The benefits of automating enterprise cyber security

Cyber security in 2021

Based on the current global macroeconomics construct, there is little sign that budgets will rise during H1 2021. That said, ever increasingly complex automated attackers are identifying new vulnerabilities and activating new enterprise breaches. Unfortunately, some of those breaches are becoming true incidents. Automating enterprise cyber security and cyber artificial intelligence (AI) have, for many seemed desirable rather than mandatory. That simply will not be the case moving forward.

Cyber security executives are now separating the wheat from the chaff in the automation solution search. Finding a provider with demonstrable results is a must. CISOs are taking a collaborative proactive stance in responding to the current and conceiving of the coming threat landscape.

Also read: Five cyber security basics for every enterprises

Automation imperatives

The universal imperative is reducing business risk by ensuring cyber security executives are spending time actually securing the enterprise. Automation offers the promises of increasing efficiencies and reducing costs across the enterprise. With an influx of threat intelligence technologies and feeds available to the organization, it is quite easy to get bogged down in non-actionable information.

The key is to focus cyber security humans on only high-impact actionable information. Thus, automation should be responsible for collecting data, correlating information, identify meaning and suggesting proper actions.

Focus

Our cyber security hub mid-year report on spend and trends revealed that two in five executives list SIEM and SOAR automation technologies as solutions that have been the biggest priorities in the last 6 months:

Roughly three in ten in the Cyber Security Hub community have taken advantage of Security Information and Event Management (SIEM) to date. However, current detractors of the technology note that SIEM systems only shed unnecessarily detailed information on the issue without solving the problem. This means that cyber security analysts now have to wade through volumes and volumes of white noise as opposed to focusing on actionable information.

SIEM VS. SOAR

Many see SIEM technology as a precursor to Security Orchestration, Automation and Response (SOAR) systems. The “And Response” part of SOAR suggests the automation of responses. That is the goal; gaining actual intelligence from information to orchestrate automatic remediation. Unfortunately, the true effectiveness of SOAR technologies is still conceptual for a large part of the industry.

While SIEM and SOAR technologies are in focus, there is a suggestion from the cyber security community that the technologies themselves could stand to be improved. DBS Bank’s VP Information Securty, Santosh Kamane shares: “Automation right now is meant to find out: ‘where are these violations to my policies? Who is violating my standards?’ There could be hundreds of logs created from the tools, but the tools are not very easy to read, or easy to understand as they are very technical.”

Promise vs. actualization

Beyond the industry looking for improvements in the technology, executives would also like to see more accuracy in the messaging around solutions.

“A lot of vendors at the moment have marketing around AI and machine learning and how those fits into the automation piece. I think some companies are doing good things in this space, but there is still a way to go as far as automated responses to threats,” notes CISO at Horizon Power, Jeff Campbell.

He suggests that where automation solutions are concerned, there is an industry disconnect between solution promise and solution actualization.

Resourcing

There are executives at very large institutions that are confident in the results of SOAR technologies and capable of resourcing those solutions from an internal- already employed- analyst perspective. Thus, those executives are very pleased with the solutions they have acquired. For others a key focus may necessarily be on a more direct Phishing Protection or Email Filtering solution based on the lack of elasticity in current staffing numbers and a shortage of the specific skills needed for automation technologies within the current staff.

“A lot of vendors at the moment have marketing around AI and machine learning and how those fits into the automation piece. I think some companies are doing good things in this space, but there’s still a way to go as far as automated responses to threats.”

Jeff Campbell, CISO, Horizon Power

Automation inhibitors

There are innumerable inhibitors to cyber security automation. Processes are never perfect. A human though, can institute a workaround for a process and potentially catch vulnerabilities when those processes run at human speed. When automating a broken process, the results of that broken process are realized much more quickly. That means unfound and potentially exponential vulnerabilities can be exposed and not realized until a breach occurs.

The issue of automation itself is just one inhibitor. A lack of standardization around automation processes and solutions means global cyber security executives are not singing off of the same hymn sheet thus laying the groundwork for further vulnerabilities. While standardization is a goal, so is customization. The complexity of cyber security systems demands a fair amount of customization around automation technologies. Customization of technologies exposes weaknesses as well as lengthens the time and cost associated with implementation.

Lack of standardization

The move to a primarily distributed workforce has destabilized any standardization that was in place in Q1 2020. While cyber security executives have undertaken a herculean feat to optimize remote environments, work still needs to be completed. Thus, compatibility of legacy systems with newer off premise tools is not ideal. Without optimal compatibility and interoperability of systems-standardization is challenging. Without standardization, rules-based automation is difficult.

Difficulty with customization

Time

One of the key promises of automation is to save cyber security teams time. However, systems that work for a particular environment need to be found, proven to work within your environment, rolled out, fully implemented, tweaked and resourced. Even in ideal circumstances, where there are no other impediments to the project, this is at least a six-month process.

Skill

The search for and rollout of an automation tool is simply the foundation of automated insights informing cogent security decisions within the enterprise. CISOs are realizing that no matter how much a technology partner points to the low-code or no code nature of the technology, internal scripting and coding must occur to get the most out of automation systems.

“There are organizations right now that are using a threat hunting methodology to find and evict threat actors before they actually have a long-standing persistence. The trick  is to do it manually once, then automate. You can then focus on new types of threat hunting or playbooks, thereby making your staff way more effective without necessarily increasing your staff or risk.”Kayne McGladrey, IEEE

Cost

Even though the promise of saving money through efficiencies warrants action and potential spend, the actual spend is hard to outlay for many at this moment.

Five questions to help gain certainty from automation:

1. What is the provider going to do to guarantee ROI?
2. What does the internal team need to do to guarantee ROI?
3. Can the provider cite real world evidence of achieve ROI?
4. What is the true investment on security dollars?
5. Where will return be seen (consistency, efficiency, improved posture, improved security)?

Tim Woods, FireMon

Automation controls

With automation responsible for collecting data, correlating information, identify meaning and suggesting proper actions, the question becomes what other controls can be automated. When asked, the Cyber Security Hub community provided a myriad of opportunities where automation can accomplish the principle of increasing efficiencies and reducing costs within cyber security.

These include:

1. Identifying vulnerabilities
2. Running penetration testing
3. Engaging an ethical hacker, to run automated tools and manual scripts
4. Finding the remediation
5. Expediting the reporting
6. Finding patterns in the trending data
7. Engaging data analytics to build something meaningful out of your logs
8. And acquiring analysis of enterprise behavioral patterns

        Santosh Kamane, DBS Bank

Multiple technical controls can be automated including:

1. The traditional process around identity and access management
2. Data loss prevention (DLP)
3. Threat hunting and response
4. Ingestion of threat intelligence feeds
5. Endpoint Detection Response (EDR)

Kayne McGladrey, IEEE

Automation talent

The goal of automation is to reduce the burden on the people who have less time to execute more and more tasks. However, automation is most valuable when the in-house team is responsible for coding ensuring seamless integration and interoperability of all of your systems. The abundance of talent needed in DevSecOps foreshadows and overlaps with the abundance of talent needed in automation.

Also read: DevSecOps report

Research by Cyber Security Hub for its year end report has found that CISOs want to increase staff in 2021 but that budgets are likely to remain static or be reduced. Leaders have also noted that some of the 2021 budget has already been spent in 2020 due to immediate distributed workforce related needs.

Different skillsets

Automation, particularly in the AI and machine learning (ML) space, requires a good understanding of mathematics and algorithms that support mathematical response to anomalies. So, finding good mathematics people that understand the computer science domain will always be a challenge, because there are very few individuals that actually have a real, really deep passion for mathematics.

Jeff Campbell, Horizon Power

Platform vs. defense-in-depth

The advantage of going with a platform-based solution is that it does 90 percent of what you need and typically all of the tooling is integrated. That reduces implementation time and reduces the amount of learning time. Every time we bring in a new tool into the organization…learning it takes time away from daily duties. You cannot just learn a tool while you are fighting a fire. That is not how the world works.

Kayne McGladrey, IEEE

Finite time and talent can be expanded

Whether you look at a number that says 69 percent of organizations have understaffed security teams or 350,000 unfilled positions in the industry, it is clear that the resources that we have are getting stretched too thin. As an industry, we are making compromises in our security profile, and when we make compromises, bad things happen.

Tim Woods, FireMon

Expanding current skillsets

The current talent issues within the cber security industry are certainly around coding and scripting. While some solutions will be upfront and honest about those kinds of requirements, I think there are a lot of solutions out there that try and minimize the coding needed to be done within ‘low-code.’

They say that they have already built the integrations and you do not need to be expert in coding. From my understanding, you need to have those skillsets to really be successful in this space. You can do some of the basics, and certainly that should not stop people from moving ahead. But, if you are truly looking to automate a lot of the workflows you have in place, then you really need to have those skillsets. That is typically not something that you will see within a standard operational team.

Iain Lumsden, Denver Health

Current automation budget

Bolstering security around the infinite perimeter, while part of short- and long-term budgets before the pandemic, is now a more acute line item in the budget. We asked the Cyber Security Hub community about where current funds are going along with what’s in the way of automation.

Distributed workforce support and monitoring

Definitely, there is more focus on remote work because that is where we see most of the threats. How do you monitor all of the remote work activities? How do you continue to get a handle on the behavior patterns? We must ensure that everything that happens remotely happens under our control.

The second thing would be zero trust architecture. How do you build a true zero trust network? The third thing would be technically developing yourself to mitigate any vulnerabilities in any of these areas, especially the open source.

Santosh Kamane, DBS Bank

IAM and PAM

Automation would play a really nice part for Identity and Access Management (IAM) and particularly around Privilege Access Management (PAM) and dynamic allocation of roles and responsibilities based on movement of identities within an organization’s structure. I think IAM and PAM need to come together around automation threat intelligence.

Secondly, we have so many threat feeds now. Automating some of the responses to some of the threat feeds so we only surface the ones on which my analysts need to focus would be largely beneficial. The ultimate goal would be adding Security Operations Center (SOC) automation and developing the orchestration behind the SOC response.

Number three is a tie between automating some of the threat around mail gateways and the way they respond to phishing attempts and endpoint and the Automated Detection and Response (ADR) component of endpoint.

Jeff Campbell, Horizon Power

Cloud evolution

Cloud is still a huge one for us. From a cloud access security broker (CASB) perspective, this is something that we are looking to mature and grow. I think data loss prevention is another one, especially with the changing barriers when it comes to cloud. We have been very centric on-premises and we have great controls there, but changing and adapting from there is the goal.

Finally, tying identity and access management into those different systems. I think automation certainly has a place in that as well.

Iain Lumsden, Denver Health

Also read: CISO startegies for threat prevention

FireMons’ Woods notes that while budgets are tight, cyber security executives are going to have to find a way to invest in some sort of automation to simply keep pace with change.

Future automation budget

Ever increasingly complex automated attackers are identifying new vulnerabilities and activating new enterprise breaches. Cyber security executives are thus in a position where it is imperative that automation is introduced to operations but a dearth of monetary resources with which to execute.

We asked the Cyber Security Hub community how to best to spend limited resources available on automation or what how they might spend newly found funds.

Proof of concept (POC) use case

We tested a solution that captured 11 percent more spam than our existing solution. The solution flagged detonating malware loads for suspected phishing emails, identified them in the background without the user even knowing would detonate the message and found out what the payload. It then took actions around that based on the intelligence that it now had.

Jeff Campbell, Horizon Power

Automated action workflows

Automated action workflows. Workflows that take an automatic action or will notify an analyst who has to approve that block before it takes place.

Iain Lumsden, Denver Health

SOAR Framework

I would definitely use found funds to build my preventative controls to mitigate risk. I would begin to customize SOAR. SOAR is more about taking your vulnerability management to next level and then creating the playbooks on this.

Then, I would automated the remediation, going beyond information security and relies on multiple business units working together. This is where I would focus more on how I can build that robust SOAR framework.

Santosh Kamane, DBS Bank

SOAR and threat hunting

SOAR or threat hunting. I say SOAR because that ingest process means your analysts are focusing their limited time and attention on those events that are most interesting and possibly the most dangerous.

I would also invest in the automation of threat hunting because it is a force multiplier. Running a threat hunt once is no good because if it you run one on Thursday and not on Friday, you do not have good sense of what has changed in the past 24 hours. In our world of persistent engagement and/or defending forward, it is so necessary to have that continuous ability to detect and evict.

Kayne McGladrey, IEEE

Read a PDF of the Report Here

How do you conduct change management initiatives in your company? Let us know in the comments below.