Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/18/2018
09:00 AM
Joe Cosmano
Joe Cosmano
Partner Perspectives
Connect Directly
LinkedIn
RSS
50%
50%

How to Leverage Artificial Intelligence for Cybersecurity

AI and predictive analytics should be used to augment a company's security team, not replace it. Here's why.

Artificial intelligence (AI) and machine learning (ML) are two interrelated concepts that people across the tech landscape know hold important implications. While the benefits of these capabilities are many, experts in the field are also known to flaunt dire theories about them - from threats of dystopian futures ala The Matrix films to more tangible fears like wide-scale data breaches.

Machine learning falls under the broader AI umbrella as a technology that can enable computers to learn and adapt through experience, essentially, mirroring human cognition to recognize patterns. Successful examples of recent ML deployments include Google’s evolving search algorithms and Amazon’s product recommendations, along with the many "news feeds" that are common across social media.

But similar initiatives can have big dividends where cybersecurity is involved, especially in freeing up many of the more rote activities with which security staff are tasked. Predictive analytics and greater automation, for instance, are being employed via AI as an innovative means to fill the skills shortage that’s prevalent across the industry. This allows teams to off-load basic tasks in favor of high-priority or more technical initiatives.

Matching Human Capabilities at a Speed We Can’t touch

Any technology that can lessen the burden of an enterprise security team is extremely useful. Further to that, any time there is a defined data set that can be analyzed and categorized into a defined set of actions, AI will be successful. Some of the benefits that are already being enjoyed by security teams include things like enhanced behavioral analysis, email security and malware prevention.

For instance, businesses can use AI to help establish "known knowns" and "known unknowns" – that is, traffic behavior that follows an expected baseline of activity, and the traffic, users, or devices that appear anomalous by comparison. Even if an individual was given a single pane of glass to monitor all the traffic crossing the network perimeter, spotting anomalies would be nearly impossible given the number of users and devices that, on average, leverage contemporary enterprise networks.

The bottom line is that computers simply absorb information at a greater speed than humans while adhering to the same rules and protocols.

Tread Carefully at First

Of course, that isn’t to say there aren’t pitfalls to implementing AI and ML into a security workflow. It’s important to remember that AI and predictive analytics should be used to augment a company’s security team not replace it.

As was explained above, quality data sets will inform the success of an AI or ML program. If a business is collecting the wrong type of information from the get go, or is storing it incorrectly, AI and predictive analytics will be drawing conclusions based on incomplete or inaccurate information, leading to a reduction in performance.

Organizations achieve the greatest benefits from these technologies when they are used to free teams up from manual tasks in order to focus on higher-level problems that require "human" brain power to assess context and nuance. Those assessments can’t be passed onto computers – at least not yet.

It’s also important to expect that hackers will inevitably ramp up their use of AI in response to the new tactics being deployed by security teams. This underscores  the point that while cybersecurity tactics will change with team, threats will always be present, requiring dedicated human collateral to help businesses remain secure for years to come.

Joe Cosmano has over 15 years of leadership and hands-on technical experience in roles including Senior Systems and Network Engineer and cybersecurity expert. Prior to iboss, he held positions with Atlantic Net, as engineering director overseeing a large team of engineers and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
iboss has created the first and only web gateway as a service specifically designed to solve the challenge of securing distributed organizations. Built for the cloud, the iboss Distributed Gateway Platform leverages an elastic, cloud-based node architecture that provides advanced security for todays decentralized organizations with more financial predictability. Backed by more than 110 patents and patents pending, and protecting over 4,000 organizations worldwide, iboss is one of the fastest growing cybersecurity companies in the world. To learn more, visit www.iboss.com.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVE-2018-16752
PUBLISHED: 2018-09-20
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.