GenAI Creativity Exercise: Beyond Mere Productivity

Slide1-1

“Focusing merely on productivity is akin to rearranging deck chairs on the Titanic; it’s a waste of time if we’re not steering towards true value creation. Simply doing something faster doesn’t equate to doing something more effectively or better. We must leverage technologies like GenAI to drive innovation, enhance efficiency, and transform our value creation processes and offerings.”

Senior management seems infatuated with leveraging Generative AI (GenAI) to improve productivity. While productivity improvements are “nice,” they don’t necessarily equate to better, more effective, or more relevant outcomes. Focusing your GenAI initiatives on improving productivity is missing the more significant economic opportunity: the opportunity to leverage GenAI and Artificial Intelligence (AI) in general to create new sources of customer, product, service, and operational value.

The empowering capabilities to leverage GenAI tools, such as OpenAI ChatGPT, to fuel the creativity and imagination necessary to drive creativity and innovation include (Figure 1):

  • Magnify Creative Problem Solving: ChatGPT can generate unique insights and solutions, helping teams think outside conventional frameworks and encouraging innovative problem exploration and problem-solving. For example, ChatGPT can assist in diagnosing complex medical cases by synthesizing patient data with the latest research, suggesting novel treatment approaches that were not immediately evident to practitioners.
  • Accelerating Idea Generation: By understanding and manipulating large datasets, ChatGPT facilitates rapid ideation processes, turning data into actionable and creative business ideas. For example, ChatGPT can analyze consumer feedback and market trends in the automotive industry to help manufacturers ideate new vehicle features that align with evolving consumer preferences.
  • Enhancing Decision Making: ChatGPT supports more informed and innovative decision-making by providing data-driven insights and predictions, enabling businesses to stay ahead in competitive markets. An example is finance, where ChatGPT can aid investment firms and wealth managers by analyzing vast amounts of market data to forecast trends and inform investment strategies that outpace average market returns.
  • Customizing User Experiences: ChatGPT can tailor interactions and services to individual user preferences, driving personalization to new heights and creating unique customer experiences. In e-commerce, ChatGPT can power chatbots that provide personalized shopping advice based on a user’s browsing history and purchase behavior, significantly improving customer satisfaction and loyalty.
  • Facilitating Continuous Learning and Improvement: Through its iterative learning capabilities, ChatGPT continuously evolves, adapting to new data and emerging trends, thereby perpetually enhancing its innovation potential. In education, ChatGPT can support personalized learning by adjusting content and pacing according to student performance and feedback, continuously improving educational outcomes.
Slide2-1

Figure 1: Unleashing Innovation with GenAI

GenAI Creativity Exercise

I decided to see just how creative ChatGPT could be. So, I posed ChatGPT the following challenge:

“Create an airplane structure to get passengers onto and off airplanes more quickly and comfortably. Think outside the box and explore novel ways to solve that challenge.”

ChatGPT came up with an impressive list of product and service features to address this challenge, including:

  • Dual-Level Boarding: Equip airplanes with entrances at both the front and rear and at multiple levels (upper and lower decks). This can reduce bottleneck effects at the door and speed up boarding and deboarding processes.
  • Slide-Deployable Entrances: Introduce slide-deployable, extendable bridges that connect the terminal directly to multiple airplane doors simultaneously, allowing passengers to board from various points.
  • Modular, Pre-Seated Passenger Modules: Develop detachable cabin modules where passengers can be pre-seated while waiting in the terminal. These modules would then be slotted into the airplane’s fuselage. This approach would minimize the time spent boarding and settling into onboard seats.
  • Rotating Seating Modules: On the plane, rotating seat modules can turn towards the aisle to make seating faster and easier, especially for window seats. Once passengers are seated, the modules rotate back into position.
  • Wider Interior Aisles: Design aisles to be temporarily expandable during boarding and deboarding, possibly by having retractable seats that can increase aisle width when needed.
  • Multiple Aisle Configurations: Implement two or even three aisles in larger aircraft to reduce the distance passengers need to travel to reach their seats.
  • Dynamic Seat Assignment: Use an AI-driven system to assign seats dynamically based on passenger check-in time. Group passengers in the same boarding area to minimize cross-aisle traffic and delays. This system can adapt in real-time to optimize the flow.
  • Efficiency-Driven Boarding Strategies: Develop algorithms that determine the most efficient boarding order based on current passenger data and seat configuration, potentially updating in real time as passengers check in.
  • Smart Overhead Bins: Implement overhead bins with automated packing solutions, where robotic systems scan and arrange bags to optimize space and reduce passengers’ time storing luggage.
  • Augmented Reality Passenger Guidance Systems: Equip the aircraft and terminals with AR (augmented reality) systems to guide passengers directly to their seats via the quickest route and inform them of bin space availability.
  • Personalized Boarding Assistance: Offer wearable tech or apps that send passengers personalized notifications about boarding times, gate changes, seat assignments, and directions for quick boarding.

I especially liked rotating seating modules (no longer have to salmon swim up the aisles), smart overhead bins (give you my carry-on bag as I enter the plane, and hand it back to me when I get off), and AR passenger guidance systems (think about how cool it would be to wear something like the Apple Vision Pro to help get you onto and off airplanes more quickly). Count me in!!

Then, I asked ChatGPT to draw an image of the aircraft that would support these innovative features.

Airplane-00

Figure 2: ChatGPT Original Designed Airplane to Accelerate Passenger Onboarding and Deplaning

YIKES!! I had to make a series of suggestions – such as creating an architecture that would actually fly – until ChatGPT finally came up with this design:

Airplane-01

Figure 3: ChatGPT Refined Designed Airplane to Accelerate Passenger Onboarding and Deplaning

This design is closer to reality without losing the sense of creativity and innovation. Although I would never fly in an airplane designed solely by ChatGPT, I would be eager to see how a team of airplane engineers, technicians, and architects could use ChatGPT to enhance their expertise and creativity to create an innovative aircraft design that helps me get on and off airplanes more quickly.

Summary

We have an excellent opportunity to use GenAI / AI to go beyond just improving productivity. While useful productivity may not always lead to more effective or relevant results. Instead, we should direct our GenAI / AI efforts toward promoting innovation and generating new sources of value in customer interactions, product development, services, and operational efficiencies.

For example, I worked with ChatGPT to explore new ways of designing an airplane structure that would make the boarding and deboarding processes more efficient. ChatGPT suggested several creative features, such as dual-level boarding, slide-deployable entrances, and modular pre-seated passenger modules to reduce bottlenecks and enhance efficiency. Although the initial designs were not optimal, our collaboration eventually led to something more practical. This demonstrates how AI-powered creativity can help reimagine traditional systems and structures in aviation, potentially transforming them for the better. It also shows the practical implications of AI-driven innovation in real-world scenarios.

Zoho’s Sridhar Vembu Joins Ola CEO Bhavish Aggarwal’s Rant Against LinkedIn and Microsoft’s ‘Wokeness’

Zoho chief Sridhar Vembu said that he agrees with the opinion of Ola chief Bhavish Aggarwal that India needs to resist the West’s woke imperialism.

“I agree with Bhavish. We in India have to strongly resist this woke imperialism – it is best understood as a fanatical religious doctrine that masquerades as a socio-political movement,” replied Vembu to Aggarwal’s lengthy post on X where he expressed his concerns about the dominance of Western companies in the tech industry and their impact on Indian society.

This comes after LinkedIn deleted Aggarwal’s post where he pointed out that the platform’s AI chatbot used wrong pronouns for him which Aggarwal referred to as ‘Pronoun Illness’

Aggarwal criticised the Western concept of “pronouns” and its imposition on Indian society. He expressed his concerns about the impact of Western social media platforms on Indian culture and the need for Indian tech companies to build their own platforms.

“The pronouns issue is a woke political ideology of entitlement that doesn’t belong in India,” Aggarwal wrote. “I wouldn’t have waded into this debate but clearly LinkedIn has presumed Indians need to have pronouns in our life, and that we can’t criticise it.”

Aggarwal took a strong stance against the Western concept of gender inclusivity, which he believes is being imposed on Indian society. “We don’t need lectures from Western companies on how to be inclusive,” Aggarwal wrote, saying Indian culture didn’t need pronouns to be inclusive for thousands of years.

Aggarwal also highlighted popular ride-hailing service’s efforts to promote diversity and inclusivity in the workplace. He noted that Ola has one of the largest women-only automotive plants in the country, with almost 5,000 women employees and plans to expand to tens of thousands in the coming years.

He argued that Indian culture has always been inclusive and respectful of all genders, citing the example of transgenders being accorded special respect in ancient Indian society.

Ola Plans to Stop Using Microsoft Azure

Furthermore, Aggarwal, announced that Ola has decided to move its entire workload out of Azure to their own Krutrim cloud within the next week.

“Since LinkedIn is owned by Microsoft and Ola is a big customer of Azure, we’ve decided to move our entire workload out of Azure to our own Krutrim cloud within the next week. It is a challenge as all developers know, but my team is so charged up about doing this,” wrote Aggarwal.

He further offered a full year of free cloud usage to any developer who wants to move out of Azure and wants to join Krutrim AI cloud.

Besides Vembu, Unacademy chief Gaurav Munjal also supported Aggarwal’s stance. “This is so fucked up on LinkedIn’s part,” replied Munjal.

“Indian civilization has a long history of inclusiveness regarding gender. However, the woke alphabet ideology promoting a pseudo-scientific view of gender is in conflict with both science and Indian ethos, “ wrote BJP leader Tejasvi Surya.

However, not all agreed.

“Does he think people who deploy and run companies’ cloud or work in AI are as stupid as consumers who buy two wheelers?” wrote Kissan AI founder Pratik Desai.

“Why does it sound like a pre-planned marketing campaign for launching Krutrim cloud? You can’t have these things done overnight for sure. Good way to grab attention, wrote another user on X.

The irony is that Aggarwal will need to buy GPUs to build Krutrim AI cloud, and it’s most likely that Intel (Western company) is providing that. Not to forget, Krutrim is currently using Databricks services to streamline data for its model, and as far as building models go, it is most likely using DBRX as well.

The post Zoho’s Sridhar Vembu Joins Ola CEO Bhavish Aggarwal’s Rant Against LinkedIn and Microsoft’s ‘Wokeness’ appeared first on Analytics India Magazine.

Chennai-Based Startup Behind First AI University Professor Launches Personal AI Home Studio

In what could potentially redefine the current use of personal AI assistants, a Chennai and Singapore-based start-up HaiVE will be launching HaiVE AI Studio this weekend.

Speaking to AIM ahead of its launch, HaiVE co-founder Arjun Reddy asked what if you had something similar to Plex but for AI? “Imagine being able to do that for AI. We have created a tool that you can install on your laptop or desktop. Once you are signed up and signed in, your home PC is the one running the AI server, so when you’re outside on your phone, you can question and talk to your own home AI server,” he said.

With GPUs becoming increasingly powerful, Reddy said that any laptop with a discrete GPU could run the server efficiently. “Because it is your own home server, you can throw in really sensitive information into it in the RAG folder that we give you,” he said.

Interestingly, HaiVE was also the startup behind Malar, the first-ever autonomous AI university professor in the world. Currently, the startup has plans to forge a partnership with the Mauritius government in allowing the use of Malar for all their university students.

HaiVE specialises in on-premise AI solutions, working with businesses and companies in order to help set up their own servers, without having to rely on cloud services. They’re also working with universities in India to help create digital twins of professors to help teach students even during off hours.

Taking that to the next level seemed like the logical thing to do, with Reddy describing the software as basically having your own J.A.R.V.I.S.

“Your medical records, your financial records, your electricity bills, etc. It’ll be able to look through all of that and it’ll be able to build a digital twin of your life,” he said, with future plans to install agents that can make phone calls on your behalf to fix plans or get updates.

“We have our own registry, a DDNS, where you can sign in, and open it up to the public or to these email IDs, whom you know as friends. So when they sign in with their email IDs, they will be shown your server as a list of service providers, and they can choose that and they can ask questions to it and your server will be the one doing the inference for them,” Reddy said.

HaiVE AI Studio will be launched this weekend at the Mauritius Emerging Tech Expo 2024.

The post Chennai-Based Startup Behind First AI University Professor Launches Personal AI Home Studio appeared first on Analytics India Magazine.

Top 10 AI Must-Know Coding Assistant Tools for Developers

Still stuck writing lines of code the old-fashioned way or fixing bugs solo? AI is changing how we code and tapping into the power of AI coding assistants can be a game-changer.

From offering savvy suggestions, automating mundane tasks, and supercharging your coding mojo, these 10 tools fueled by AI will help you level up!

Tabnine

Source: Tabnine

Tabnine is an AI-driven coding assistant that enhances developer productivity by quickly generating code, predicting subsequent lines, and offering smart completion suggestions.

It supports numerous programming languages and IDEs, including VS Code, IntelliJ, and Android Studio, making it highly versatile. Key features include generating code from prompts, autofilling classes and variables, recommending bug fixes, and creating documentation and test cases.

The tool is SOC-2 compliant, ensuring that it maintains code security within your existing environment. A standout feature is its customization to each user’s unique coding style, blending gen AI with personal patterns.

This enables it to predict and suggest context-specific code, streamlining repetitive tasks and enhancing code quality. Tabnine’s deep learning algorithms provide tailored suggestions across more than 20 programming languages including Python, Java, JavaScript, PHP, Go, and Rust among others.

It’s free to start, with a full-featured version available for $12 per month.

Codiga

Codiga provides real-time error checking and code analysis without disrupting existing code. It supports a wide array of programming languages including PHP, C++, Java, and Python and ensures high-quality software development.

Codiga offers a comprehensive report on code quality and can identify, analyze, and suggest fixes for various coding issues. It excels in auto-fixing codes and focuses heavily on security, making it ideal for managing complex codebases.

Its integration with popular development environments and support for over 12 programming languages, coupled with over 2000 analysis rules, including dependency scanning and security analysis, make Codiga a valuable tool for developers.

A free individual plan is available and a paid plan starts from $14 per month.

Replit

Replit, an AI-based online coding platform, facilitates collaborative coding and learning. Its standout feature, Ghostwriter, offers contextually relevant code suggestions, enhancing coding efficiency and readability.

Users can instantly start projects in any language and share them globally with ease. Ghostwriter streamlines coding tasks, from auto-completion to error detection, fostering learning within documents.

Replit’s AI assistance aids both beginners and experienced developers, speeding up coding processes. The tool can conduct multiple complex coding problems at a single time and also provides unlimited public replies.

It is free for individual use and subscription options include a Hacker plan priced at $7 per month and a Pro plan at $20 per month.

GitHub Copilot

GitHub Copilot is highly favored for its ability to write high-quality code using natural language prompts. It supports a broad range of programming languages including Python, JavaScript, C++, and TypeScript, and integrates seamlessly with popular IDEs like Visual Studio Code and JetBrains.

It not only automates boilerplate code but also provides suggestions for code completion, debugging, and spotting potential security risks. It’s particularly useful for learning new programming languages and enhancing productivity.

According to the Stack Overflow 2023 Survey, over 50% of developers prefer GitHub Copilot, and it is used by one in three Fortune 500 companies and over 50,000 businesses globally.

For individuals, pricing starts at $10 per month, while business plans begin at $19 per month. The tool has recently launched mobile versions for Android and iOS soon, which will further its accessibility and utility.

Whoa, GitHub just redefined software engineering.
GitHub Copilot Workspace just dropped and now you can idea, code, live demo in natural language.
Here's what you need to know (and how to sign up) 👇 pic.twitter.com/sf4t8RaL06

— Min Choi (@minchoi) April 30, 2024

AskCodi

AskCodi is a valuable AI coding assistant for developers, designed to streamline the coding process by eliminating unnecessary tasks and boosting productivity. It supports a range of programming languages, including JavaScript, MySQL, Kotlin, and C++, and is compatible with multiple IDEs like VS Code, PyCharm, and IntelliJ IDEA.

Powered by OpenAI Codex, AskCodi excels in generating code, answering programming queries, and providing code suggestions directly within your IDE.

The tool supports various natural languages such as English, Spanish, and German, and features a unique Codi WorkBook. This interactive environment is ideal for both beginners and experienced developers, offering functionalities like code generation, explanation, and documentation creation.

The membership pack costs $9.99 a month and is free for personal use.

Snyk

If your primary role in software development is to identify issues and vulnerabilities, Snyk is an excellent free AI tool for this purpose. It utilizes ML and various analytical techniques to detect problems in both human-written and AI-generated code.

The tool quickly scans code, identifies errors, and suggests fixes. It integrates into existing development tools and workflows, making security a seamless part of the development process. Snyk provides comprehensive security testing and real-time alerts to ensure that security issues are addressed promptly, thereby minimizing risks.

The platform supports multiple programming languages. Notably, even Google Cloud’s AI-powered developer assistant, Gemini Code Assist, relies on Snyk to ensure the generation of secure code.

It offers a free plan for individual developers and $25/month for the development teams.

Amazon CodeWhisperer

Amazon CodeWhisperer is a ML powered AI coding assistant that enhances developer productivity by generating high-quality code. It supports multiple IDEs and programming languages, offering real-time, comprehensive code suggestions.

The tool is particularly adept at identifying and suggesting fixes for bugs, ensuring code accuracy and security. CodeWhisperer’s integration with various development environments makes it a versatile choice for developers, especially those using AWS.

It promotes efficient, secure coding practices by leveraging a vast dataset of open-source code and providing up-to-date industry standard suggestions.

Recently, Amazon CodeWhisperer has transformed into ‘Q Developer’ with expanded functions and capabilities.

It is free for individuals and has a professional plan which starts from $19 per month.

Sourcegraph Cody

Sourcegraph Cody enhances workflow efficiency and understanding of code bases. It simplifies coding by generating precise codes from natural language prompts and streamlining complex coding tasks.

Cody offers features like bug detection, documentation generation, and code interpretation. It integrates with popular IDEs such as VS Code and JetBrains, providing real-time code completion and context-aware answers.

Ideal for both beginners and seasoned developers, Cody helps locate and understand code across repositories and branches efficiently, making coding less intimidating and more accessible.

It is free for individual use.

Today, I asked @SourcegraphCody to migrate the PySheets backend from Firestore to MongoDB. I was blown away with the result 🤯. pic.twitter.com/ZR9zKHWbtr

— Chris Laffra (@laffra) May 6, 2024

Codeium

Compatible with popular IDEs and supporting 20+ languages, Codeium, an AI-powered code completion tool, simplifies navigation through unfamiliar codebases, sparing developers from intricate syntax details.

Key features include seamless integration with preferred environments, effortless navigation of complex codebases, and enhanced coding speed and accessibility.

It is free for individual users and $12 per month for teams.

WP Code

WPCode simplifies code injection into WordPress headers and footers. It’s grown from a snippet tool to a Google Tag Manager alternative, with free and pro versions. The pro version tracks changes and creators, aiding accountability and recovery.

Features include easy snippet insertion, AI-driven code generation, and tailored WordPress snippets. It’s user-friendly for beginners and developers, offering a hassle-free way to implement code without complex theme file edits.

The post Top 10 AI Must-Know Coding Assistant Tools for Developers appeared first on Analytics India Magazine.

Sam Altman Proposes ‘Universal Basic Compute’ for Global Access to GPT-7’s Resources

Sam Altman recently proposed ‘Universal Basic Compute,’ in which everyone would have access to a portion of GPT-7’s computing resources.

“I wonder if the future looks something more like Universal Basic Compute than Universal Basic Income, and everybody gets like a slice of GPT-7 compute,” said Altman, in the recent episode of the All-in podcast.

He said that this would not be in the form of money but as a share of productivity that could be used, sold, or even donated for initiatives like cancer research, etc.

Altman said that they began exploring Universal Basic Income (UBI) around 2016. “About the same time, we started taking AI really seriously,” he added, considering the potential changes AI might bring to society, employment, the economy, and even social contract.

“I am not like a super fan of how the government has handled most policies designed to help poor people, and I kind of believe that if you could just give people money they would make good decisions, and the market would do its thing,” reminisced Altman, saying that he is pretty much in favour of lifting up the poor and eliminating poverty.

He believes that the existing social safety net is broken. “Giving people money is not going to solve all the problems. It is certainly not going to make people happy. But it might solve some problems. It might give people a better horizon with which to help themselves,” said Altman, adding that things are now changing and there should be better things to do than traditional UBI.

This new development also comes in the backdrop of Altman’s controversial statement: “I don’t care if we burn 50 billion a year, we’re building AGI.”

“Whether we burn $500 million, $5 billion, or $50 billion a year, I don’t care. I genuinely don’t as long as we can stay on a trajectory where eventually we create way more value for society than that and as long as we can figure out a way to pay the bills,” he said.

Meanwhile, OpenAI is gearing up to make some major announcements next week. “Not GPT-5, not a search engine, but we’ve been hard at work on some new stuff we think people will love! Feels like magic to me,” said Altman.

Sources reveal that it is likely to release an AI voice assistant that enables a human-like interaction with better logical reasoning capabilities and reduced latency, mostly powered by GPT-4-Lite, GPT-4-Auto, and GPT-4-Lite-Auto.

The post Sam Altman Proposes ‘Universal Basic Compute’ for Global Access to GPT-7’s Resources appeared first on Analytics India Magazine.

Anthropic now lets kids use its AI tech — within limits

AI startup Anthropic is changing its policies to allow minors to use its generative AI systems — in certain circumstances, at least. Announced in a post on the company’s official blog Friday, Anthropic will begin letting teens and preteens use third-party apps (but not its own apps, necessarily) powered by its AI models so long […]

© 2024 TechCrunch. All rights reserved. For personal use only.

How Can Businesses Defend Themselves Against Common Cyberthreats?

Today, all businesses are at risk of cyberattack, and that risk is constantly growing. Digital transformations are resulting in more sensitive and valuable data being moved onto online systems capable of exploitation, thus increasing the profitability of a successful breach.

Furthermore, launching a cyberattack is becoming more accessible. Exploit kits and malware-as-a-service offerings are getting cheaper, while open-source AI tools are making masquerading as a trusted executive and exploiting vulnerabilities easier.

TechRepublic consolidated expert advice on how businesses can defend themselves against the most common cyber threats, which are:

  • Social engineering attacks.
  • Zero-day exploits.
  • Ransomware attacks and data theft.
  • IoT attacks.
  • Supply chain attacks.
  • AI deepfakes.

Social engineering attacks

What are they?

Social engineering is an umbrella term for some of the most common types of cyberattacks, all of which involve some form of human manipulation to obtain information about an organization or network. Social engineering attacks include, but are not limited to:

  • Phishing: Attackers impersonate legitimate entities to deceive individuals into giving up confidential information, like log-in credentials. Most often, this is in the form of an email, but it can be done over the phone (vishing) or text (smishing).
  • Baiting: The attacker leaves a physical device, like a USB stick or CD, containing malware in a public place in the hopes that someone will pick it up and use it, thus compromising their system.
  • Whaling: A more personalized version of phishing that usually targets a single, high-ranking individual.
  • Business email compromise: A targeted cyberattack where attackers impersonate a trustworthy executive via a compromised email account and deceive employees into transferring money or revealing sensitive information.

SEE: 6 Persuasion Tactics Used in Social Engineering Attacks

What are the most common attack entry points?

While social engineering attacks can be instigated through emails, phone calls and USB sticks, they all have one attack entry point in common: humans.

How can businesses protect themselves?

  • Educate personnel about social engineering techniques and how to spot them. It is recommended to never open a document or click on a link that seems suspicious, and to alert IT of anything suspicious. Employees should also be informed about the dangers of sharing too much personal information publicly online, as social engineering attacks often rely on gathering details from public sources.
  • Install an anti-spam filter and anti-virus software. Email content should be analyzed by security solutions capable of detecting anomalies instead of only URLs or attached files.
  • Leverage multifactor authentication and password policies that require employees to regularly update them.
  • Consider hiring a security firm to conduct a social engineering audit to identify vulnerabilities and strengthen defences against potential attacks.

Zero-day exploits

What are they?

TechRepublic contributing writer Kihara Kimachia defined zero-day exploits as:

“Zero-day exploits are code vulnerabilities and loopholes that are unknown to software vendors, security researchers and the public. The term ‘zero day’ originates from the time remaining for a software vendor to patch buggy code. With zero days — or zero hours — to respond, developers are vulnerable to attack and have no time to patch the code and block the hole. One bug can give hackers enough access to explore and map internal networks, exfiltrate valuable data and find other attack vectors.”

SEE: Zero-Day Exploits Cheat Sheet: Definition, Examples & How It Works

Zero-day attacks could be on the rise thanks to the growing accessibility of large language models. Such models can be used to speed up the search for vulnerabilities and help conduct convincing social engineering attacks.

What are the most common attack entry points?

Potential attack entry points for zero-day vulnerabilities are the same as known and patched vulnerabilities — any way an attacker can exploit the weaknesses in software or hardware systems. These common attack entry points include:

  • Email attachments that exploit vulnerabilities in software when opened. These attachments can arrive in a victim’s inbox as part of a social engineering attack.
  • Compromised websites that trigger the automatic download of malware onto a visitor’s device.
  • Software or hardware that has had a vulnerability exploited directly by a threat actor through injecting malicious code.

How can businesses protect themselves?

Kimachia offered the following advice for protection against zero-day exploits:

  • Keep software up to date as patches are released to fix known vulnerabilities. However, it’s important to be cautious when updating from unverified sources.
  • Install intrusion detection systems that can detect unusual patterns or behaviours in networks, which helps in identifying zero-day exploits.
  • Implement endpoint security solutions that offer real-time monitoring and protection against both known and unknown threats.
  • Stay informed by subscribing to threat intelligence services that provide real-time information about vulnerabilities and exploits.
  • Develop an incident response plan so security teams can act quickly and cohesively to mitigate the damage caused by a zero-day exploit.
  • Behavioral analytics tools can identify any unusual user or system behaviour that could indicate the presence of a zero-day exploit.
  • Conduct regular security audits using a security risk assessment checklist to proactively identify any vulnerabilities in your network and applications.
  • Never use a ‘.0’ release of software to keep your organization safe from any undiscovered zero-day vulnerabilities in the first iteration.

Ransomware attacks and data theft

What are they?

Ransomware is malware, according to TechRepublic’s ransomware cheat sheet. The hackers demand payment, often via Bitcoin or prepaid credit card, from victims in order to regain access to an infected device and the data stored on it.

Recent research found that, alongside financial implications, ransomware’s impact could include heart attacks, strokes and PTSD.

A ransomware attack is a form of data theft attack, and encrypting is not the only thing that attackers can do when they successfully obtain access to the data. They could also leak the information online or sell it to competitors or other cybercriminals, leading to reputational and financial damage.

What are the most common attack entry points?

  • Vulnerabilities in enterprise software and applications that connect to the internet can allow bad actors to gain unauthorised access to an organization’s environment and steal or encrypt sensitive data.
  • Similarly, compromised websites can contain malware that scans connected devices for vulnerabilities. If one is found, malware can automatically be downloaded onto the device that provides the attacker with remote access to the system and, therefore, data.
  • Employees, via social engineering attacks, are another common attack vector. Attackers can gain access after a worker opens a link or download from a phishing email masquerading as legitimate communication. Those who feel wronged by their employer or made a deal with cybercriminals may also intentionally install ransomware.
  • Weak log-in credentials can be exploited via brute force credential attacks. Such attacks involve the bad actor inputting a series of typical username and passwords until a correct login is discovered and they can begin the ransomware attack.
  • Previously compromised credentials that have been leaked on the dark web without the owner’s knowledge can offer access to the organization’s system. Often, one set of correct credentials can unlock multiple areas of the environment, as it is common for staff to reuse passwords so they are easy to remember.

SEE: Brute Force and Dictionary Attacks: A Guide for IT Leaders (TechRepublic Premium)

How can businesses protect themselves?

Threat intelligence provider Check Point Research provides the following advice to protect organizations and assets from ransomware:

  • Back up all company data regularly to mitigate the potential impacts of a ransomware attack. If something goes wrong, you should be able to quickly and easily revert to a recent backup.
  • Keep software updated with the latest security patches to prevent attackers exploiting known vulnerabilities to gain access to the company system. Legacy devices running unsupported operating systems should be removed from the network.
  • Leverage an automated threat detection system to identify the early warning signs of a ransomware attack and give the company time to respond.
  • Install anti-ransomware solutions that monitor programs running on a computer for suspicious behaviours commonly exhibited by ransomware. If these behaviours are detected, the program can stop any encryption before further damage is done.
  • Implement multifactor authentication as it prevents criminals who discover an employee’s log-in credentials from accessing the organization’s system. Phishing-resistant MFA techniques, like smartcards and FIDO security keys, are even better as mobile devices can also be compromised.
  • Use the principle of least privilege, which means employees should only have access to the data and systems essential for their role. This limits the access of cybercriminals should an employee’s account become compromised, minimizing the damage they could do.
  • Scan and monitor emails and files on an ongoing basis, and consider deploying an automated email security solution to block malicious emails from reaching users that could lead to ransomware or data theft.
  • Train employees on good cyber hygiene to help minimize the risks of the inevitable human attack vector. Cyber training equips the team with the ability to recognize phishing attempts, preventing attackers from ever being able to deploy ransomware.
  • Do not pay the ransom if a business does fall victim to ransomware. Cyber authorities advise this because there is no guarantee the attacker will be true to their word, and the remuneration will encourage future attacks.
  • Refer to the No More Ransom project. This is a collaboration between Europol, the Dutch National Police, Kaspersky Lab and McAfee that provides victims of a ransomware infection with decryption tools to remove ransomware for more than 80 variants of widespread ransomware types, including GandCrab, Popcorn Time, LambdaLocker, Jaff, CoinVault and many others.

IoT attacks

What are they?

Since the COVID-19 pandemic, IoT devices have become more commonplace in organizations to support new remote working policies. While this is a positive step, these devices do not typically have the same level of security as more sophisticated hardware, making them an increasingly popular entry point for cyberattackers.

SEE: Securing IoT with Microsoft Defender for IoT Sensors

The weak security of IoT devices is targeted in many different ways by cyber criminals. For example, they can use them as an entry point to deploy ransomware on the device or wider network, or even control the device to sabotage business processes.

Furthermore, IoT botnet attacks involve an entire network of connected devices being compromised by a single “botmaster” and used to carry out coordinated attacks often without the device owners’ knowledge. Examples of botnet attacks include distributed denial-of-service (DDoS) attacks on a target server or website, data theft by intercepting transmissions over the network and malware distribution. A botnet attack can also leverage “living off the land” techniques, which are the use of legitimate, pre-installed tools and software within the IoT device to help evade detection.

What are the most common attack entry points?

  • Existing software vulnerabilities in a device can be exploited by cybercriminals to gain access to an IoT device or network. These vulnerabilities might be prevalent due to poor security practices, lack of updates or outdated software.
  • Many organizations lock their IoT devices using default or weak credentials, which can be easily guessed by an attacker through a brute force credential attack.
  • Employees might provide an IoT device’s log-in credentials or download IoT-targeting malware as part of a wider social engineering attack.
  • If IoT devices are not kept physically secure, then attackers might tamper with the hardware by altering settings or connecting malicious devices. Attackers might be intruders but could also be existing employees or contractors with access.
  • All the above entry points could be present at the device’s supplier or manufacturer, meaning it could be compromised even before deployment.

SEE: Study Reveals Most Vulnerable IoT, Connected Assets

How can businesses protect themselves?

The following advice is from Brian Contos, a security expert with Phosphorus and Sevco, senior threat expert at Trend Micro and TechRepublic contributing writer Cedric Pernet and TechRepublic reporter Megan Crouse.

  • Maintain an updated inventory of IoT devices to ensure comprehensive knowledge of all the devices that need protection.
  • Ensure IoT devices have strong, unique passwords that are rotated regularly to prevent successful brute force credential attacks.
  • Keep IoT devices updated with the latest firmware and security patches, and replace legacy devices with modern versions that support better security practices.
  • Harden IoT devices by disabling unnecessary ports and connectivity features.
  • Limit IoT devices’ communication outside the network using network firewalls, access control lists and VLANs.
  • Validate and manage IoT digital certificates to mitigate risks such as TLS versions and expiration dates.
  • Monitor for suspicious changes in IoT devices, such as default password resets or insecure services being reactivated.
  • Implement mobile security solutions and train employees to detect compromise attempts on their mobile devices.
  • Advise employees to avoid storing sensitive data on mobile phones and power off devices during sensitive meetings.
  • Enable logging for application, access and security events and implement endpoint protection and proactive defences like SIEM tools and security orchestration solutions.
  • Implement phishing-resistant multifactor authentication to prevent access for cybercriminals with correct log-in information.

Supply chain attacks

What are they?

Supply chain attacks are when a cybercriminal targets an organization by compromising a less-secure vendor of software, hardware or services in its supply chain. Historically, supply chain attacks occurred when an attacker infiltrated a trusted supplier that had been granted access to the victim’s data or network to do their job; however, now software supply chain attacks — where the attacker manipulates software that is distributed to many end user organisations — are actually more common. Once a business uses the compromised software, they become vulnerable to data theft, ransomware and other attack types.

Bad actors use a variety of techniques to access and manipulate the code behind commercial software products. They may deploy malicious updates after compromising the account of one of its developers or exploiting a vulnerability in its download location. Alternatively, attackers might amend code stored in a software library used by developers for hundreds of different products.

SEE: BBC, British Airways, Boots Hit With Hackers’ Ultimatum After Suffering MOVEit Supply-Chain Attack

Sometimes, the bad actor might build a trusted relationship with legitimate developers of enterprise software and become one of the maintainers of their tool, allowing them to slowly push different vulnerable parts of code into the software without being noticed. This is how a backdoor was implemented into the XZ Utils data compressor in 2024.

What are the most common attack entry points?

To execute a supply chain attack, attackers first need to gain access to a crucial part of a target organization’s supply chain. There are a number of potential targets, all of which are susceptible to social engineering campaigns, using weak log-in credentials, unintentionally downloading malware through a compromised website and having vulnerabilities in their digital systems. Some common entry points are:

  • Third-party software providers, as attackers could directly amend the product’s code before it is downloaded by the target firm or manipulate its update mechanisms.
  • Third-party service providers that may have been granted access to the target company’s system and have weaker security.
  • Third-party hardware providers, as attackers can tamper with hardware or physical components during manufacturing or distribution if they gain access to their facility.
  • Open-source or private code repositories used by enterprise software developers. Attackers can use this as a way of deploying malicious code into hundreds of different software products used by even more companies.

How can businesses protect themselves?

The following advice is from Kurt Hansen, the CEO of cybersecurity firm Tesserent, senior threat expert Cedric Pernet and TechRepublic contributing writer Franklin Okeke.

  • Conduct an audit to understand all business activities’ third-party involvement, as there are often different suppliers to different parts of an organization.
  • Follow a documented governance process for third parties that includes accreditations, whether they are doing assessments and if they are outsourcing themselves. Ensure contracts include outlines of requirements, data protection obligations and consequences for non-compliance.
  • Remain aware of developing geopolitical tensions and consider if they are putting the supply chain at risk.
  • Review new software updates before deploying them by looking at code differences between the old and new code.
  • Implement a zero-trust architecture, where every connection request must meet a set of rigorous policies before being granted access to organizational resources.
  • Deploy honeytokens, which mimic valuable data. Once attackers interact with these decoy resources, an alert is triggered, notifying the targeted organization of the attempted breach.
  • Conduct regular third-party risk assessments. This helps to expose each vendor’s security posture, providing further information on vulnerabilities that should be remediated.
  • Automate third-party attack surface monitoring.

AI deepfakes

What are they?

AI deepfakes are being increasingly exploited as part of cyberattacks. Bad actors can more easily impersonate trusted individuals to evade security controls and gain access to an organization’s environment.

The barrier to entry has also been lowered significantly in recent months, as AI tools are both easy and cheap to use. Research by Onfido revealed the number of deepfake fraud attempts increased by 3,000% in 2023, with cheap face-swapping apps proving the most popular tool.

SEE: Prompt Hacking, Private GPTs, Zero-Day Exploits and Deepfakes: Report Reveals the Impact of AI on Cyber Security Landscape

There are a number of impacts a deepfake attack could have on an organization. Incidences of financial fraud have been reported on multiple occasions where a scammer has impersonated an executive using a deepfake and convinced an employee to transfer money to them. In addition, deepfakes could be used to convince others of false events, such as a staffing change, which impacts an organization’s stock price. The sharing of deepfake content featuring staff could also have serious consequences, damaging a business’s employee experience and reputation.

What are the most common attack entry points?

  • Email. In 2022, it was the top delivery method used to distribute deepfake content.
  • Video and phone calls can be made using sophisticated technology to impersonate a trusted executive’s voice and likeness. The deepfake could be a recorded message or hold a conversation in real time.
  • Authentication methods based on voice or facial recognition can be tricked using deepfake content of authorised employees.
  • Attackers, or even disgruntled employees, may choose to create a compromising deepfake and share it on social media to damage the company’s reputation or influence their stock.

How can businesses protect themselves?

The following advice was provided by Robert Huber, the chief security officer at cybersecurity firm Tenable, and Rahm Rajaram, the former VP of operations and data at financial services firm EBANX.

  • Make the risks associated with AI deepfakes a part of regular risk assessment procedures, including evaluating internal content as well as that from third parties.
  • Be aware of the common indicators of deepfake content, like inconsistent lighting or shadows, distortion at the edge of the face, lack of negative expressions and lip movement not correlating with audio. Consider educating staff in this area.
  • Implement phishing-resistant MFA to prevent the attacker’s access even if their deepfake campaign results in them acquiring log-in credentials. Consider requiring such verification for large wire transfers and not relying on facial recognition.
  • Look out for data breaches that expose customers’ credentials and flag these accounts to watch for potential fraud.
  • Maintain cybersecurity best practices to eliminate the risk of phishing attacks of all types, including those involving deepfakes.

More cyber security resources

Improve your organisation’s cyber security with these resources from TechRepublic Academy:

  • The Complete 2024 CompTIA Cyber Security Certification Training Bundle
  • The 2024 Cybersecurity Mastermind Training Bundle
  • The Ultimate Cybersecurity & IT Career Certification Pathway Training Bundle

Bumble Soon to Introduce AI Concierge for Discussing Insecurities and Breakups

"In the future, your AI will date other people's AI," says Bumble CEO

In a recent interview at the Bloomberg Technology Summit in San Francisco, Whitney Wolfe Herd, the founder and executive chair of Bumble, emphasised the company’s commitment to leveraging AI to cultivate healthier and more equitable relationships.

“Our focus with AI is to foster healthier, more equitable relationships, beginning with self-improvement. For example, in the near future, you might be able to consult an AI dating concierge about your insecurities, such as recent breakups or commitment issues, and receive guidance on improving your self-perception and communication skills.”

“If you want to get really out there. There is a world where your dating concierge could go and date for you with other dating concierges,” Herd said.

However, the Bumble Founder acknowledged the dual nature of AI’s impact on relationships. While it can potentially assist users in flirting and crafting engaging messages, there are concerns about individuals forming attachments to AI-driven personas or encountering deceptive practices.

A recent incident shared by a woman in Bengaluru underscored these concerns, where she recounted being impressed by a date who might have used AI during their conversation. But she realised he was a ‘dull man’ when interacting in person.

Herd highlighted the potential for AI concierges to facilitate matchmaking by interacting with counterparts to identify highly compatible matches, underscoring the alignment of AI with Bumble’s values.

“Envision a scenario where your AI concierge assists you and interacts with other dating concierges to streamline your dating process, narrowing down potential matches to the most compatible few. This illustrates the potential of AI when aligned with our core values,” Bumble Founder explained.

Interestingly, a shift is underway among Gen Z and millennials, who increasingly incorporate AI into their dating lives. According to a report by Cosmopolitan magazine and dating app Bumble, over three-quarters of millennials and 81% of Gen Z are open to using AI bots to spice up their flirting game on dating apps.

Looking ahead, Bumble aims to be the go-to platform for individuals seeking meaningful connections that align with their experiences and aspirations.

The post Bumble Soon to Introduce AI Concierge for Discussing Insecurities and Breakups appeared first on Analytics India Magazine.