Frontier
AI era
Security Frontline

An attack is meaningless if it doesn't reach its target.

The evolution of frontier AI is accelerating cyberattacks.
The increasing use of AI within companies necessitates greater governance control.
Especially now, when things are changing so rapidly thanks to AI,
It is important to "correctly understand the necessary measures and take appropriate action."

Watch on-demand videos

The evolution of frontier AI is accelerating cyberattacks.
The increasing use of AI within companies necessitates greater governance control.
Especially now, when things are changing so rapidly thanks to AI,
"Understand the necessary measures correctly and take appropriate action."
This is important.

Changes in Threat Trends

AI will accelerate cyberattacks.

The evolution of frontier AI allows attackers to discover vulnerabilities, explore entry points, and take post-intrusion actions much faster.

01 Accelerating vulnerability discovery

Cutting-edge AI is causing an explosive increase in previously undiscovered vulnerabilities.

02. Information leak due to vulnerability.

The misuse of AI is making attack methods more sophisticated, accelerating the leakage of information related to legitimate IDs.

03 Speeding up attacks after intrusion

The time it takes to move the attacker horizontally within the network after an intrusion, reach critical assets, and steal information has been accelerated.

Watch on-demand videos

Challenges faced by companies

Attacks are evolving with Frontier AI.
But I don't know where to start when it comes to strengthening security.

There are many targets for vulnerability countermeasures.
I don't know where to start.

Externally exposed assets, IDs, cloud, SaaS, VPN, etc.
The scope of what needs to be managed is expanding more than ever before.

I focused on the speed at which I would be attacked.
Rapid patch application is not possible.

Because measures must be taken with business impact in mind.
Applying the patch inevitably takes time.

There are many daily alerts.
We are likely to overlook important incidents.

Many security products are installed.
A large number of alerts can lead to delays in making decisions about what is important.

Including subsidiaries, bases, and factories
I don't know the security situation.

Subsidiaries, domestic bases, overseas bases, factories, etc.
There are many things that need to be managed, but it is difficult to grasp the current situation.

Flow of attack

Four steps in a cyberattack

An attack isn't a case of "it's over once they've infiltrated."
Since the attack progresses through multiple steps even after intrusion, stopping it at any point can prevent the attack from succeeding.

1. Intrusion

Externally disclosed asset leakage due to incorrect ID configuration

2. Horizontal movement

Internal exploration, lateral expansion, and privilege escalation

3. Reaching key assets

Active Directory core system administrator privileges

4. Encryption / Extortion

Data breach, data encryption, and data recovery hindrance.

Specific examples of countermeasures

Organize the necessary countermeasures for your company according to each phase of the attack.

There isn't just one point where you can stop the attack.
The important thing is to "clarify which phases should be prioritized for countermeasures within your own company's environment."

1. Intrusion

identification

Preventive security

CNAPP Cloud Protection
SSPM SaaS Configuration Management
ISPM ID configuration management
IASM Internal Asset Management
EASM External Asset Management

2. Horizontal movement

defense

Least privilege access control

IDaaS Authentication Platform
SASE Secure Access
E-Browser: A browser for businesses.
MSEG Network Isolation
UEM terminal management

3. Reaching key assets

Detection and response

Advanced detection and attack response

EDR Terminal Defense
NDR Network Defense
ITDR ID Defense
ESP email defense
SIEM Log Integration Analysis
AI-SOC Operation Efficiency Improvement/Automation

4. Encryption/Threat

restoration

Data recovery and encryption

Cloud storage
Data encryption
backup

Key points for countermeasures

We will consider countermeasures from three perspectives.

01 Prioritizing Vulnerabilities

We will narrow down the vast number of vulnerabilities discovered in our own environment to only those that are truly necessary and address them.

02 System operational load balancing

To minimize the scope of responsibility handled internally, we will increase the scope of external management.

03 Countermeasures assuming intrusion

By establishing multiple layers of defense, we can address the issue before it reaches critical assets while minimizing the impact on business operations.