This week’s Department of Know is hosted by Rich Stroffolino with guests Robb Dunewood, Host, Daily Tech News Show, and Howard Holton, CEO, GigaOm

Missed the live show? Check it out on YouTube

CISO Series The Department of Know  is live every Monday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com

Know or No?

Robb and Howard will discuss whether they think these stories are worth bringing to a team standup. Do you agree? Tell them what you think:

Google intros Private AI Compute

Google is launching Private AI Compute, a cloud platform that lets devices run advanced AI tasks while keeping data private. It’s similar to Apple’s Private Cloud Compute and moves intensive AI processing to the cloud without exposing sensitive information to Google. The system is meant to expand AI features on devices like Pixel 10 phones, enabling more personalized suggestions from tools like Magic Cue and supporting additional languages for Recorder transcriptions. Google frames it as a secure way to handle complex AI tasks beyond on-device capabilities. (The Verge)

SAP fixes hardcoded credentials flaw

SAP’s November patch cycle fixed two critical flaws, including a hardcoded credentials bug in the SQL Anywhere Monitor rated 10.0 severity, which could let attackers execute arbitrary code. Another critical issue in SAP Solution Manager let authenticated users inject malicious code and take full system control. SAP also patched one high- and 14 medium-severity bugs, plus reissued a NetWeaver fix from October. No active exploitation has been observed. (BleepingComputer)

UK cyber insurance claims triple

According to a new report from the Association of British Insurers, or ABI, UK insurers paid out over £197M for cyber insurance claims in 2024, up from £60 in 2023. Ransomware-related claims accounted for 51% of that total, up from 32% in 2023. ABI also reported that the number of cyber insurance policies in the UK increased by 17% on the year in 2024.

(FT, ABI)

China-backed hackers launch first large-scale autonomous AI cyberattack

In September, the threat actors used Claude Code AI from Anthropic to “automate and execute cyberattacks in a sophisticated espionage campaign.” They made use of its advanced “agentic” capabilities rather than using AI only for guidance and so allowed the attack to execute itself autonomously. Experts describe this as an unprecedented shift from AI as advisor to AI as operator. The attack targeted 30 global tech, finance, chemicals, and government organizations, and succeeded in a few cases.

(Security Affairs)

Five U.S. based individuals plead guilty to helping North Korean IT workers infiltrate 136 companies

The U.S. Department of Justice announced on Friday announced that these five individuals had pleaded guilty in violation of international sanctions. The counts were of wire fraud and conspiracy for knowingly allowing IT workers located outside of the U.S. to use their U.S. identities to secure jobs at American firms between September 2019 and November 2022. Three of these defendants had also served as facilitators, “hosting the company-issued laptops at their residences and installing remote desktop software so that the IT workers could give the impression that they were working remotely within the U.S. They also helped with passing employer vetting procedures, including appearing for drug testing on behalf of their North Korean clients. One of the defendants was an active-duty member of the U.S. Army.

(The Hacker News)

Huge thanks to our episode sponsor, KnowBe4

DEEP DIVE

Here we will spend some time talking in more depth about some of these stories. Join in the conversation on YouTube Live

CISA reauthorization/back to work

One of the impacts of the prolonged US government shutdown was the expiration of the 2015 Cybersecurity Information Sharing Act, or CISA, at the end of September. One provision in a deal to reopen the government, advancing through the Senate as of this recording, would reauthorize the law. However, this is only a temporary stay of execution, as that reauthorization would only go through January 30, 2026. The House Homeland Security Committee approved legislation in September that would extend CISA for the next decade. Two members of the Senate Homeland Security Committee introduced a similar bill, but a vote on it was blocked by the Committee’s chair, Senator Rand Paul, during the shutdown. 

(The Record)

Windows 11 supports 3rd-party passkey apps 

Microsoft’s November Windows 11 update adds native support for third-party passkey managers, starting with 1Password and Bitwarden, currently in beta. The update introduces a new passkey API developed with these companies to expand passwordless authentication options. Users can now store and manage passkeys through Windows Hello or supported apps, protected by Azure’s hardware security modules. Microsoft also integrated its own Password Manager from Edge directly into Windows. (BleepingComputer)

Denmark and Norway investigating electric bus “kill switches”

Earlier this month, the Norwegian bus operator Ruter investigated the connected capabilities of two bus models, one from the Dutch manufacturer VDL and the other by the Chinese firm Yutong. It found that, because of how Yutong buses receive over-the-air updates, the company “has direct digital access to each individual bus.” The company said it put in stricter controls for new vehicle purchases and will collaborate with local authorities on “clear cybersecurity requirements.” Danish public transport provider Movia also said it is investigating its Yutong buses for any issues. However, COO Jeppe Gaard clarified that this isn’t a “Chinese bus concern,” but rather something to account for with any connected vehicle. Yutong said all vehicle data in the region is stored in an EU-based AWS data center “protected by storage encryption and access control measures.” 

(NBC News, FT)