Attacks/Breaches

10/24/2017
02:00 PM
JP Bourget
JP Bourget
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Finding Your Appetite for Security Automation (and Why That's Important)

Yes, automation is becoming increasingly critical. But before you go all-in, determine the level that's right for your company.

"Automation" is one of the most deafening buzzwords in cybersecurity circles. Four out of five executives say their organizations are already implementing some form of this technology, according to a survey by Radware, and 57% indicate that they trust automated security systems "as much or more than" humans to protect the enterprise. What's more, 38% believe automated security systems will emerge as the primary resource for cyber defense within two years.

Decision-makers funding time-strapped security operations centers (SOCs) overwhelmed with the volume and velocity of alerts understandably like the sound of automation. Others point to plenty of repetitive and time-consuming tasks requiring speed and accuracy that have been offloaded to machines in other industries.

However, in watching security teams test and adopt different automation principles, it's clear to me that the most important success factor is getting our "appetite for automation" right. In other words, we must ask these questions: "Where can automation realistically make a difference in our operations?" "How much risk are we willing to take for the expected rewards of speed and efficiency?" Unless decisions are framed this way, approaches to automation risk being unfulfilling at best — or problematic and disappointing at worst.

Consider these examples to start a discussion on what degree of automation fits — particularly from a workflow perspective — within three common stages of the incident response process:

Identification
At the initial incident handling stage of "What just happened?" there is a premium on being able to gather and assimilate relevant data quickly. First responders manually managing an endless alert stream can reliably benefit from automation tools to distinguish false positives from the real thing faster. This process of pulling data from multiple disparate sources to provide context is often referred to as enrichment.

Let's illustrate with the use case of an executive receiving a potentially malicious e-mail. Traditionally, security staff would manually scrutinize the message's metadata, links, or attachments to find out what it contains, where it came from, and who appears to be the true sender. But automation can now perform this legwork, allowing experts to focus their time on making reasoned decisions about what, if any, action to take instead of tediously gathering all the data beforehand.

Even incremental automation steps usually deliver solid net gains. The biggest caveat, in my experience, is making sure the automation platform you select can readily interface via APIs with both your security tools and other existing investments, such as security information and event management software and configuration management databases. If you start needing multiple dashboards, it offsets any performance gain.

Containment
Here's where the right appetite becomes tricky, because containment requires action. When malware — or what looks like malware — hits, a number of steps must be executed to curtail what a suspicious file is trying to do, such as stealing data. If you take an "all-in" approach to automation during containment, you might be able to contain true attacks more quickly, but you also shoulder the risk of "breaking things."

When you move the slider toward more automated defense and empower machines to block and filter more things at top speed, it can result in business users experiencing broken browser links, blocked access to legitimate files, and overall diminished productivity. You have to weigh asset value, sensitivity of the data, and user role to decide if the automation you green-light will result in more security victories — or angry help-desk calls.

Try a few new things on the menu, carefully: Potential risk is the make-or-break factor for most enterprises here. In a large organization, there could be a case for fielding automated defenses in certain business units as test cases, or to protect the most sensitive users and data. Some firms ironically automate containment for low-risk incidents first, requiring human approvals in the process for more high-value targets until confidence is high in the automation's accuracy.

Remediation
This is where the risk-versus-reward balance matters most. Many vendor claims try to whet automation appetites in this stage with demos that show fully automated technologies seamlessly quarantining or patching machines, or kicking-off more complex steps across security and network management.

The logic and technical tripwires behind these highly automated concepts are generally sound, but demos are not the real world and you have to ask what will happen when the unexpected inevitably occurs. A product could conceivably "take matters into its own hands" (because, well, that's what automation does) during remediation and shut down production systems or email, while it installs a patch or purges all copies of a certain file. Needless to say, when automation performs at this scale, the CISO wants to be the hero — not the person receiving blame.

Approach security automation with enthusiasm, but use caution. Feed your more immediate appetites first. The safest path is to stair-step with automation; tackle enrichment first for measurable, early gains. Use that insight to guide containment, and what you learn along the way will help determine your tastes in automated remediation.

When SOC alerts are skyrocketing, analysts are racing, and breaches cloud the headlines, it is easy to think that big, bold technology moves are the way to go in changing the game. Automation is surely changing how we do security, but everyone's needs, resources, and risk tolerance are different.

Our wider goal as a community should be sharing how we reach and feed our appetites for security automation across our enterprises, so that different organizations can take notes, follow good examples, and avoid pitfalls.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

JP Bourget, Founder and Chief Security Officer of Syncurity, has more than 10 years of experience in cybersecurity. JP works with Syncurity's customers and market influencers to drive adoption of the company's flagship IR-Flow platform. Prior to co-founding Syncurity, JP was ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
StevenLSmith
50%
50%
StevenLSmith,
User Rank: Apprentice
10/25/2017 | 12:14:12 PM
Finding the balance
JP- Excellent article. Automation is a hairy issue, regardless of industry and business case.

Can you share any suggestions on how to "take stock" of your organization's security automation appetite, and turn that into an actionable plan?
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6487
PUBLISHED: 2019-01-18
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.