December 4, 2023 at 08:19PM
Companies need specific playbooks for effective cyber incident response, as tools and general plans without adequate processes often lead to intrusions. Experts advocate integrating artificial intelligence and machine learning into playbooks for faster, more effective responses, despite concerns over control and compliance in sensitive areas. Automation is increasing, with a focus on a transparent, AI-assisted approach to match the evolving threat landscape.
Meeting Takeaways:
1. Incident response (IR) plans are essential for all companies, which include establishing an IR team, designating members, and outlining a strategy for potential cybersecurity incidents.
2. Beyond a general IR plan, companies need specific playbooks that provide step-by-step guidance for various cyberattacks such as ransomware, malware outbreaks, and business email compromise.
3. John Hollenberger from Fortinet has highlighted the importance of playbooks, noting that 40% of global incidents were exacerbated due to the absence of adequate playbooks.
4. Hollenberger also emphasized that even with the right tools, ineffective processes around these tools can lead to inadequate responses to incidents.
5. There’s an interest in integrating machine learning (ML) and artificial intelligence (AI) with playbooks to automate recommendations during incident investigations and responses.
6. Researchers from Ben-Gurion University and NEC believe that manual management of playbooks is unsustainable, especially for response playbooks that require agility to adapt to new threats.
7. Security orchestration, automation, and response (SOAR) systems are key for automating and managing playbooks, and are crucial for achieving predictable outcomes in cybersecurity.
8. AI and ML are becoming increasingly integrated into SOAR systems to add intelligence and efficiency, as reported by experts and firms like Red Canary.
9. There is potential for playbooks to be fully automated using deep learning, as suggested by the BGU and NEC researchers, aiming to reduce the load on analysts significantly.
10. However, caution is necessary when giving AI/ML models control over playbooks, especially in sensitive or regulated industries, as stated by Andrea Fumagalli of Sumo Logic.
11. Enterprise customers prefer to maintain full control over IR and response procedures, highlighting a demand for transparency and validation in AI-assisted processes, as mentioned by Josh Blackwelder of SentinelOne.
12. The consensus is that automation must be transparent, and showing all the data and queries to security analysts is vital for validating the AI-assisted approaches and maintaining the balance between mitigating AI risks and meeting the needs for greater efficiency.
It is clear that while the adoption of AI and ML in cybersecurity operations is an ongoing trend, the industry maintains a cautious approach to ensure control, compliance, and proper validation are in place.