Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/18/2018
09:00 AM
Joe Cosmano
Joe Cosmano
Partner Perspectives
Connect Directly
LinkedIn
RSS
50%
50%

How to Leverage Artificial Intelligence for Cybersecurity

AI and predictive analytics should be used to augment a company's security team, not replace it. Here's why.

Artificial intelligence (AI) and machine learning (ML) are two interrelated concepts that people across the tech landscape know hold important implications. While the benefits of these capabilities are many, experts in the field are also known to flaunt dire theories about them - from threats of dystopian futures ala The Matrix films to more tangible fears like wide-scale data breaches.

Machine learning falls under the broader AI umbrella as a technology that can enable computers to learn and adapt through experience, essentially, mirroring human cognition to recognize patterns. Successful examples of recent ML deployments include Google’s evolving search algorithms and Amazon’s product recommendations, along with the many "news feeds" that are common across social media.

But similar initiatives can have big dividends where cybersecurity is involved, especially in freeing up many of the more rote activities with which security staff are tasked. Predictive analytics and greater automation, for instance, are being employed via AI as an innovative means to fill the skills shortage that’s prevalent across the industry. This allows teams to off-load basic tasks in favor of high-priority or more technical initiatives.

Matching Human Capabilities at a Speed We Can’t touch

Any technology that can lessen the burden of an enterprise security team is extremely useful. Further to that, any time there is a defined data set that can be analyzed and categorized into a defined set of actions, AI will be successful. Some of the benefits that are already being enjoyed by security teams include things like enhanced behavioral analysis, email security and malware prevention.

For instance, businesses can use AI to help establish "known knowns" and "known unknowns" – that is, traffic behavior that follows an expected baseline of activity, and the traffic, users, or devices that appear anomalous by comparison. Even if an individual was given a single pane of glass to monitor all the traffic crossing the network perimeter, spotting anomalies would be nearly impossible given the number of users and devices that, on average, leverage contemporary enterprise networks.

The bottom line is that computers simply absorb information at a greater speed than humans while adhering to the same rules and protocols.

Tread Carefully at First

Of course, that isn’t to say there aren’t pitfalls to implementing AI and ML into a security workflow. It’s important to remember that AI and predictive analytics should be used to augment a company’s security team not replace it.

As was explained above, quality data sets will inform the success of an AI or ML program. If a business is collecting the wrong type of information from the get go, or is storing it incorrectly, AI and predictive analytics will be drawing conclusions based on incomplete or inaccurate information, leading to a reduction in performance.

Organizations achieve the greatest benefits from these technologies when they are used to free teams up from manual tasks in order to focus on higher-level problems that require "human" brain power to assess context and nuance. Those assessments can’t be passed onto computers – at least not yet.

It’s also important to expect that hackers will inevitably ramp up their use of AI in response to the new tactics being deployed by security teams. This underscores  the point that while cybersecurity tactics will change with team, threats will always be present, requiring dedicated human collateral to help businesses remain secure for years to come.

Joe Cosmano has over 15 years of leadership and hands-on technical experience in roles including Senior Systems and Network Engineer and cybersecurity expert. Prior to iboss, he held positions with Atlantic Net, as engineering director overseeing a large team of engineers and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.