Automation and AI in security

Issue 4 2021 Editor's Choice, Cyber Security, Commercial (Industry)

In 1988, a Cornell University graduate student named Robert Morris wanted to measure the size of the Internet. He wrote a program that could spread across a network, install itself on machines and then Morris would count the instances. From that, the now-infamous ‘Morris Worm’ unintentionally became one of the first known widespread cyberattacks, infecting over 6000 machines.

Pieter Du Preez.

In 2017, the Wannacry malware virus hit an estimated 1 million machines. According to a report cited by Statista, there were 305 million ransomware attacks in 2020, directed not by curious scholars but organised crime and malicious state actors. The scope and danger of such attacks have exploded in the past decade and show no sign of slowing down.

Fortunately, the cybersecurity industry has been hitting back and there is considerable excitement around automation and artificial intelligence in the field. Yet, those phrases can have broad meanings. So, if you are in the market for security solutions, what should you consider about automation and AI in security?

Greater than the sum of its parts

“I think there are two important things to know when you look at automation and artificial intelligence,” says Pieter Du Preez, head of managed detection and response at cybersecurity company Performanta. “First, it’s very important that the customer has an internal strategy for automation and AI. These can relate to both cybersecurity and other parts of the business and provide a benchmark for evaluating the security vendor.

“The second important consideration is not to get caught up in the specifics of the technologies. Instead, look into the provider’s processes and results. Do they study the client’s security posture, associate threat intelligence with it and incorporate that into automation?”

Such diligence is necessary because almost anyone can claim to use automation or AI. Says Du Preez: “You can apply broad definitions to either technology. This is very relevant in security, where the best results come from a combination of different integrated systems and services. You need to look at how they use AI and automation in a platform sense and not just through their services.”

It’s helpful to understand that automation and AI are sparking a cultural revolution in security. For example, a traditional security operations centre (SOC) would employ dozens of people, whereas one using automation ran using a handful of skilled staff. Similarly, the skills profiles of security professionals are changing, blending specialisation with a range of generalist abilities. So, if a cybersecurity provider claims to use automating technologies yet doesn’t reflect that in its operations, you can wonder if they are using those improvements to full effect.

“This is a common misunderstanding that I’ve seen among customers and security executives,” says Du Preez. “They will check your SOC employee numbers on LinkedIn and then ask how you expect to run operations with so few employees. But that is often the difference between proper use of AI and automation, and not.”

Determining value

As a purchaser of security services, you don’t need to care about automation and AI. Instead, ask a vendor a few key questions such as:

• What is your mean time to respond?

• What is your mean time to detect and is that faster than it was before?

• Can you demonstrate a considerable reduction in time and effort for things that used to be cumbersome and labour-intensive?

There are three areas of a security vendor that you should look at. Managed security services (MSS) must help a customer establish baseline process standards in place. These should address business goals and industry threats. Managed risk and governance focuses on the client’s risk posture and governance requirements, aligning the MSS to the client-specific industry and needs.

Finally, managed detection and response (MDR) is the muscle: endpoint detection and response (EDR), security information and event management (SIEM), security orchestration, automation and response (SOAR) and the SOC fall under MDR. MDR is also where the vendor will apply most of its automation and AI capabilities.

You need to question how they provide results. A vendor can provide examples of the playbooks that govern its machine-learning behaviour or demonstrate how its detection and response times have improved considerably.

Focus on the core platform, as it’s about how and where people apply automation. Du Preez says, “The automation and the integration around those elements is where you show your maturity in the security market. For example, show me your rules, what was pushed to the security platforms and how you use automation that is effective to me. How did your threat intelligence detect something faster than your competitor? That’s it, really.”

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

FortiGuard labs reports disruptive shift of cyber threats
Issue 1 2021 , Editor's Choice
Threat intelligence from the second half of 2020 demonstrates an unprecedented cyber-threat landscape where cyber adversaries maximised the constantly expanding attack surface to scale threat efforts around the world. Adversaries proved to be highly adaptable, creating waves of disruptive and sophisticated attacks.

The year resilience paid off
Issue 8 2020 , Editor's Choice, Security Services & Risk Management
Hi-Tech Security Solutions spoke to Michael Davies about business continuity and resilience in a year when everything was put to the test.

Retail solutions beyond security
Issue 8 2020, Axis Communications SA, Technews Publishing, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring
The need for security technology to deliver more than videos of people falling or stealing from retail stores is greater than ever.

Did they bite off more than they could chew?
Issue 4 2021 , Editor's Choice
For a long time, ransomware gangs were mostly focused on Microsoft Windows operating systems, however, several ransomware gangs are now experimenting with writing their binaries in the cross-platform language Golang (Go).

Stops and destroys a 6-ton truck
Issue 4 2021 , Editor's Choice
Delta Scientific's single shallow-foundation bollard gets M30 rating by stopping and destroying a 6804 kg test truck with -2,69 m of static penetration and -1,1 m of dynamic penetration.

Beating cybercriminals at their own game with AI
Issue 4 2021 , Editor's Choice
AI is a powerful technology that holds great potential for exploitation by cybercriminals; the only way that security leaders can stay ahead is by gaining a true understanding of how this technology can be weaponised.

PoPIA: De-identifying, matching and filing
Issue 3 2021 , Editor's Choice, News, Security Services & Risk Management
Three of the crucial areas in organisational PoPIA compliance that must be discussed include de-identifying, information matching programmes and filing systems.

A resilient video surveillance market despite Covid-19
Issue 3 2021 , Editor's Choice
Novaira Insights, a new video surveillance market research provider, has released its first report, The World Market for Video Surveillance Hardware and Software – 2021.

Winners of the inaugural South Africa OSPAs
Issue 4 2021, Technews Publishing, Secutel Technologies, Cathexis Technologies , Editor's Choice, News, Integrated Solutions, Security Services & Risk Management
The presentation of the first-ever South Africa Outstanding Security Performance Awards (OSPAs) took place virtually on Thursday 3rd June 2021 as part of an internationally attended online thought leadership webinar.

2000 services in one platform
Issue 4 2021, Technews Publishing , Editor's Choice
Incident Desk allows customers to customise it to include a full range of building management, maintenance and OHS modules, as well as additional components that integrate and turn IoT data into usable knowledge.