The SOC Emergency Room Faces Malware Pandemic

To protect populations from COVID-19, countries are facing unforeseen circumstances and taking extreme measures in response. Everything is moving fast, but we can see that countries that took decisive measures early have slowed the virus's spread.

Security professionals can learn from the healthcare industry new ways to protect their own organizations from hackers, who are out in full force. 

We in the security arena are also inundated with finding increasing and more severe vulnerabilities. To maintain business continuity in this quarantined era, organizations are allowing – or mandating – their employees to work from home and access the organization's business assets from afar. 

Attackers are exploiting the high volume of remote users logged into the organization, presenting a new, very distributed and volumetric, baseline of remote logins. This makes it very hard to identify unusual remote logins and makes it harder to detect credential theft cases; devices that are used to log in for the first time are no longer an anomaly, and so may not be identified. This is the new normal with user behavior and access patterns that have never been seen before, so most organizations are in the area of experiencing "unknown unknowns." They don’t even know what they don’t know.

Additionally, many employees are not security trained and can be attacked by quite simple social engineering methods as they work from home. Spear phishing (with weaponized emails), credit theft of remote user credentials, and phishing campaigns are on the rise.

And not only are doctors and nurses understaffed and overworked in hard-hit areas, so are SOC and IT teams. SOC rooms are now "distributed SOC rooms" and some SOC employees are ill or quarantined. Teams already strapped for staff are making do with even less and in difficult circumstances.

In the real world, countries which have successfully taken on COVID-19 have moved rapidly, identifying those who carry the virus and separating them form the healthy population quickly and effectively. In our IT organizations, we need to adopt the more disciplined, centralized approach. Steps we should take:

In one area our cyber world has an advantage over real life emergency rooms – today it's possible to automate much of the work of security analysts. Imagine if we could provide doctors and nurses with robotic assistants who could take on some of the tasks of the ER team, without needing breaks or getting sick. Advanced AI such as natural language processing (NLP), which automates incident investigations, can lower the burden on our security teams and enable them to fight the big fight against cyber attackers triumphantly.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "What Should I Do If Someone Is Impersonating My Company in a Phishing Campaign?"