Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:00 PM
JP Bourget
JP Bourget
Connect Directly
E-Mail vvv

Finding Your Appetite for Security Automation (and Why That's Important)

Yes, automation is becoming increasingly critical. But before you go all-in, determine the level that's right for your company.

"Automation" is one of the most deafening buzzwords in cybersecurity circles. Four out of five executives say their organizations are already implementing some form of this technology, according to a survey by Radware, and 57% indicate that they trust automated security systems "as much or more than" humans to protect the enterprise. What's more, 38% believe automated security systems will emerge as the primary resource for cyber defense within two years.

Decision-makers funding time-strapped security operations centers (SOCs) overwhelmed with the volume and velocity of alerts understandably like the sound of automation. Others point to plenty of repetitive and time-consuming tasks requiring speed and accuracy that have been offloaded to machines in other industries.

However, in watching security teams test and adopt different automation principles, it's clear to me that the most important success factor is getting our "appetite for automation" right. In other words, we must ask these questions: "Where can automation realistically make a difference in our operations?" "How much risk are we willing to take for the expected rewards of speed and efficiency?" Unless decisions are framed this way, approaches to automation risk being unfulfilling at best — or problematic and disappointing at worst.

Consider these examples to start a discussion on what degree of automation fits — particularly from a workflow perspective — within three common stages of the incident response process:

At the initial incident handling stage of "What just happened?" there is a premium on being able to gather and assimilate relevant data quickly. First responders manually managing an endless alert stream can reliably benefit from automation tools to distinguish false positives from the real thing faster. This process of pulling data from multiple disparate sources to provide context is often referred to as enrichment.

Let's illustrate with the use case of an executive receiving a potentially malicious e-mail. Traditionally, security staff would manually scrutinize the message's metadata, links, or attachments to find out what it contains, where it came from, and who appears to be the true sender. But automation can now perform this legwork, allowing experts to focus their time on making reasoned decisions about what, if any, action to take instead of tediously gathering all the data beforehand.

Even incremental automation steps usually deliver solid net gains. The biggest caveat, in my experience, is making sure the automation platform you select can readily interface via APIs with both your security tools and other existing investments, such as security information and event management software and configuration management databases. If you start needing multiple dashboards, it offsets any performance gain.

Here's where the right appetite becomes tricky, because containment requires action. When malware — or what looks like malware — hits, a number of steps must be executed to curtail what a suspicious file is trying to do, such as stealing data. If you take an "all-in" approach to automation during containment, you might be able to contain true attacks more quickly, but you also shoulder the risk of "breaking things."

When you move the slider toward more automated defense and empower machines to block and filter more things at top speed, it can result in business users experiencing broken browser links, blocked access to legitimate files, and overall diminished productivity. You have to weigh asset value, sensitivity of the data, and user role to decide if the automation you green-light will result in more security victories — or angry help-desk calls.

Try a few new things on the menu, carefully: Potential risk is the make-or-break factor for most enterprises here. In a large organization, there could be a case for fielding automated defenses in certain business units as test cases, or to protect the most sensitive users and data. Some firms ironically automate containment for low-risk incidents first, requiring human approvals in the process for more high-value targets until confidence is high in the automation's accuracy.

This is where the risk-versus-reward balance matters most. Many vendor claims try to whet automation appetites in this stage with demos that show fully automated technologies seamlessly quarantining or patching machines, or kicking-off more complex steps across security and network management.

The logic and technical tripwires behind these highly automated concepts are generally sound, but demos are not the real world and you have to ask what will happen when the unexpected inevitably occurs. A product could conceivably "take matters into its own hands" (because, well, that's what automation does) during remediation and shut down production systems or email, while it installs a patch or purges all copies of a certain file. Needless to say, when automation performs at this scale, the CISO wants to be the hero — not the person receiving blame.

Approach security automation with enthusiasm, but use caution. Feed your more immediate appetites first. The safest path is to stair-step with automation; tackle enrichment first for measurable, early gains. Use that insight to guide containment, and what you learn along the way will help determine your tastes in automated remediation.

When SOC alerts are skyrocketing, analysts are racing, and breaches cloud the headlines, it is easy to think that big, bold technology moves are the way to go in changing the game. Automation is surely changing how we do security, but everyone's needs, resources, and risk tolerance are different.

Our wider goal as a community should be sharing how we reach and feed our appetites for security automation across our enterprises, so that different organizations can take notes, follow good examples, and avoid pitfalls.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.


JP Bourget, Founder and Chief Security Officer of Syncurity, has more than 10 years of experience in cybersecurity. JP works with Syncurity's customers and market influencers to drive adoption of the company's flagship IR-Flow platform. Prior to co-founding Syncurity, JP was ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
10/25/2017 | 12:14:12 PM
Finding the balance
JP- Excellent article. Automation is a hairy issue, regardless of industry and business case.

Can you share any suggestions on how to "take stock" of your organization's security automation appetite, and turn that into an actionable plan?
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-14
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.
PUBLISHED: 2019-10-14
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph ...
PUBLISHED: 2019-10-14
SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
PUBLISHED: 2019-10-14
CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service (Recognition Update Client Service) via an insecure communication channel (Named Pipe). The data (JSON) sent via this channel is used to import data f...
PUBLISHED: 2019-10-14
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server