How To Automate Cyber Defense

Humans aren’t fast enough to respond to network attacks and breaches. Machines can help us, if we help them.

One of the most interesting possibilities is creating an event-driven architecture to add automation to the defensive arsenal.

Given a single router can generate over 100,000 data points every few seconds, any network of any size quickly grows beyond the ability for even teams of humans to protect 100 percent effectively. There is just too much data and not enough analysts.

Attackers know this, and use all that data as cover to remain undetected once they breach a network. That is why the latest Mandiant M-Trends 2016 Report found most organizations were breached for 146 days before the successful attack was discovered. The US government is no exception to this rule.

Automation could be the answer, reducing the time from detection to remediation from months to seconds.

The basic concept is simple enough. It uses the power of the network itself to counter threats, making it a machine versus machine affair. That’s not unlike the classic “WarGames” movie, where a young Matthew Broderick gets the WOPR computer to play itself in a game to teach it futility.

The concept of automation in cyber-security can be broken down into three basic levels.

At the first and most-basic level is human-driven automation. A human operator needs to do something, like check a series of network devices for compliance issues, so they activate a script to do the heavy lifting. This can cut down on operator workload and help with odorous chores like patch management, but doesn’t improve breach response times.

At the second level, which makes the most sense for federal agencies, there is event-driven automation. At level two, humans “teach” computers their various processes. If a computer goes down, they open a trouble ticket, or if a virus is detected, they wipe the system and restore the core operating system.

Humans set those event triggers and program what responses to automatically take. Then, they can remove themselves from the loop, though they can also keep a hand in things, such as having a computer notify a supervisor about a particularly dangerous trigger.

Computers are never actually doing anything beyond what they are taught, but can respond to security events at machine speed, automating the remediation of many threats, especially low-level ones, and freeing up analysts to work on larger projects or trickier situations.

The final level is almost science fiction at this point, though there have been glimpses of what could one day be possible in things like IBM’s Watson and Google’s AlphaGo software. At that level, computers still respond to events, but also program their own triggers and responses, possibility making processes even more efficient than the original human-driven plan.

So why don’t we see more automation in federal networks, even at level two?

The answer is to get there requires both hardware and software. The software is available, but you also really need to have event-driven hardware in your network to take advantage of all of automation’s benefits.

That is ready too, but installing it piece by piece could be a slow process. In an event-driven network, devices should be built so they can interface with one another to open the doorway to true automation.

Specifically, they should all have:

  • Device Configuration in Structured Formats. Devices should be able to be programmed using a standard and common interface across the enterprise.
  • On-device APIs. Especially critical for feds, each device needs to run scrips natively onboard the device. Feds using a FIPS 140-2 device running on a closed network will need this, so automation scrips can run completely onboard, without breaking tight standards compliance.
  • Full Configuration Rollback. If an automation script is not working as intended, any device in an event-driven architecture needs to easily rollback to a previous configuration. This will keep experimenting with new scrips from becoming a liability.
  • Support for industry-standard models. For ease-of-use, each device should support industry standard configuration models like IETF or OpenConfig.

Once the hardware is in place, and several companies do offer automation-ready gear, the triggers and responses can be programmed to help fight cybersecurity threats at machine speed. The computers can do everything an analyst does without getting tired, hungry or bored.

Beyond just cyber-security, having an event-driven architecture in place also opens new efficiencies. Automation can, for example, be used in data centers for the automatic provisioning of software-defined networks based on customer needs, establishing micro-segments or automating the application of services by applying service-chaining.

There are some impressive capabilities in this field, but the first benefits of automation for most agencies will most certainly be in cybersecurity.

Especially now with a critical shortage of analysts and the US government not hiring anyone new, technologies like automation need to be quickly deployed before agencies start to get steamrolled under the next wave of advanced attacks.

DefenseOne

Watson For Cybersecurity:                Business Can Minimise Cybersecurity Risks And Drive Profit

« Deterrence & Cyber Attacks On The US Electoral System
WhatsApp Becomes The Latest Victim »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

4ARMED

4ARMED

4ARMED specializes in penetration testing, information security consultancy and security training

CW Jobs

CW Jobs

CWJobs.co.uk is a leading specialist IT recruitment website covering all areas of IT including Cyber Security.

Cybersprint

Cybersprint

Cybersprint's Digital Risk Protection platform continuously monitors your digital footprint so you can make informed decisions on exposure to online threats, identify vulnerabilities and take action.

DataProtect

DataProtect

DataProtect is a specialized information security company providing consultancy, information management, integration and training services.

Urbane Security

Urbane Security

Urbane Security is a premier information security consultancy empowering the Fortune 500, small and medium enterprise, and high-tech startups.

Cyber Intelligence House (CIH)

Cyber Intelligence House (CIH)

Cyber Intelligence House provides risk exposure solutions for a wide range of audiences including companies, government agencies, regulators, investors, law enforcement and consumers.

SecureLayer7

SecureLayer7

SecureLayer7 is an international provider of integrated business information security solutions with an innovative approach to IT security.

Digital Element

Digital Element

Digital Element is a global IP geolocation and intelligence leader with unrivaled expertise in leveraging IP address insights to deliver new value to companies.

Encova Insurance

Encova Insurance

Encova’s cyber liability coverage protects you and your customers in case of a security breach in your company's data.

Quzara

Quzara

Quzara provides trusted advisory services and highly adaptive cybersecurity services to federal, commercial and Defense Industrial Base customers to meet their security compliance and cyber needs.

People Driven Technology

People Driven Technology

People Driven Technology is a customer-obsessed organization. We leverage our decades of business, technology, and engineering experience to deliver outcomes for our clients.

SeeMetrics

SeeMetrics

SeeMetrics is an automated cybersecurity performance management platform that integrates security data and business objectives into a simple interface.

Mindgard

Mindgard

The Mindgard Security Copilot platform secures your Artificial Intelligence, GenAI and LLMs.

Strobes Security

Strobes Security

Strobes is among the world’s first cybersecurity platforms specifically designed for end-to-end continuous threat exposure management.

STACK Cybersecurity

STACK Cybersecurity

STACK Cybersecurity serves as a strategic partner, guiding you through the intricate and dynamic cybersecurity landscape.

SignalRed

SignalRed

SignalRed provides the cutting edge next-generation penetration testing and secure development solutions to startups and large enterprises.