6 Steps To Creating An Outstanding Cybersecurity Incident Response Plan [Free Templates]

Posted by CyVent on Sep 1, 2022

Incident Response Plan is the #1 defense strategy to prevent a major crisis when it comes to cybersecurity. After all, as Jamie Ward famously says, “Cyberattack is not a matter of ‘if’, but ‘when’”.

In this article, we'll walk you through the critical elements for the security team when creating a new plan or updating existing plans. Including:

  • Why having a Cybersecurity Incident Response Plan is important
  • 4 Examples of the best Cybersecurity Incident Response Plans 
  • The 6 Key 'Must Haves' in every Incident Response Plan
  • The post-incident response plan

Why Having A Cybersecurity Incident Response Plan Is Important

The National Institute of Standards and Technology (NIST) defines Cybersecurity Incident Response Plan (CIRP) as: “The documentation of a predetermined set of instructions or procedures to detect, respond to, and limit consequences of a malicious cyber attack against an organization’s information system(s).”

Having a CIRP cannot be underestimated by companies. Research shows that companies that prepare to deal with the effects of a cyberattack efficiently have a considerably lower average loss.

According to The Cost of Data Breach Report 2022, the average cost of a breach for businesses with incident response (IR) capabilities is 58% lower than those without IR capabilities. Breaches at organizations with IR capabilities cost an average of $3.26 million in 2026, compared to $5.92 million from organizations with no IR capabilities.

 

The Cost of Data Breach Report 2022

 

So why do businesses with incident response plans have lower breach costs? Having a complete and up-to-date CIRP implies constantly passing on information to employees and offering training. This helps to create an organizational culture that favors the recognition and prevention of cyber threats. 

Another aspect is that by directing efforts to prevent attacks, it is possible to have more clarity on the cybersecurity gaps that are being left. That means you can correct them before they are found by criminals. All this allows an incident to be corrected much more quickly and efficiently.

However, not all companies have a plan. According to a survey by shred-it, 63% of C-level executives and 67% of small businesses in the U.S. do not have an incident response plan.

Another problem is that many plans are not done completely and consistently. For example, many security leads just focus on the most critical incidents. Yet, any fragility or risk to an endpoint must be defended vigorously to prevent a loophole allowing criminals from accessing valuable information. 

A consistent cybersecurity plan considers ALL vulnerabilities. As Window Snyder states, “One single vulnerability is all an attacker needs”.

 

Cybersecurity Quote

4 Examples of The Best Incident Response Plans

Here are four of the best examples we’ve pulled together that you can use as a blueprint to guide your planning for possible attacks.

Michigan Government Incident Response Plan

Computer Security Incident Handling Guide - NIST

Incident Response and Management: NASA Information Security Incident Management

Cyber Incident Response Plan - Government of Victoria, Australia

 

The 6 Key 'Must Haves' In Every Incident Response Plan

When it comes to creating a robust cybersecurity incident response plan, there are six key aspects that need to be included:

1. Prioritize Incident Levels

Prioritizing the incident level of an attack is critical to quickly identify the risk of the attack. This involves understanding which systems are critical to the functioning of your business and understanding the different types of user risk interactions. As seen in the Human Factor Report 2022 diagram below.

 

User Risks Interact

 

 

2. Complete Visibility of All Your Company's Systems And Resources

Clarity is a key aspect of the incident response plan. Knowing all the assets and resources that the company has is important when defending them. In addition, having complete visibility into the company's up-to-date data is critical to knowing where to act and in what way. Therefore, access to detailed and real-time data on the functioning of the company's systems is essential. With this, an attack can be identified more quickly.

 

3. Define Incident Response Plan Responsibilities

Establish those responsible for each stage of the plan, providing their level of authority and the list of responsibilities. This step is important because it allows people to act faster.

Create a full-time team to handle incident response or train staff to be on call. Professionals must have sufficient authority and responsibility to make the necessary decisions quickly.

Quick response to incidents is crucial on holidays and weekends because there is often a reduction in company protection. We know that Ramsonware is detonated every day of the week, as seen in the data below from RiskRecon.

 

Criminals arent taking the weekends off

4. Security Partners

Asking for help is no shame. On the contrary. Having reliable suppliers can prevent huge damage to the company. Therefore, it is important that these partners are mapped and that the team responsible for cybersecurity has easy access to the list. These contacts may include government security officials, privacy regulatory authorities, audit committees, press offices, etc.

 

5. Easy Access to CIRP

Another key point is to ensure that all employees and people relevant to the company have access to the CIRP. There's no point in putting together an incredible and complete plan if no one knows it exists. It is also important to consider a backup so that the document is accessible even if the internal servers are compromised.

 

6. Constant Training

Employees must be trained and have clarity on the steps that must be followed in the event of a threat, as well as their responsibility in attack situations. Training is best delivered little and often, just as software and systems must be updated periodically to stay ahead of the latest threats.

 

The Importance of Simulated Attacks

One of the best ways to equip employees with the skills to respond to attacks is with simulated attacks. They are designed to test everything that was established in the plan and delivered in training.

One of the most effective training programs is the Red Team Exercises, which simulate the conditions of an attack to identify vulnerabilities in your company's system. This type of exercise is critical to testing an incident response plan before it is done by a real hacker.

 

Red Team Exercise

Why You Need A Post-incident Response Plan

A post-incident response plan helps the company to be more protected from the next attack. 

This involves documenting everything to form history and feed a repository that will help the company to be more prepared for future attacks. Including the actions that were taken, the protocols that were made, and the measures that effectively eradicated the incident.

There are several CIRP frameworks. The National Institute of Standards and Technology (NIST) is one of the most recognized and includes four steps:

  1. Preparation
  2. Detection & Analysis
  3. Containment Eradication & Recovery
  4. Post-Incident Activity

NIST Framework

The unique part about the NIST approach is it foresees a non-linear action. That is, the plan must always be revisited and updated according to new information, new threats, and new skills of the team.

Likewise, after an attack, the plan must be updated. This can be taken a stage further by exchanging incident breach experiences with other companies can help your organization to be more prepared.

Here are some questions that can help when it comes to updating the plan after an attack:

  • What attack was carried out and at what exact moment did it take place?
  • What was the cybercriminal's entry point?
  • Who perceived the threat and at what time?
  • What was the first act after the incident was detected?
  • How was the team informed about the problem? What was the team's reaction?
  • What steps were taken to combat the problem? Who led this process?
  • What were the positives and negatives of the responsible team approach? What is the lesson in preparing for the next incident?
  • How can we prepare ourselves not to leave gaps and not suffer from this type of vulnerability in the future?
  • Can any tool or system help us detect this type of vulnerability and respond more quickly to this type of attack in the future?
  • What aspects, learned from this incident, can we include in staff training so that staff is better prepared?

 

Conclusion

Research shows that having a Cybersecurity Incident Response Plan (CIRP) significantly reduces the cost of a cyberattack on a company. However, many companies don’t have a robust plan in place or fail to update them consistently. To be effective, a CIRP must be constantly revisited and updated.

In this article, we have highlighted the importance of having an incident response plan, best practice examples of incident response plans, the 6 key 'must haves' in every Incident Response Plan, and why you need a post-incident response plan. 

 

Need help creating your CIRP?

Need help creating a cybersecurity incident response plan? CyVent has access to the leading IR solutions. We rigorously curate our approved partners and monitor all stages of implementation. We also carry out training and tests that will raise the level of your company's response and make it more prepared to face threats.

CyVent experts are on hand to help you create the plan, train your employees, and choose the right tools to protect your business.

If you want more information, book a call on  https://www.cyvent.com/assess-company-cyber-threats/ 

CYV_banner_1_alt-1

 

 

 

 

How to Protect Your Company from Phishing

Posted by Yuda Saydun on May 12, 2022

Haven

According to the Computer Security Resource Center definition, Phishing is “a technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a website, in which the perpetrator masquerades as a legitimate business or reputable person”. This scam is increasingly common and has devastating consequences for companies.

According to IBM's Cost of a Data Breach Report 2021, Phishing was the second costliest average total cost of the 10 initial attack vectors in the study, at $4.65 million. Furthermore, phishing was the second most frequent initial attack vector, being the gateway to 17% of threats.

The different types of Phishing:

There are different types of phishing. Below, we list some of the most common:

Email Phishing: attacks carried out through messages via email, using fake domains, which imitate those of real companies. It can trick the victim into clicking on a malicious website, making a suspicious download, or tricking them into sending information.

Spear Phishing: While Email Phishing is sent in bulk, for many people, Spear Phishing is personalized, through an email with personal information from the person receiving the message. With this, the chances of the victim falling for the scam is much greater.

Whaling: This Phishing scam targets the “big fish”, meaning the company's top executives. These people usually have a lot of information available on the internet. With dedication and study, scammers manage to mount a very believable bait, which increases the chances of the victim falling for the scam. This type of attack is worrying, as CEOs and C-Levels have access to especially sensitive company information.

Voice Phishing: Voice simulation programs are getting more and more sophisticated. Through this type of resource, scammers are able to simulate voice messages and even phone calls, posing as banking institutions, for example, to collect information or practice scams.

Smishing: This scam involves fake SMS messages. Scammers usually use information from leaks, or information collected from research on social networks, to make the scam seem more real.

These Phishing messages typically follow patterns such as:

  • Sense of urgency
  • Presence of writing errors
  • Unusual requests such as payments or credential information
  • Use of non-standard company logos

Book a Call

Given the importance of this threat, here are some strategies that can help your company protect itself from scams:

Tips to protect your business from Phishing Scams:


Qualified and constant training of employees

Keeping employees trained and on the lookout is critical to ensuring a functional end-to-end cybersecurity strategy. Attacks by criminals are increasingly sophisticated, ranging from viruses disguised as attachments to well-rehearsed phone calls.

According to Google's Transparency Report, 46,000 new phishing websites were created every week in 2020.

CyVent Product Page_Haven

Employees need to know the dangers, the risks of attacks, and the correct procedures for acting in a phishing situation.

This training can be done by the internal cybersecurity and technology team or delivered automatically by a partner company through short 2-3 minute videos.

Controlled tests

Sending controlled tests allows you to identify the extent to which your company is susceptible to attacks. In addition, fictitious attacks give clues to where the biggest vulnerabilities are and which aspects of cybersecurity the company should strengthen.

A good password strategy

Passwords are a particularly sensitive topic when it comes to phishing. Without the correct management of passwords, with single access, the hacker can have control over several logins. Thus, in addition to training your employees to create strong passwords, it is important to raise awareness about the use of unique passwords for each access, reducing damage in the event of an attack.

Install good email protection solutions

The corporation can invest in efficient solutions to stop suspicious messages and requests through its inbound channels. These malicious emails are blocked and tested by the tools, preventing the scam from reaching the recipient.

CyVent proudly offers Haven, a managed protection, detection, and response solution as a service made for businesses of all sizes, providing enterprise-class security protection, along with controls, management, and monitoring options, with an excellent protection program for your endpoints, your network and your emails.

Use the principle of least privilege

Restricting server access is also a good alternative to protect information. Employees should have access to basic servers, accessing servers with more important information only when necessary. That way, in case of phishing, the threats are found.

The problems your company faces are unique. So your answer should be too. With CyVent you have expert support, cutting-edge software, and access to rigorously selected solutions with 24/7 monitoring.

Book a call: www.cyvent.com/contact-us 

CyVent | Contact Us

Artificial Intelligence and Information Security: Fact vs Fiction

Posted by Yuda Saydun on Jul 8, 2019

Machine learning, deep learning, generative adversarial networks and other AI technologies have burst onto the cybersecurity scene over the last year. Software vendors and MSSPs are scrambling to bring their particular flavor of AI cyber security to market and claim their stake as industry leaders.

While AI has quickly become table stakes for an effective security posture, some of it can also seem to be overhyped in some respects. In this post, we’ll aim to cut through the superlatives and provide a few thoughts on the role of artificial intelligence in cyber security.

Artificial Intelligence in Cyber Security Does Not Replace Traditional Tools

By claiming that AI will replace traditional tools while lowering labor costs and probably making coffee at the same time, some advertising has put AI on a pedestal that it may not have achieved yet.

Here are some things that AI cyber security definitely will not replace. Security teams will still need to keep around:

  • Employee training and a security-sensitive culture
  • Smart policies and processes
  • Qualified architects, managers, engineers, and analysts
  • Rock-solid, layered infrastructure with effective controls around it

If you find yourself saying, “Wait, that’s 95% of my security program,” you’re right. Artificial intelligence in cyber security is a complement to a well-run cyber framework, not a replacement for it.

Must-Ask Questions When Evaluating AI Cyber Security Tools

We all have seen that technology can be promoted with grand promises backed by sometimes disappointing results. To avoid a dud in your AI implementation, you may want to sit down with your security team and your vendor rep to go over a few questions:

  • How do your AI algorithms actually work? How mature is the technology? What are its blind spots?
  • How well does it avoid false positives and false negatives?
  • How do you measure the incremental benefits and the expected ROI?
  • How will it protect us from insider threats?
  • What’s your definition of ‘real-time’?
  • Which attack vectors, file type, operating systems do you cover?
  • How frequently does it need to be updated?
  • How does it handle APT’s, zero-days and zero-hours?
  • What outside support are we going to need to implement and maintain this?
  • How much additional training will we need to use this effectively?
  • Does it produce usable reports that actually mean something?
  • What results have your other clients seen from it?
  • Does it outperform what I already have, or will it be just another software bloating up my network?

Pitfalls to Avoid When Implementing an AI Cyber Security Solution

Adding software to your organization’s toolkit is rarely a trivial matter, and even less so when you’re dealing with AI. Here are some potential mistakes when deploying an AI cyber security tool:

  • Expecting a “set-and-forget” solution that will replace the whole security program: See the first section of this post.
  • Thinking that an in-house developed solution will be best-in-show without exploring other available options.
  • Expecting that the AI tool won’t require any customization or integration.
  • And possibly the most delicate one: Thinking it’ll all work out on automatic pilot without specialized AI expertise on your team or assistance from AI safety experts.

The fact of the matter is that it is no longer viable to delay implementation of robust AI cyber security tools. Bad actors have already started using AI.

A talented cybersecurity team and company-wide awareness trainings go a long way. Artificial intelligence in cyber security simply brings a needed support structure that can assist your teams to prevent attacks and accelerate mitigation if needed. As businesses undergo the digital transformation, it is imperative they also leverage new developments in cyber capabilities and include them in their thinking from the very beginning of their process. Cyber security cannot be an after-thought.

CyVent is a Certified Partner of global leaders in augmented intelligence applied to cybersecurity. Our cutting edge, AI-driven solutions help organizations transition from the classic remediation approach to security to a more pre-emptive posture, which ultimately increases prevention, decreases times-to-resolution and automates cybersecurity operations. 

Click here to contact us if you would like learn more about the role of artificial intelligence in cyber security.

Cybersecurity in Crisis

Posted by Yuda Saydun on Nov 20, 2018

Responding to Cybersecurity Threats: How to Assess Your Tools and Cyber Strategy

76687265_l-1080x736Cybersecurity is in crisis. Cybersecurity threats are becoming increasingly sophisticated and pervasive. Bad actors have access to all the latest technology and tools, including artificial intelligence, for free or very little cost. They have endless time and resources to send out millions of cyberattacks – and need only a single successful attack to reap a windfall. It’s asymmetric warfare, and the attackers’ tools just keep improving.

In response, dozens of new cybersecurity providers seem to enter the market every day. Artificial intelligence, new tools and easy access to information mean that innovation keeps accelerating daily. With cybersecurity threats regularly making headlines, and pressure on companies to secure their data (and customers’ data) growing, new cybersecurity providers barely need to advertise to gain customers’ attention. For the same reasons, venture capitalists are eager to fund cybersecurity firms. The traditional big players in the market are rushing to upgrade their outdated packages. It’s a noisy marketplace, and companies trying to protect their data and systems are confused about how best to do so.

How Companies Are Addressing Cybersecurity Threats

Companies have responded to the crowded cybersecurity marketplace in different ways. Some just bury their heads in the sand, deciding to deal with incursions when they occur, or to hope that they’re too small to be worth targeting with a cyberattack. Others are spending way too much money on cybersecurity, experimenting with every new product that hits the market.

Many companies believe that they already have all the tools they need to combat cybersecurity threats, but haven’t properly patched their existing systems, which need regular updates to combat ever-changing cyber threats. On top of that, many companies experience dozens of little attacks every day, from all sides, and it’s hard to know where to put resources.

But burying your head in the sand or sticking with old tools that don’t counteract today’s cybersecurity threats is simply not an option. And throwing money at whatever strikes a chord isn’t an effective strategy, either.

What Is an Effective Strategy for Managing Cybersecurity Threats?

Resolving the cybersecurity crisis starts with an honest cyber vulnerability assessment, either by your internal experts or by outside experts.

Ultimately, this cyber vulnerability assessment should give you a map of where your company is in terms of cybersecurity. Next, you’ll need a map of where you’re going. Your experts should prepare a plan that:

  • Closes your cybersecurity gaps over time
  • Analyzes the financial risks of not closing gaps and prioritizes closing the gaps that put the company at the most risk
  • Includes a company cybersecurity policy that every employee is expected to follow (much like a dress code or conduct policy)

This cyber vulnerability assessment and plan give you a framework for cybersecurity decisions. Armed with an understanding of your risk profile, your budget, your weaknesses and the consequences of various breaches, your experts should be able to recommend cybersecurity investments that will provide the best ROI for your company. The key is to remain true to this framework, even as new cybersecurity threats rear their ugly heads. Certainly, you want to maintain some flexibility, with strategies adjusting as truly required. But stick with what you know to be important to your business, and let that lead your investment decisions.

Wondering about your ability to respond to cybersecurity threats? Schedule a free, confidential assessment today.

Why Artificial Intelligence Is the Future of Cybersecurity

Posted by Yuda Saydun on Aug 28, 2018

Screen-Shot-2018-08-28-at-3.25.37-PMTo thwart cyber attacks, the traditional approach has been to focus on the perimeter to repel intruders. But over time the perimeter has become a sieve. Today’s hackers easily break through it or find ways around it. In fact, a new study by RiskIQ estimates the cost cybercrime at $856,000 per minute. AI cybersecurity solutions directly address these challenges, which is why many now view the technology as the future of cybersecurity.

Going Beyond the Perimeter Is the Future of Cybersecurity

Focusing on defending the perimeter has been akin to wearing a Hazmat suit in a hostile environment: Any small perforation, and you were doomed to unexpected consequences at the hands of hackers who had the time and intellect to play games with your critical assets.

Not only are perimeters fragile and the gap in available talent huge, but most IT teams are often so stretched for resources that they can’t keep up with the updates necessary to protect against the myriad attacks that can penetrate a company’s external defenses. WannaCry was just an example of that.

Over the years, computing speed has grown exponentially –multiplying more than 3,000x since 1991 – to the point where even a $5 Raspberry Pi can now run deep learning algorithms. So it’s not a surprise that, in recent years, focus has shifted to using AI cybersecurity to complement traditional defenses in many ways and neutralize stealthy, unknown threats that may have already breached the perimeter before any irreparable damage to network or data is done.

Applying Artificial Intelligence in Cybersecurity

In AI cybersecurity programs, which are now being embedded in companies’ networks, endpoints and data are evolving into immune systems that allow internal defenses to shorten the dwell-time and pre-empt the devastation that can follow a breach.

While there is no need to abandon the perimeter, today’s smart CISOs are squarely focused on increasing their AI-driven pre-emption capabilities and boosting their own auto-immune systems. Artificial intelligence in cybersecurity is by no means perfect yet, but cybercriminals are already using automation and machine learning 24x7x365. In the never-ending cat-and-mouse game, AI is slated to continue gaining ground to build predictive capabilities and strengthen defenses for the foreseeable future.

To learn more about how AI is impacting the future of cybersecurity, download this white paper from Darktrace: Machine Learning in Cybersecurity.

 

ICS Cybersecurity: Using AI in Operational Technology Security

Posted by Yuda Saydun on Jun 18, 2018

Updated on May 7, 2019

Recent headlines have been abuzz with ICS experts warning of grid vulnerability to hacking. Digital threat actors have become exceptionally skilled at infiltrating every type of computer network. Industrial Control Systems (ICS) are no different: While ICS networks were generally thought to be more secure due to not communicating outside of the corporate network or on the internet, attackers have managed to compromise them and steal valuable production data.

Some of the most effective tools for ICS cybersecurity are the emerging technologies in Machine Learning and Artificial Intelligence. By combining real-time data monitoring with orchestration and automated response, AI/ML solutions are proving their value when compared to legacy systems and human-intervention driven response times.

A Real-World Example of Using AI for ICS Network Security

At the 2017 Black Hat Europe conference, security research firm CyberX demonstrated how data exfiltration was possible from a supposedly air-gapped ICS network. By delivering a payload of specific ladder logic code into Programmable Logic Controllers, the attack was programmed to send out copies of data through encoded radio signals which can be received by AM radios and analyzed by special-purpose software. As the communication channel is outside the TCP/IP stack, there is no encryption to safeguard the data once it’s captured.

How does AI respond to this threat? In this case, Machine Learning can be used to craft an algorithm which establishes a “normal” state and monitors traffic and configurations to compare against that state. This baseline can include network traffic, equipment settings, and even the source code of PLCs. With its continuous heartbeat checks, the algorithm can detect when the system deviates from the baseline and immediately alert security staff of the change.

Another real-world example involving operational technology security comes very recently from the ransomware attack on Norsk Hyrdo, one of the world’s largest aluminum producers based in Norway. The ransomware infected multiple systems across the organization in a number of locations.The company’s production environments were forced to stop production or change to manual systems. The ransomware supported the changing of administrator passwords, and as the majority of servers were under the same domain, the attack could spread more rapidly than if there had been a combination of network segmentation and separately administered domains. In the case of Norsk, an AI cybersecurity layer would have been able to spot irregularities in system access and lockdown channels before the hackers could manipulate the permissions.

AI and ICS Cybersecurity: Adding Value to Existing Systems

Where does AI fit into your existing ICS network security program? You already have the ICS equipment sectioned off on its own VLAN(s), firewalled, monitored, and protected by IDS/IPS, SIEMs, and other security tools. Where does it make sense to insert AI/ML into the equation?

The biggest advantage of implanting an AI solution for ICS cybersecurity is its real-time response and orchestration. AI tools don’t need to wait for security staff to make a decision. They don’t see a black and white picture of firewall rules which often miss malware traffic flying under the radar, masquerading as “normal” network signals. Machine algorithms can detect abnormal data exchanges and immediately respond to the threat, long before a SOC resource would be alerted. Some AI offerings can even monitor devices that don’t communicate over TCP/IP, creating powerful visibility into non-networked equipment.

A particularly interesting tool to protect industrial control systems is Cyberbit’s ScadaShield, a layered solution to provide full stack ICS network detection, visibility, smart analytics, forensics and response. ScadaShield performs continuous monitoring and detection across the entire attack surface for both IT and OT components and can be combined with SOC automation to trigger workflows that accelerate root cause identification and mitigation.

Large-scale processes operating at critical power generation, electrical transmission, water treatment, and refining sites, as well as major manufacturing plants are more at risk than ever.  The good news is that new developments in Artificial Intelligence and Machine Learning have created new ways to protect these systems and improve ICS cybersecurity.

If you haven’t already done so, this is a good time to consider adding an AI/ML solution to your security perimeter to take your prevention and response times to the next level. Click here to contact us if you would like to learn more about artificial intelligence in cyber security.

PHOTO CREDIT: UNSPLASH | RAMÓN SALINERO

Artificial Intelligence and ICS Cybersecurity: Filling Gaps in Operational Technology Security

Posted by Yuda Saydun on Jun 18, 2018

ramon-salinero-271002-unsplash-1080x720Recent headlines have been abuzz with ICS experts warning of grid vulnerability to hacking. Digital threat actors have become exceptionally skilled at infiltrating every type of computer network. Industrial Control Systems (ICS) are no different: While ICS networks were generally thought to be more secure due to not communicating outside of the corporate network or on the internet, attackers have managed to compromise them and steal valuable production data.

Some of the most effective tools for ICS cybersecurity are the emerging technologies in Machine Learning and Artificial Intelligence. By combining real-time data monitoring with orchestration and automated response, AI/ML solutions are proving their value when compared to legacy systems and human-intervention driven response times.

A Real-World Example of Using AI for ICS Network Security

At the last Black Hat Europe conference, security research firm CyberX demonstrated how data exfiltration was possible from a supposedly air-gapped ICS network. By delivering a payload of specific ladder logic code into Programmable Logic Controllers, the attack was programmed to send out copies of data through encoded radio signals which can be received by AM radios and analyzed by special-purpose software. As the communication channel is outside the TCP/IP stack, there is no encryption to safeguard the data once it’s captured.

How does AI respond to this threat? In this case, Machine Learning can be used to craft an algorithm which establishes a “normal” state and monitors traffic and configurations to compare against that state. This baseline can include network traffic, equipment settings, and even the source code of PLCs. With its continuous heartbeat checks, the algorithm can detect when the system deviates from the baseline and immediately alert security staff of the change.

Another real-world example involving operational technology security comes very recently from the ransomware attack on Atlanta’s municipal infrastructure, which involved encrypting city files, locking access to online services, and blocking the city from processing court cases and warrants. This is just the latest in a string of attacks on American cities. Previously, hackers gained access to Dallas’s tornado warning system and set off sirens in the middle of the night. In the case of Atlanta, an AI cybersecurity layer would have been able to spot irregularities in system access and lockdown channels before the hackers could manipulate the permissions.

AI and ICS Cybersecurity: Adding Value to Existing Systems

Where does AI fit into your existing ICS network security program? You already have the ICS equipment sectioned off on its own VLAN(s), firewalled, monitored, and protected by IDS/IPS, SIEMs, and other security tools. Where does it make sense to insert AI/ML into the equation?

The biggest advantage of implanting an AI solution for ICS cybersecurity is its real-time response and orchestration. AI tools don’t need to wait for security staff to make a decision. They don’t see a black and white picture of firewall rules which often miss malware traffic flying under the radar, masquerading as “normal” network signals. Machine algorithms can detect abnormal data exchanges and immediately respond to the threat, long before a SOC resource would be alerted. Some AI offerings can even monitor devices that don’t communicate over TCP/IP, creating powerful visibility into non-networked equipment.

A particularly interesting tool to protect industrial control systems is Cyberbit’s ScadaShield, a layered solution to provide full stack ICS networkdetection, visibility, smart analytics, forensics and response. ScadaShield performs continuous monitoring and detection across the entire attack surface for both IT and OT components and can be combined with SOC automation to trigger workflows that accelerate root cause identification and mitigation.

Large-scale processes operating at critical power generation, electrical transmission, water treatment, and refining sites, as well as major manufacturing plants are more at risk than ever.  The good news is that new developments in Artificial Intelligence and Machine Learning have created new ways to protect these systems and improve ICS cybersecurity.

If you haven’t already done so, this is a good time to consider adding an AI/ML solution to your security perimeter to take your prevention and response times to the next level. Click here to get in touch with our team today.

PHOTO CREDIT: UNSPLASH | RAMÓN SALINERO

The Role of Artificial Intelligence in Cyber Security: Separating Fact from Fiction

Posted by Yuda Saydun on Jun 4, 2018

adrien-milcent-192445-unsplash-1080x720Machine learning and artificial intelligence have exploded onto the cybersecurity scene over the last year. Software vendors and MSSPs are scrambling to bring their particular flavor of AI cyber security to market and claim their stake as industry leaders.

While AI has quickly become table stakes for an effective security posture, some of it can also seem to be overhyped in some respects. In this post, we’ll aim to cut through the superlatives and provide a few thoughts on the role of artificial intelligence in cyber security.

Artificial Intelligence in Cyber Security Does Not Replace Traditional Tools

By claiming that AI will replace traditional tools while lowering labor costs and probably making coffee at the same time, some advertising has put AI on a pedestal that it may not have achieved yet.

Here are some things that AI cyber security definitely will not replace. Security teams will still need to keep around:

  • Employee training and a security-sensitive culture
  • Smart policies and processes
  • Qualified architects, managers, engineers, and analysts
  • Rock-solid, layered infrastructure with effective controls around it

If you find yourself saying, “Wait, that’s 95% of my security program,” you’re right. Artificial intelligence in cyber security is a complement to a well-run cyber framework, not a replacement for it.

Must-Ask Questions When Evaluating AI Cyber Security Tools

We all have seen that technology can be promoted with grand promises backed by sometimes disappointing results. To avoid a dud in your AI implementation, you may want to sit down with your security team and your vendor rep to go over a few questions:

  • How do your AI algorithms actually work? How mature is the technology? What are its blind spots?
  • How well does it avoid false positives and false negatives?
  • How do you measure the incremental benefits and the expected ROI?
  • What outside support are we going to need to implement and maintain this?
  • How much additional training will we need to use this effectively?
  • Does it produce usable reports that actually mean something?
  • What results have your other clients seen from it?
  • Does it outperform what I already have, or will it be just another software bloating up my network?

Pitfalls to Avoid When Implementing an AI Cyber Security Solution

Adding software to your organization’s toolkit is rarely a trivial matter, and even less so when you’re dealing with AI. Here are some potential mistakes when deploying an AI cyber security tool:

  • Expecting a “set-and-forget” solution that will replace the whole security program: See the first section of this post.
  • Thinking that an in-house developed solution will be best-in-show without exploring other available options.
  • Expecting that the AI tool won’t require any customization or integration.
  • And possibly the most delicate one: Thinking it’ll all work out on automatic pilot without specialized AI expertise on your team or assistance from AI safety experts.

The fact of the matter is that it is no longer viable to delay implementation of robust AI cyber security tools. Bad actors have already started using AI.

A talented cybersecurity team and company-wide awareness trainings go a long way. Artificial intelligence in cyber security simply brings a needed support structure that can assist your teams to prevent attacks and accelerate mitigation if needed. As businesses undergo the digital transformation, it is imperative they also leverage new developments in cyber capabilities.

CyVent is a Certified Partner of Darktrace, a global leader in machine learning applied to cybersecurity, whose technology can detect and autonomously respond to cyber threats that legacy systems miss. Learn more about Darktrace’s capabilities in this white paper.

 

A New Digital Defense: Machine Learning and Cybersecurity

Posted by Yuda Saydun on May 28, 2018

Updated on May 7, 2019

It’s no surprise to anyone that digital threats are evolving and becoming more complex than ever before. As attackers take their game to the next level, an organization’s cybersecurity program should grow and become smarter along with them. The latest step forward in digital defense comes in the form of machine learning and Artificial Intelligence algorithms that combine the reliability of traditional signatures with the power of Big Data analytics.

Legacy Tools No Longer the Answer to Growing Threats

With the ever-increasing sophistication of today’s security threats, traditional layers of defense like SIEMs, IDS/IPS, and antimalware applications are no longer sufficient. While these tools are certainly effective at thwarting routine port scans or spam emails, the smart security administrator needs to add another layer of security to be truly protected from advanced attacks. Signature-based defenses can’t scale fast enough or stay up to date with critical threats like zero-day attacks or a targeted phishing campaign, and reactive security programs are an open invitation for a data breach. While a business can add more resources to its SOC, or invest in the most engaging security awareness program, an organization’s defense is only as strong as the tools used in that defense. The reality is that security programs built on tools from as recent as 3-4 years ago are already outdated in the face of today’s threats.

Combining Traditional Defenses With Modern Data Analytics

 What is the answer to the increasing complexity of these attacks? By pairing the usefulness of legacy solutions with a boost from Big Data, machine learning allows administrators to identify and prevent new or anomalous threats while controlling attacks from traditional threat vectors. Beginning with a baseline of signature files and a sample of normal activity from the network, new security devices can implement machine learning to automatically detect and shut down advanced threats that would otherwise slip past legacy perimeters.

An important component of these AI-driven devices is the ability to aggregate and analyze data from all the environments they are installed in, across multiple customers and industries. For clients who choose to opt-in to the program, smart devices can share their anonymized data in a pool of information from other clients, greatly increasing the samples that algorithms can be based upon. By analyzing data from such a large pool, these devices can leverage predictive analysis to protect an organization from threats that are new to their market but have been seen before in other industries.

In summary, security professionals should be aware that traditional lines of defense are no longer sufficient against today’s evolving threats. Machine intelligence and Big Data are changing the cybersecurity game by combining legacy methods with modern analysis and behavior models and should be seriously considered while building a well-rounded security program. Click here to learn more about machine learning in cyber security.

PHOTO CREDIT: UNSPLASH | JASH CHHABRIA

Machine Learning as a New Line of Cybersecurity Defense

Posted by Yuda Saydun on May 28, 2018

jash-chhabria-658499-unsplash-1080x718It’s no surprise to anyone that digital threats are evolving and becoming more complex than ever before. As attackers take their game to the next level, an organization’s cybersecurity program should grow and become smarter along with them. The latest step forward in digital defense comes in the form of machine learning and Artificial Intelligence algorithms that combine the reliability of traditional signatures with the power of Big Data analytics.

Legacy Tools No Longer the Answer to Growing Threats

With the ever-increasing sophistication of today’s security threats, traditional layers of defense like SIEMs, IDS/IPS, and antimalware applications are no longer sufficient. While these tools are certainly effective at thwarting routine port scans or spam emails, the smart security administrator needs to add another layer of security to be truly protected from advanced attacks. Signature-based defenses can’t scale fast enough or stay up to date with critical threats like zero-day attacks or a targeted phishing campaign, and reactive security programs are an open invitation for a data breach. While a business can add more resources to its SOC, or invest in the most engaging security awareness program, an organization’s defense is only as strong as the tools used in that defense. The reality is that security programs built on tools from as recent as 3-4 years ago are already outdated in the face of today’s threats.

Combining Traditional Defenses With Modern Data Analytics

 What is the answer to the increasing complexity of these attacks? By pairing the usefulness of legacy solutions with a boost from Big Data, machine learning allows administrators to identify and prevent new or anomalous threats while controlling attacks from traditional threat vectors. Beginning with a baseline of signature files and a sample of normal activity from the network, new security devices can implement machine learning to automatically detect and shut down advanced threats that would otherwise slip past legacy perimeters.

An important component of these AI-driven devices is the ability to aggregate and analyze data from all the environments they are installed in, across multiple customers and industries. For clients who choose to opt-in to the program, smart devices can share their anonymized data in a pool of information from other clients, greatly increasing the samples that algorithms can be based upon. By analyzing data from such a large pool, these devices can leverage predictive analysis to protect an organization from threats that are new to their market but have been seen before in other industries.

In summary, security professionals should be aware that traditional lines of defense are no longer sufficient against today’s evolving threats. Machine intelligence and Big Data are changing the cybersecurity game by combining legacy methods with modern analysis and behavior models and should be seriously considered while building a well-rounded security program.

If you would like to learn more about machine learning in cybersecurity, click here to download "The Enterprise Immune System: Proven Mathematics and Machine Learning for Cyber Defense"...

PHOTO CREDIT: UNSPLASH | JASH CHHABRIA