should already have been in place for testing models with advanced cyber capabilities.

Jake Williams told Dark Reading he felt compelled to act after OpenAI disclosed its models had breached Hugging Face. The cybersecurity expert and vice president of R&D at Hunter Strategies had been working on a new idea for a while and was in the midst of submitting it to conferences and shopping license agreements. He had developed a new framework called CUSTODY, which is designed to trap AI agents inside a network and keep them from causing mischief or even mayhem outside it.

Someone messed with the in-flight Wi-Fi system on a Delta Air Lines flight from Las Vegas following the Black Hat and DEF CON conferences earlier this month, and authorities aren't happy. In this episode of "What We Missed," Dark Reading's Rob Wright and Alex Culafi discuss some of the recent news events and topics that didn't make it into Dark Reading's publication slate this week.

OPINION A government agency I work with lost nearly a million dollars and never heard an alarm. No ransom note, no locked-up servers. Attackers slipped into a handful of staff email accounts, watched how the agency moved money for a couple of months, and then quietly rerouted a wire meant for an affordable-housing project. Nobody caught it until the money was already gone. This wasn't a federal department or a Fortune 500 company.

Malware silently spread through a Texas law enforcement system—hidden inside body camera footage that police uploaded to the department server and then shared with county officials, prosecutors, and defense attorneys. As the compromised video traveled through the chain of command, the danger of putting highly sensitive data at risk only grew.