Today’s cybercriminals are technically proficient, creative, well-funded, and well-equipped. This year’s high profile attacks on banks, retailers and critical national infrastructure has proven just how sophisticated and persistent they can be. Indeed, we only need to consider the recent WannaCry attack on the NHS to understand how dangerous modern-day attacks are, for our data and our lives.
A typical organisation is data-driven and powered by technology, which means they often have huge volumes of data that – unless adequately protected – could become easily accessible to hackers. With data breaches covering the front pages on a regular basis and EU General Data Protection Regulations (GDPR) coming into force next year, businesses are under growing pressure to detect and mitigate threats as soon as they arise.
Why prevention is not the silver bullet
Up until now, there’s no doubt that the speed of innovation among today’s cybercriminals has increasingly outpaced the ability of their targets to evolve their security defences. The fact is, cybercriminals only need to get it right once to gain access to what they want, whilst businesses need to get it right every time – a rather daunting task for even the most successful security operations team to take on.
Tipping the balance even further, security teams are increasingly being forced to figure out how to do more with less. The amount of information a company processes is not getting smaller – in fact, it’s getting significantly bigger – yet security teams are expected to deliver the same success rate with the same amount of resources. They need to be able to define what ‘normal’ network activity looks like so they can identify and neutralise a potential threat straightaway, and when this is done manually, it’s not an easy job.
Security teams are often faced with an overwhelming avalanche of false positives and can easily be distracted by alarm fatigue, which means it could be possible for a compromise to slip through the net. Threat detection has simply become too big a job for security teams to handle on their own – which is why cloud-based Artificial Intelligence (AI) is playing a bigger role.
AI and the Cloud
Security teams cannot afford to spend time on extensive manual threat-hunting exercises or deploying and managing yet another security product.
Security teams cannot afford to spend time on extensive manual threat-hunting exercises or deploying and managing yet another security product. Cloud-based security enables easy, reliable and rapid insight into their network, which not only saves companies crucial time and money but provides them with access to a class of analytics that are not otherwise technically practical or affordable to deploy on-premise.
Combined with AI and automation, this technology gives organisations the rapid detection and response capabilities they need to fight today’s cyber attackers. It enables them to cut through the noise and detect serious threats earlier in their lifecycle, thus eliminating time-consuming manual threat detection and response exercises, and allowing analysts to focus on higher-value activities that require direct human touch. Cloud-based AI ups the ante for businesses as it allows them to analyse different behavioural models to characterise how users are interacting with the IT environment and whitelist a user’s “normal” online behaviour in order to pursue user-based threats, which have previously been difficult to identify manually.
Cloud AI from beginning to end
Cloud-based AI needs to be applied throughout the cyberattack lifestyle in order to automate and enhance entire systems of work and to enable faster and more efficient breach detection. Unfortunately, hackers are constantly looking for new ways to breach existing defence systems, and are proficient at staying a step ahead of the new technology and exploiting the new and existing vulnerabilities. While breaches cannot be completely prevented, Cloud AI plays a key role in stopping these motivated hackers in their tracks. The technology is proactive and predictive, automatically learning and evolving to alert even the smallest changes in events and behaviour models that suggest a hacker might be breaching a system.
[clickToTweet tweet=”‘When #AI is deployed in the #cloud, businesses benefit from #Collective Intelligence…’ Read more ->” quote=”When AI is deployed in the cloud, businesses benefit from collective intelligence and a broader perspective to get even smarter, and even fast.”]
When AI is deployed in the cloud, businesses benefit from collective intelligence and a broader perspective to get even smarter, and even fast. Imagine incorporating real-world insight into specific threats in real-time. This will advance the ability of AI-powered analytics to detect even the stealthiest or previously unknown threats more quickly and with greater accuracy than ever before.
Thus far, the war against cybercriminals has not been a fair fight, however, organisations are increasingly shifting their attitudes about threat detection. No longer are they relying on prevention-only tactics; instead they are starting to look for ways that they can evolve at the same paces as the hackers. AI has the power to help these companies alter the terms of engagement, particularly when coupled with the advantages that cloud security can bring. Automation and intelligence is tilting the scales in favour of the good guys, allowing organisations to automatically detect and neutralise threats with little or no room for error.
Vice President and Managing Direction, EMEA at LogRhythm