Automation and AI in security

Issue 4 2021 Editor's Choice, Cyber Security, Commercial (Industry)

In 1988, a Cornell University graduate student named Robert Morris wanted to measure the size of the Internet. He wrote a program that could spread across a network, install itself on machines and then Morris would count the instances. From that, the now-infamous ‘Morris Worm’ unintentionally became one of the first known widespread cyberattacks, infecting over 6000 machines.

Pieter Du Preez.

In 2017, the Wannacry malware virus hit an estimated 1 million machines. According to a report cited by Statista, there were 305 million ransomware attacks in 2020, directed not by curious scholars but organised crime and malicious state actors. The scope and danger of such attacks have exploded in the past decade and show no sign of slowing down.

Fortunately, the cybersecurity industry has been hitting back and there is considerable excitement around automation and artificial intelligence in the field. Yet, those phrases can have broad meanings. So, if you are in the market for security solutions, what should you consider about automation and AI in security?

Greater than the sum of its parts

“I think there are two important things to know when you look at automation and artificial intelligence,” says Pieter Du Preez, head of managed detection and response at cybersecurity company Performanta. “First, it’s very important that the customer has an internal strategy for automation and AI. These can relate to both cybersecurity and other parts of the business and provide a benchmark for evaluating the security vendor.

“The second important consideration is not to get caught up in the specifics of the technologies. Instead, look into the provider’s processes and results. Do they study the client’s security posture, associate threat intelligence with it and incorporate that into automation?”

Such diligence is necessary because almost anyone can claim to use automation or AI. Says Du Preez: “You can apply broad definitions to either technology. This is very relevant in security, where the best results come from a combination of different integrated systems and services. You need to look at how they use AI and automation in a platform sense and not just through their services.”

It’s helpful to understand that automation and AI are sparking a cultural revolution in security. For example, a traditional security operations centre (SOC) would employ dozens of people, whereas one using automation ran using a handful of skilled staff. Similarly, the skills profiles of security professionals are changing, blending specialisation with a range of generalist abilities. So, if a cybersecurity provider claims to use automating technologies yet doesn’t reflect that in its operations, you can wonder if they are using those improvements to full effect.

“This is a common misunderstanding that I’ve seen among customers and security executives,” says Du Preez. “They will check your SOC employee numbers on LinkedIn and then ask how you expect to run operations with so few employees. But that is often the difference between proper use of AI and automation, and not.”

Determining value

As a purchaser of security services, you don’t need to care about automation and AI. Instead, ask a vendor a few key questions such as:

• What is your mean time to respond?

• What is your mean time to detect and is that faster than it was before?

• Can you demonstrate a considerable reduction in time and effort for things that used to be cumbersome and labour-intensive?

There are three areas of a security vendor that you should look at. Managed security services (MSS) must help a customer establish baseline process standards in place. These should address business goals and industry threats. Managed risk and governance focuses on the client’s risk posture and governance requirements, aligning the MSS to the client-specific industry and needs.

Finally, managed detection and response (MDR) is the muscle: endpoint detection and response (EDR), security information and event management (SIEM), security orchestration, automation and response (SOAR) and the SOC fall under MDR. MDR is also where the vendor will apply most of its automation and AI capabilities.

You need to question how they provide results. A vendor can provide examples of the playbooks that govern its machine-learning behaviour or demonstrate how its detection and response times have improved considerably.

Focus on the core platform, as it’s about how and where people apply automation. Du Preez says, “The automation and the integration around those elements is where you show your maturity in the security market. For example, show me your rules, what was pushed to the security platforms and how you use automation that is effective to me. How did your threat intelligence detect something faster than your competitor? That’s it, really.”

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Revamping Liberty Life’s reception area
Turnstar Systems Access Control & Identity Management Commercial (Industry)
Turnstar supplied and installed four Speedgate Express lanes, each 550 mm wide, as well as two Pulse Special Needs Gates for wheelchair access to Liberty Life.

Hikvision aims for solutions
Technews Publishing Hikvision South Africa Editor's Choice CCTV, Surveillance & Remote Monitoring News Integrated Solutions Conferences & Events
Hikvision recently held a roadshow titled Industry X, where the company highlighted its latest products and solutions, supported by partners and distributors.

Reliable, low-maintenance video appliances
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring News IT infrastructure Products
Symetrix, part of the Agera Group, has added the AES range of video recording servers, storage appliances and workstations to its portfolio.

Technology and the future of security installation in South Africa
Editor's Choice Integrated Solutions Security Services & Risk Management
What are the technologies and trends shaping installation, service and maintenance teams globally, and how will they shape South African businesses today and in the future?

Upgraded security and AI monitoring at upmarket estate
Watcher Surveillance Solutions Editor's Choice CCTV, Surveillance & Remote Monitoring Integrated Solutions Residential Estate (Industry)
Estate upgrades and enhances its security through a partnership between surveillance specialist Watcher and the incumbent guarding company.

The technology wave implications for staff mismatches in control rooms
Leaderware Editor's Choice Security Services & Risk Management
An industry habit of looking at control rooms through a physical security lens has increasingly left clients and staff at a disadvantage in keeping up with control room technology and demands.

Resilience is a collaborative effort
Technews Publishing Editor's Choice
Cyber resilience is not an ‘IT thing’; Wayne Olsen says it is an enterprise-wide risk strategy that involves collaboration, lots of collaboration.

The challenge of data safety and availability
Technews Publishing Editor's Choice Cyber Security
Veeam offers backup and recovery software that presents the user with one interface to manage backups to and from almost any platform.

Cold chain integrity in real time
Technews Publishing Editor's Choice Asset Management, EAS, RFID IT infrastructure Transport (Industry) Logistics (Industry)
DeltaTrak offers real-time farm-to-fork IoT monitoring of the cold chain to ensure every step of the journey is recorded and verifiable via the cloud.

Nomad launches early adopter programme
Editor's Choice News Integrated Solutions Smart Home Automation
Participants in Nomad’s Early Adopter Programme will receive 10% of their volume order to facilitate testing before the commercial launch later this year.