Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/18/2018
09:00 AM
Joe Cosmano
Joe Cosmano
Partner Perspectives
Connect Directly
LinkedIn
RSS
50%
50%

How to Leverage Artificial Intelligence for Cybersecurity

AI and predictive analytics should be used to augment a company's security team, not replace it. Here's why.

Artificial intelligence (AI) and machine learning (ML) are two interrelated concepts that people across the tech landscape know hold important implications. While the benefits of these capabilities are many, experts in the field are also known to flaunt dire theories about them - from threats of dystopian futures ala The Matrix films to more tangible fears like wide-scale data breaches.

Machine learning falls under the broader AI umbrella as a technology that can enable computers to learn and adapt through experience, essentially, mirroring human cognition to recognize patterns. Successful examples of recent ML deployments include Google’s evolving search algorithms and Amazon’s product recommendations, along with the many "news feeds" that are common across social media.

But similar initiatives can have big dividends where cybersecurity is involved, especially in freeing up many of the more rote activities with which security staff are tasked. Predictive analytics and greater automation, for instance, are being employed via AI as an innovative means to fill the skills shortage that’s prevalent across the industry. This allows teams to off-load basic tasks in favor of high-priority or more technical initiatives.

Matching Human Capabilities at a Speed We Can’t touch

Any technology that can lessen the burden of an enterprise security team is extremely useful. Further to that, any time there is a defined data set that can be analyzed and categorized into a defined set of actions, AI will be successful. Some of the benefits that are already being enjoyed by security teams include things like enhanced behavioral analysis, email security and malware prevention.

For instance, businesses can use AI to help establish "known knowns" and "known unknowns" – that is, traffic behavior that follows an expected baseline of activity, and the traffic, users, or devices that appear anomalous by comparison. Even if an individual was given a single pane of glass to monitor all the traffic crossing the network perimeter, spotting anomalies would be nearly impossible given the number of users and devices that, on average, leverage contemporary enterprise networks.

The bottom line is that computers simply absorb information at a greater speed than humans while adhering to the same rules and protocols.

Tread Carefully at First

Of course, that isn’t to say there aren’t pitfalls to implementing AI and ML into a security workflow. It’s important to remember that AI and predictive analytics should be used to augment a company’s security team not replace it.

As was explained above, quality data sets will inform the success of an AI or ML program. If a business is collecting the wrong type of information from the get go, or is storing it incorrectly, AI and predictive analytics will be drawing conclusions based on incomplete or inaccurate information, leading to a reduction in performance.

Organizations achieve the greatest benefits from these technologies when they are used to free teams up from manual tasks in order to focus on higher-level problems that require "human" brain power to assess context and nuance. Those assessments can’t be passed onto computers – at least not yet.

It’s also important to expect that hackers will inevitably ramp up their use of AI in response to the new tactics being deployed by security teams. This underscores  the point that while cybersecurity tactics will change with team, threats will always be present, requiring dedicated human collateral to help businesses remain secure for years to come.

Joe Cosmano has over 15 years of leadership and hands-on technical experience in roles including Senior Systems and Network Engineer and cybersecurity expert. Prior to iboss, he held positions with Atlantic Net, as engineering director overseeing a large team of engineers and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5007
PUBLISHED: 2020-01-17
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename pa...
CVE-2020-5397
PUBLISHED: 2020-01-17
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not incl...
CVE-2019-17635
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted inde...
CVE-2019-19339
PUBLISHED: 2020-01-17
It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries...
CVE-2007-6070
PUBLISHED: 2020-01-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-1382. Reason: This candidate is a reservation duplicate of CVE-2008-1382. Notes: All CVE users should reference CVE-2008-1382 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...