How AI can help you stay ahead of cybersecurity threats

Artificial intelligence and machine learning can be force multipliers for under-staffed security teams needing to respond faster and more effectively to cyber threats.

Become An Insider

Sign up now and get FREE access to hundreds of Insider articles, guides, reviews, interviews, blogs, and other premium content. Learn more.

Since the 2013 Target breach, it’s been clear that companies need to respond better to security alerts even as volumes have gone up. With this year’s fast-spreading ransomware attacks and ever-tightening compliance requirements, response must be much faster. Adding staff is tough with the cybersecurity hiring crunch, so companies are turning to machine learning and artificial intelligence (AI) to automate tasks and better detect bad behavior.

What are artificial intelligence and machine learning?

In a cybersecurity context, AI is software that perceives its environment well enough to identify events and take action against a predefined purpose. AI is particularly good at recognizing patterns and anomalies within them, which makes it an excellent tool to detect threats.

Machine learning is often used with AI. It is software that can “learn” on its own based on human input and results of actions taken. Together with AI, machine learning can become a tool to predict outcomes based on past events.

Using AI and machine learning to detect threats

Barclays Africa is beginning to use AI and machine learning to both detect cybersecurity threats and respond to them. “There are powerful tools available, but one must know how to incorporate them into the broader cybersecurity strategy,” says Kirsten Davies, group CSO at Barclays Africa.

For example, the technology is used to look for indicators of compromise across the firm’s network, both on premises and in the cloud. “We’re talking about enormous amounts of data,” she says. “As the global threat landscape is advancing quite quickly, both in ability and collaboration on the attacker side, we really must use advanced tools and technologies to get ahead of the threat themselves.”

AI and machine learning also lets her deploy her people for the most valuable human-led tasks. “There is an enormous shortage of the critical skills that we need globally,” she says. “We've been aware of that coming for quite some time, and boy, is it ever upon us right now. We cannot continue to do things in a manual way.”

The bank isn’t alone. San Jose-based engineering services company Cadence Design Systems, Inc., continually monitors threats to defend its intellectual property. Between 250 and 500 gigabits of security-related data flows in daily from more than 30,000 endpoint devices and 8,200 users -- and there are only 15 security analysts to look at it. "That's only some of the network data that we're getting," says Sreeni Kancharla, the company's CISO. "We actually have more. You need to have machine learning and AI so you can narrow in on the real issues and mitigate them."

Cadence uses these technologies to monitor user and entity behavior, and for access control, through products from Aruba Networks, an HPE company. Kancharla says that the unsupervised learning aspect of the platform was particularly attractive. "It's a changing environment," he says. "These days, the attacks are so sophisticated, they may be doing little things that over time grow into big data exfiltration. These tools actually help us."

Even smaller companies struggle with the challenge of an overload of security data. Daqri is a Los Angeles-based company that makes augmented reality glasses and helmets for architecture and manufacturing. It has 300 employees and just a one-person security operations center. "The challenge of going through and responding to security events is very labor-intensive," says Minuk Kim, the company's senior director of information technology and security.

The company uses AI tools from Vectra Networks to monitor traffic from the approximately 1,200 devices in its environment. "When you look at the network traffic, you can see if someone is doing port scans or jumping from host to host, or transferring out large sections of data through an unconventional method," Kim says.

The company collects all this data, parses it, and feeds it into a deep learning model. "Now you can make very intelligent guesses about what traffic could potentially be malicious," he says.

To continue reading this article register now

SUBSCRIBE! Get the best of CSO delivered to your email inbox.