In the digital era, enterprises of all sizes must be proactive instead of reactive when it comes to cyber security.
We’ve all heard about digitalization and what it means but its more about the amounts of data being housed in pretty much every place you can think of. Data today is housed everywhere, us as consumers are accessing data in a completely new way, the way we consume data, see data, take data and use data is very different and the way we do all of this is always through the devices that we use, mobile phones, laptops, desktops and computers in general. These devices generate massive and massive amounts of data and it almost changes the way enterprises are storing this data.
We are now seeing this era where enterprises are moving at scale, moving all of there data centers on-prem onto the cloud which is where all of our data is being stored. Everywhere where we want to build detection into to store that data, services, applications, workloads, and computer power, everything is moving into the cloud so data is moving everywhere, perimeters are changing completely, the notion of the network is ever-expanding and there are a new way and a new model that’s required to think about when it comes to how can you secure all of these transactions.
At the same time, given that vast attack surface, attackers have automated their attack methodology. In the cyber defense industry, we talk about using machine learning and artificial intelligence, using more and more advanced techniques to try and defend more effectively but the attackers are not resting either. They are using the same tools to automate a lot of there attacks so they are becoming more sophisticated and they target more enterprises in the attack footprint.
You may have heard of the famous WannaCry and NotPetya Ransomware, but the more interesting thing about these attacks is that they were completely automated. They touched one device on one companies network and it immediately spread throughout the entire enterprise at machine speed. If you are trying to use humans and trying to analyze what is happening while these attacks are occurring, you are already one step behind what the attack is doing, while the attack is happening, what the code is doing while the attack is spreading.
So, how do we deal with attacks that move at machine speed?
Not with humans, and what I mean by this is, with everyone’s security stacks today being multi-vendor e.g. web protection with one vendor, Legacy Anti-Virus with another, Firewall logs generated or being forwarded to a Security Information Event Manager (SIEM), enterprises have all these different solutions in there security stack that need to be updated by security teams manually. Analysts are struggling to find the source and what is happening in the attack, piecing together all of this information from the vast amount of logs generated to find that needle in a haystack is taking too long before you know it, your whole network is compromised.
If we want to think about cyber security, not just as another issue but as a scalability issue, it’s not just a problem we need to solve, it’s a problem we need to solve at scale. How do we deal with all of the data we have today, how do we build systems that allow us to be more flexible, more scalable to how we go through that data and find the attacker. Using real-time security, real-time security that is based in AI, empowering the machine to actually make decisions across large body scales of data and again doing it autonomously, letting systems react to attacks to prevent them, to fix deficiencies, reacting to attacks to remediate machines in once again a complete autonomous manor.
Do we need to manage our Endpoint Security?
Although using AI-assisted and machine learning capabilities to respond and remediate the latest attack vectors in real-time, there is still an element of proactive threat hunting within enterprises. How do we make sure that we are not isolating or shutting down critical systems? If we look at the cyber security industry, there is a huge shortage in cyber security talent, in analysts and people that are needed to monitor and provide a more proactive service to validating threat alerts and threat hunting for enterprises, so it’s incredibly hard for IT Teams to allocate the resources and expertise to achieve this.
In comes Managed Detection and Response (MDR) services. To fight back and resolve this issue, enterprises large and small are exploring MDR services, combined technology with human expertise and specific methodologies to generate recommendations, guidance, and intelligence to keep clients secure.
To protect clients, MDR services monitor activity and apply advanced analytics on endpoints, user activity, the application layer, and at the network perimeter, as well as traffic moving laterally within an enterprise network.
Want to find out more on JTSecurity Vortex Managed Detection and Response service, head over to www.jtechnical.net/vortex for more information.
