In 1988, a Cornell University graduate student named Robert Morris wanted to measure the size of the Internet. He wrote a program that could spread across a network, install itself on machines, and then Morris would count the instances. From that, the now-infamous ‘Morris Worm’ unintentionally became one of the first known widespread cyberattacks, infecting over 6,000 machines.
In 2017, the Wannacry malware virus hit an estimated 1 million machines. According to a report cited by Statista, there were 305 million ransomware attacks in 2020, directed not by curious scholars but organised crime and malicious state actors. The scope and danger of such attacks have exploded in the past decade and show no sign of slowing down.
Fortunately, the cybersecurity industry has been hitting back, and there is considerable excitement around automation and artificial intelligence in the field. Yet, those phrases can have broad meanings. So, if you are in the market for security solutions, what should you consider about automation and AI in security?
Greater than the sum of its parts
“I think there are two important things to know when you look at automation and artificial intelligence,” says Pieter Du Preez, Head of managed detection and response at cybersecurity company, Performanta. “First, it’s very important that the customer has an internal strategy for automation and AI. These can relate to both cybersecurity and other parts of the business and provide a benchmark for evaluating the security vendor.
“The second important consideration is not to get caught up in the specifics of the technologies. Instead, look into the provider’s processes and results. Do they study the client’s security posture, associate threat intelligence with it, and incorporate that into automation?”
Such diligence is necessary because almost anyone can claim to use automation or AI. Says Du Preez: “You can apply broad definitions to either technology. This is very relevant in security, where the best results come from a combination of different integrated systems and services. You need to look at how they use AI and automation in a platform sense and not just through their services.”
It’s helpful to understand that automation and AI are sparking a cultural revolution in security. For example, a traditional security operations centre (SOC) would employ dozens of people, whereas one using automation run using a handful of skilled staff.
Similarly, the skills profiles of security professionals are changing, blending specialisation with a range of generalist abilities. So, if a cybersecurity provider claims to use automating technologies yet doesn’t reflect that in its operations, you can wonder if they are using those improvements to full effect.
“This is a common misunderstanding that I’ve seen among customers and security executives,” says Du Preez. “They will check your SOC employee numbers on LinkedIn and then ask how you expect to run operations with so few employees. But that is often the difference between proper use of AI and automation, and not.”
Determining Value
As a purchaser of security services, you don’t need to care about automation and AI. Instead, ask a vendor a few key questions such as: What is your mean time to respond? What is your mean time to detect, and is that faster than it was before? Can you demonstrate a considerable reduction in time and effort for things that used to be cumbersome and labour-intensive?
There are three areas of a security vendor that you should look at. Managed security services (MSS) must help a customer establish baseline process standards in place. These should address business goals and industry threats. Managed risk and governance focuses on the client’s risk posture and governance requirements, aligning the MSS to the client-specific industry and needs.
Finally, managed detection and response (MDR) is the muscle: endpoint detection and response (EDR), security information and event management (SIEM), security orchestration, automation and response (SOAR), and the SOC fall under MDR. MDR is also where the vendor will apply most of its automation and AI capabilities.
You need to question how they provide results. A vendor can provide examples of the playbooks that govern its machine-learning behaviour or demonstrate how its detection and response times have improved considerably.
Focus on the core platform as it’s about how and where people apply automation. Du Preez says: “The automation and the integration around those elements is where you show your maturity in the security market. For example, show me your rules, what was pushed to the security platforms and how you use automation that is effective to me. How did your threat intelligence detect something faster than your competitor? That’s it, really.”