The conventional tools to ensure cybersecurity are not sufficient in today’s world especially in 2020 where using just anti-malware software or login audits will not work at par with rising threats. Organisations need more resources and powerful infrastructure to resist any type of data breach. To enable such strength, they need to embrace AI/ML and automation to fortify their company and company data against malicious intentions.
In an interview to Tech Republic, Greg Martin, general manager of the Security Business Unit at Sumo Logic, said, “AI/ML and automation greatly enhance endpoint protection, but where we see the most benefit in the technology is guiding security operations in what exactly to do with those threats once they hit the enterprise.
The ever-increasing sophistication and persistence of cybercriminal activity is requiring security operations teams to rethink how they use people, processes, and technology.”
How AI can strengthen Cybersecurity?
Obfuscation, polymorphism and certain others are among most challenging hacking techniques which make it difficult to spot malicious programs. Moreover, security engineers with domain-specific knowledge and workforce shortage are another significant issues in regard to ensure cybersecurity.
However, using AI and ML, experts and researchers are dedicating their best to utilize the best of the technologies in an effort to identify and counteract sophisticated cyber-attacks with reduced or no human intervention. AI and ML have enabled the security professionals to learn about new attack vectors. In the domain of cybersecurity, ML is much more than just an application of certain algorithms. The technology can be leveraged to analyze cyber threats better and respond to security incidents.
Detecting malicious activities and stopping cyber-attacks while analysing mobile endpoints for cyber threats are among the significant benefits of ML in cybersecurity. The technology also tends to improve human analysis – from malicious attack detection to endpoint protection.
Role of Automation in Cybersecurity
As noted by Forbes, “cybersecurity products designed to automate specific processes are widespread, and the likelihood is that you have already implemented automation tools within your organization. For example, vulnerability management products can be configured to automatically detect and scan devices on an enterprise network. They can then conduct an assessment based upon a set of security controls authorized by the organization. Once the assessment is complete, identified defects can be remediated.” To enable the cybersecurity in today’s age, a number of experts tend to refer to the tools like security automation and orchestration (SOAR) products, robotic process automation (RPA) and custom-developed software and code that automate processes and perform analysis. Where SOAR products are purpose-built tools that orchestrate activities between other security tools and perform specific automation activities in response to identified threats, RPA tools, on the other hand, are a broader set of automation tools that allow for a wide variety of processes to be automated.
Moreover, RPA tools have seen a significant acceleration in adoption in the HR and finance fields but can also be leveraged by cybersecurity teams. According to Forbes, custom-developed software and code can automate all manner of analyses and is often leveraged for a niche or specific challenge within an organization that may not have an out of the box tool available.
What are the downsides of AI in Cyber security?
The advantages discussed above are just a small chunk of the potential of improving AI enabled cyber security.
However, as with anything, there are also some downsides to using AI in this field. In order to build and maintain an AI system, organizations would need substantially more resources and financial investments.
Furthermore, as AI systems are trained using data sets, you must acquire many distinct sets of malware codes, non-malicious codes, and anomalies. Acquiring all of these data sets is time-intensive and requires investments that most organizations cannot afford.
Without huge volumes of data and events, AI systems can render incorrect results and/or false positives. And getting inaccurate data from unreliable sources can even backfire.
Another major downside is that cybercriminals can also use AI to analyze their malware and launch more advanced attacks, which brings us to the next point.
Published by:
