Automation and AI in security

Issue 4 2021 Editor's Choice, Cyber Security, Commercial (Industry)

In 1988, a Cornell University graduate student named Robert Morris wanted to measure the size of the Internet. He wrote a program that could spread across a network, install itself on machines and then Morris would count the instances. From that, the now-infamous ‘Morris Worm’ unintentionally became one of the first known widespread cyberattacks, infecting over 6000 machines.

Pieter Du Preez.

In 2017, the Wannacry malware virus hit an estimated 1 million machines. According to a report cited by Statista, there were 305 million ransomware attacks in 2020, directed not by curious scholars but organised crime and malicious state actors. The scope and danger of such attacks have exploded in the past decade and show no sign of slowing down.

Fortunately, the cybersecurity industry has been hitting back and there is considerable excitement around automation and artificial intelligence in the field. Yet, those phrases can have broad meanings. So, if you are in the market for security solutions, what should you consider about automation and AI in security?

Greater than the sum of its parts

“I think there are two important things to know when you look at automation and artificial intelligence,” says Pieter Du Preez, head of managed detection and response at cybersecurity company Performanta. “First, it’s very important that the customer has an internal strategy for automation and AI. These can relate to both cybersecurity and other parts of the business and provide a benchmark for evaluating the security vendor.

“The second important consideration is not to get caught up in the specifics of the technologies. Instead, look into the provider’s processes and results. Do they study the client’s security posture, associate threat intelligence with it and incorporate that into automation?”

Such diligence is necessary because almost anyone can claim to use automation or AI. Says Du Preez: “You can apply broad definitions to either technology. This is very relevant in security, where the best results come from a combination of different integrated systems and services. You need to look at how they use AI and automation in a platform sense and not just through their services.”

It’s helpful to understand that automation and AI are sparking a cultural revolution in security. For example, a traditional security operations centre (SOC) would employ dozens of people, whereas one using automation ran using a handful of skilled staff. Similarly, the skills profiles of security professionals are changing, blending specialisation with a range of generalist abilities. So, if a cybersecurity provider claims to use automating technologies yet doesn’t reflect that in its operations, you can wonder if they are using those improvements to full effect.

“This is a common misunderstanding that I’ve seen among customers and security executives,” says Du Preez. “They will check your SOC employee numbers on LinkedIn and then ask how you expect to run operations with so few employees. But that is often the difference between proper use of AI and automation, and not.”

Determining value

As a purchaser of security services, you don’t need to care about automation and AI. Instead, ask a vendor a few key questions such as:

• What is your mean time to respond?

• What is your mean time to detect and is that faster than it was before?

• Can you demonstrate a considerable reduction in time and effort for things that used to be cumbersome and labour-intensive?

There are three areas of a security vendor that you should look at. Managed security services (MSS) must help a customer establish baseline process standards in place. These should address business goals and industry threats. Managed risk and governance focuses on the client’s risk posture and governance requirements, aligning the MSS to the client-specific industry and needs.

Finally, managed detection and response (MDR) is the muscle: endpoint detection and response (EDR), security information and event management (SIEM), security orchestration, automation and response (SOAR) and the SOC fall under MDR. MDR is also where the vendor will apply most of its automation and AI capabilities.

You need to question how they provide results. A vendor can provide examples of the playbooks that govern its machine-learning behaviour or demonstrate how its detection and response times have improved considerably.

Focus on the core platform, as it’s about how and where people apply automation. Du Preez says, “The automation and the integration around those elements is where you show your maturity in the security market. For example, show me your rules, what was pushed to the security platforms and how you use automation that is effective to me. How did your threat intelligence detect something faster than your competitor? That’s it, really.”

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Accelerating your Zero Trust journey in manufacturing
IT infrastructure Cyber Security Industrial (Industry)
Francois van Hirtum, CTO of Obscure Technologies, advises manufacturers on a strategic approach to safeguarding their businesses against cyber breaches.

Cyber resilience is more than cybersecurity
Technews Publishing Editor's Choice Cyber Security Integrated Solutions IT infrastructure
Hi-Tech Security Solutions held a round-table discussion focusing on cyber resilience and found that while the resilience discipline includes cybersecurity, it also goes much further.

Crossing the chasm
Editor's Choice News Security Services & Risk Management Training & Education
Industry reports suggest that in the next ten years, millions of jobs could go unfilled because there simply are not enough people to fill them.

Records in place now, not later
Editor's Choice Security Services & Risk Management
It is important, after an incident, to have records in place as soon as possible. Too often the matter is left for the day when the company is going to court, or a disciplinary hearing is scheduled.

A robust OT cybersecurity strategy
Editor's Choice Cyber Security IT infrastructure Industrial (Industry)
Cyber experts are still struggling to convince senior management to spend money to protect their control system assets, resulting in a lack of even basic measures to protect control systems.

Why Multi-Factor Authentication, universal ZTNA and Zero Trust matter
Access Control & Identity Management Cyber Security
Malicious cyber actors are experimenting with new attack vectors and increasing the frequency of zero-day and other attacks, according to Fortinet’s 1H 2022 FortiGuard Labs Threat Landscape report.

Simplifying SIEM, EDR, XDR and SOAR
Bitrate Editor's Choice Cyber Security
Jeroen Dubbelman unpacks what some of the latest acronyms used in the cybersecurity industry actually mean to businesses looking for solutions for their cyber requirements.

Securing IoT devices to maximise their value
IT infrastructure Cyber Security
Anything that is connected to the Internet is a potential security vulnerability, and IoT devices are increasingly targets through which cybercriminals infiltrate networks.

The rise of edge computing: What does it mean for cybersecurity?
IT infrastructure Cyber Security
Edge computing reduces response times, decreases bandwidth usage and maximises the real-time value of data for applications, processing or storage, by bringing it all closer to the source.

Ransomware loves retail
Retail (Industry) Cyber Security
The retail industry was the second most targeted industry by ransomware in 2021, with 77% of retail organisations hit with ransomware, a 75% rise from 2020.