Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/18/2018
09:00 AM
Joe Cosmano
Joe Cosmano
Partner Perspectives
Connect Directly
LinkedIn
RSS
50%
50%

How to Leverage Artificial Intelligence for Cybersecurity

AI and predictive analytics should be used to augment a company's security team, not replace it. Here's why.

Artificial intelligence (AI) and machine learning (ML) are two interrelated concepts that people across the tech landscape know hold important implications. While the benefits of these capabilities are many, experts in the field are also known to flaunt dire theories about them - from threats of dystopian futures ala The Matrix films to more tangible fears like wide-scale data breaches.

Machine learning falls under the broader AI umbrella as a technology that can enable computers to learn and adapt through experience, essentially, mirroring human cognition to recognize patterns. Successful examples of recent ML deployments include Google’s evolving search algorithms and Amazon’s product recommendations, along with the many "news feeds" that are common across social media.

But similar initiatives can have big dividends where cybersecurity is involved, especially in freeing up many of the more rote activities with which security staff are tasked. Predictive analytics and greater automation, for instance, are being employed via AI as an innovative means to fill the skills shortage that’s prevalent across the industry. This allows teams to off-load basic tasks in favor of high-priority or more technical initiatives.

Matching Human Capabilities at a Speed We Can’t touch

Any technology that can lessen the burden of an enterprise security team is extremely useful. Further to that, any time there is a defined data set that can be analyzed and categorized into a defined set of actions, AI will be successful. Some of the benefits that are already being enjoyed by security teams include things like enhanced behavioral analysis, email security and malware prevention.

For instance, businesses can use AI to help establish "known knowns" and "known unknowns" – that is, traffic behavior that follows an expected baseline of activity, and the traffic, users, or devices that appear anomalous by comparison. Even if an individual was given a single pane of glass to monitor all the traffic crossing the network perimeter, spotting anomalies would be nearly impossible given the number of users and devices that, on average, leverage contemporary enterprise networks.

The bottom line is that computers simply absorb information at a greater speed than humans while adhering to the same rules and protocols.

Tread Carefully at First

Of course, that isn’t to say there aren’t pitfalls to implementing AI and ML into a security workflow. It’s important to remember that AI and predictive analytics should be used to augment a company’s security team not replace it.

As was explained above, quality data sets will inform the success of an AI or ML program. If a business is collecting the wrong type of information from the get go, or is storing it incorrectly, AI and predictive analytics will be drawing conclusions based on incomplete or inaccurate information, leading to a reduction in performance.

Organizations achieve the greatest benefits from these technologies when they are used to free teams up from manual tasks in order to focus on higher-level problems that require "human" brain power to assess context and nuance. Those assessments can’t be passed onto computers – at least not yet.

It’s also important to expect that hackers will inevitably ramp up their use of AI in response to the new tactics being deployed by security teams. This underscores  the point that while cybersecurity tactics will change with team, threats will always be present, requiring dedicated human collateral to help businesses remain secure for years to come.

Joe Cosmano has over 15 years of leadership and hands-on technical experience in roles including Senior Systems and Network Engineer and cybersecurity expert. Prior to iboss, he held positions with Atlantic Net, as engineering director overseeing a large team of engineers and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Bluetooth Hack Affects Millions of Vehicles
Dark Reading Staff 11/16/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
iboss has created the first and only web gateway as a service specifically designed to solve the challenge of securing distributed organizations. Built for the cloud, the iboss Distributed Gateway Platform leverages an elastic, cloud-based node architecture that provides advanced security for todays decentralized organizations with more financial predictability. Backed by more than 110 patents and patents pending, and protecting over 4,000 organizations worldwide, iboss is one of the fastest growing cybersecurity companies in the world. To learn more, visit www.iboss.com.
Featured Writers
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19406
PUBLISHED: 2018-11-21
kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.
CVE-2018-19407
PUBLISHED: 2018-11-21
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.
CVE-2018-19404
PUBLISHED: 2018-11-21
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= ...
CVE-2018-19387
PUBLISHED: 2018-11-20
format_cb_pane_tabs in format.c in tmux 2.7 through 2.8 might allow attackers to cause a denial of service (NULL Pointer Dereference and application crash) by arranging for a malloc failure.
CVE-2018-19388
PUBLISHED: 2018-11-20
FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and application crash) via TIFF data because of a ConvertToPDF_x86!ReleaseFXURLToHtml issue.