perm_phone_msgUNDER ATTACK? S.O.S. LINE 0114 354 0054

Top Categories



Cyber security TechRepublic

How well do you know your APIs? Not well enough, says Cisco

Many APIs are openly accessible online, and that means big chunks of your apps are, too. Cisco’s Vijoy Pandey has tools and tips to help businesses get visibility into their APIs. Image: Shutterstock/Den Rise There’s a slight problem in the world of app development, and it’s one that’s pretty fundamental [...]

Top Voted
Sorry, there is nothing for the moment.

The tech industry must embrace automation if it wants better security analysts

Cyber security ITPro. today31/10/2019 1

share close

Automating necessary, but menial and time-consuming functions in a business could be the key to unlocking the next wave of advanced analysts and threat hunters.

‘There really isn’t any reason to avoid automation,’ according to Michael Leland, chief technology strategist at McAfee, adding that only through embracing the automation of tasks, specifically in a company’s security operations centre (SOC), can they hope to free up valuable human brainpower for other things.

Advertisement – Article continues below

Speaking at (ISC)2 Security Congress, Leland said every tier 1 analyst wants to move up to tier 2, but are stymied by the relentless and menial work they have to do.

“A tier one analyst whose job is to pick through the events at a very low level I hate to call them it trained monkey work but at the end of the day, a lot of the work they’re doing is mindless.” he said.

“But I can tell them that I’m reducing the workload by 80% by allowing a bunch of the automation to do his job. That time restriction now is removed and he can start performing more advanced techniques that you might want to learn.”

These monotonous duties preventing tier 1 analysts progressing to tier 2 and beyond include triaging all the events that pop up in the SOC and evaluating whether they need remediation.

The time it takes a human to triage an event and perform remediation takes around 75 minutes, what’s known as dwell time. An automated process could do it in just two, according to Leland  and the efficacy of a SOC is measured, in part, on the dwell time it takes to remediate issues.

Advertisement – Article continues below

“The only way to achieve this kind of efficiency is to automate as many of these tasks as possible, whether that’s an AI engine, whether it’s machine learning or simply mining data,” he said.

The value of a unified and automated architecture is huge. Automating processes in a SOC can lead to a 1,000% or more increase in event handling capacity, a 65% quicker triage rate and this is all done with a much greater degree of accuracy compared to what a human can produce.

This is due to a few things, the first being a human’s inability to multi-task. Leland referenced an experiment McAfee did with people who were originally told to enter a room, scan it and then recall all the items they saw in that room after.

People were able to score a 98% recall rate in the first test condition, but when the researchers made them unlock a door before entering the room an added task the recall rate tumbled to 67%.

Related Resource

How AI and automation are changing the way work gets done

Intelligent automation will be a defining factor for the future workforce

Download now

“We think that the combination of humans and machines, the concept of human-machine teaming is probably the only way that we are going to achieve better accuracies, reduced timeframes for meantime detection, reduced meantime for remediation and reducing alert fatigue,” said Leland.

Advertisement – Article continues below

Another factor affecting the effectiveness of a SOC program is the constraints on resources that businesses face. By freeing up tier 1 analysts, organisations can use their analyst’s free time to explore opportunities to improve what those analysts are already doing, or do new things to benefit the business while the automated SOC works in the background.

The need for automation has never been greater for businesses and that’s evidenced by the sheer number of events that trigger alerts in a SOC environment.

Leland said, on average, an enterprise of a significant size will be alerted to 3.2 billion events a month. 3,000 of these will require investigation and only 13 will be critically dangerous.

“How else would you find those 13 in 3.2 billion if you have a human bottleneck? Automation is the only way to achieve that.”

Automation may be one of the industry’s most feared buzzwords it threatens the jobs of many real people working in the industry but a rise in automation should instil fear in no-one, Leland claims.

“The idea behind robots replacing humans is probably something that we’re not going to see in our lifetime,” he said. “But what is more realistic is that we’re going to build environments where humans and AI or computers work better together to create greater value.”

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now

See the original article here: ITPro

Written by: ITPro.

Rate it
Previous post

Designed by Cloud Boffins