02:00 PM
JP Bourget
JP Bourget
Connect Directly
E-Mail vvv

Finding Your Appetite for Security Automation (and Why That's Important)

Yes, automation is becoming increasingly critical. But before you go all-in, determine the level that's right for your company.

"Automation" is one of the most deafening buzzwords in cybersecurity circles. Four out of five executives say their organizations are already implementing some form of this technology, according to a survey by Radware, and 57% indicate that they trust automated security systems "as much or more than" humans to protect the enterprise. What's more, 38% believe automated security systems will emerge as the primary resource for cyber defense within two years.

Decision-makers funding time-strapped security operations centers (SOCs) overwhelmed with the volume and velocity of alerts understandably like the sound of automation. Others point to plenty of repetitive and time-consuming tasks requiring speed and accuracy that have been offloaded to machines in other industries.

However, in watching security teams test and adopt different automation principles, it's clear to me that the most important success factor is getting our "appetite for automation" right. In other words, we must ask these questions: "Where can automation realistically make a difference in our operations?" "How much risk are we willing to take for the expected rewards of speed and efficiency?" Unless decisions are framed this way, approaches to automation risk being unfulfilling at best — or problematic and disappointing at worst.

Consider these examples to start a discussion on what degree of automation fits — particularly from a workflow perspective — within three common stages of the incident response process:

At the initial incident handling stage of "What just happened?" there is a premium on being able to gather and assimilate relevant data quickly. First responders manually managing an endless alert stream can reliably benefit from automation tools to distinguish false positives from the real thing faster. This process of pulling data from multiple disparate sources to provide context is often referred to as enrichment.

Let's illustrate with the use case of an executive receiving a potentially malicious e-mail. Traditionally, security staff would manually scrutinize the message's metadata, links, or attachments to find out what it contains, where it came from, and who appears to be the true sender. But automation can now perform this legwork, allowing experts to focus their time on making reasoned decisions about what, if any, action to take instead of tediously gathering all the data beforehand.

Even incremental automation steps usually deliver solid net gains. The biggest caveat, in my experience, is making sure the automation platform you select can readily interface via APIs with both your security tools and other existing investments, such as security information and event management software and configuration management databases. If you start needing multiple dashboards, it offsets any performance gain.

Here's where the right appetite becomes tricky, because containment requires action. When malware — or what looks like malware — hits, a number of steps must be executed to curtail what a suspicious file is trying to do, such as stealing data. If you take an "all-in" approach to automation during containment, you might be able to contain true attacks more quickly, but you also shoulder the risk of "breaking things."

When you move the slider toward more automated defense and empower machines to block and filter more things at top speed, it can result in business users experiencing broken browser links, blocked access to legitimate files, and overall diminished productivity. You have to weigh asset value, sensitivity of the data, and user role to decide if the automation you green-light will result in more security victories — or angry help-desk calls.

Try a few new things on the menu, carefully: Potential risk is the make-or-break factor for most enterprises here. In a large organization, there could be a case for fielding automated defenses in certain business units as test cases, or to protect the most sensitive users and data. Some firms ironically automate containment for low-risk incidents first, requiring human approvals in the process for more high-value targets until confidence is high in the automation's accuracy.

This is where the risk-versus-reward balance matters most. Many vendor claims try to whet automation appetites in this stage with demos that show fully automated technologies seamlessly quarantining or patching machines, or kicking-off more complex steps across security and network management.

The logic and technical tripwires behind these highly automated concepts are generally sound, but demos are not the real world and you have to ask what will happen when the unexpected inevitably occurs. A product could conceivably "take matters into its own hands" (because, well, that's what automation does) during remediation and shut down production systems or email, while it installs a patch or purges all copies of a certain file. Needless to say, when automation performs at this scale, the CISO wants to be the hero — not the person receiving blame.

Approach security automation with enthusiasm, but use caution. Feed your more immediate appetites first. The safest path is to stair-step with automation; tackle enrichment first for measurable, early gains. Use that insight to guide containment, and what you learn along the way will help determine your tastes in automated remediation.

When SOC alerts are skyrocketing, analysts are racing, and breaches cloud the headlines, it is easy to think that big, bold technology moves are the way to go in changing the game. Automation is surely changing how we do security, but everyone's needs, resources, and risk tolerance are different.

Our wider goal as a community should be sharing how we reach and feed our appetites for security automation across our enterprises, so that different organizations can take notes, follow good examples, and avoid pitfalls.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.


JP Bourget, Founder and Chief Security Officer of Syncurity, has more than 10 years of experience in cybersecurity. JP works with Syncurity's customers and market influencers to drive adoption of the company's flagship IR-Flow platform. Prior to co-founding Syncurity, JP was ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
10/25/2017 | 12:14:12 PM
Finding the balance
JP- Excellent article. Automation is a hairy issue, regardless of industry and business case.

Can you share any suggestions on how to "take stock" of your organization's security automation appetite, and turn that into an actionable plan?
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable as the first argument to printf(). Setting this variable using the sysvar command results in a user-c...
PUBLISHED: 2019-03-26
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged.
PUBLISHED: 2019-03-26
utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user controlled) shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addre...
PUBLISHED: 2019-03-26
An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, the current working directory path is used as the first argument to printf() without a proper check. An attacker may thus forge a path contain...