Estimated reading time: 6 minutes
The cost of cybercrime has now outstripped the ability to keep up. Gartner, a multinational security and analytics company in the field of technology, predicted that world spending on cybersecurity will be 16 times lower than damage caused. To address this challenge, organizations are now turning to machine learning and artificial intelligence for cybersecurity, trying to fill in the gaps.
The vast majority of malware targets known vulnerabilities, but botnets often go unnoticed within the victim organizations for around 12 days. The problem in many cases is the scarcity of resources a arrangement.
The attack surface has expanded in recent years with the adoption of IoT devices and the spread of BYOD (Bring Your Own Device) work environments. This, combined with the increasing sophistication of the attacks and increasing the security skills gap, has overwhelmed many teams.
In response, service providers MSSP are increasingly implementing a machine learning system in their cybersecurity solutions. This is certainly an interesting field and many security chiefs are looking for a permanent solution in the fight against cybercriminals. But the question is whether the machine learning offered by artificial intelligence can add new value to the realm of security.
Threat detection and prevention
Most companies are operating with a standard security kit. Their rooms are filled with devices that claim they can detect and prevent the latest threats through signature-based detection, predefined policies or custom configurations. Sensors in this category include firewall , DLP ( Data Loss Prevention ), IPS ( Intrusion Prevention System ) and WCF ( Web Content Filter ) . An alarming consideration, as these sensors continue to be adopted in large numbers, many of them may not be configured correctly .
Furthermore, many of these devices operate in complete isolation , unable to share or correlate information or respond to threats with any kind of coordinated strategy. Consequently, controlling these devices also requires an extra layer of sensors , along with additional members of the security team. Of course, more sensors and more data require more people and given the current security skills shortage, this strategy is unsustainable in the long run.
Through a complete system such as a SOC , however, this does not happen. The collection, correlation and analysis take place in a coordinated way in a SOAR (Security Orchestration, Automation and Response) designed to be a unique workflow. Part of these tasks is done by artificial intelligence and machine learning mess and in the service of cybersecurity . The aim is to analyze user behavior and identify anomalies, as well as learn from past analyzes.
Machine learning for cybersecurity
Machine Learning (ML) is a subset of AI (Artificial Intelligence). AI and ML can enhance our human capabilities by allowing us to dig through large datasets and locate patterns behavior or signals that would be nearly impossible for humans to find. This force multiplier allows technicians at their disposal to identify unusual behaviors. Then the behavioral analysis with UEBA (User Entity Behavior Analytics) tools for safety will do the rest. Mundane and repetitive tasks can also be automated with machine learning, allowing scarce cybersecurity staff resources to focus on higher-value tasks.
UEBA and security
Machine learning and artificial intelligence are based on so-called “big data”. Their efficiency and accuracy improve with the amount of data passed to them . The important thing, however, is to collect the right data. This is where UEBA security systems come in. . The combination of accurate and essential behavioral data with machine learning is the strength of this cybersecurity system. This combination allows you to accurately monitor users, providing deep visibility into what they do on a regular basis .
Once a behavior routine has been established, when a user takes actions that the system considers abnormal , a notification is generated. The operations team is thus notified of any action outside the routines defined . If the detected activity is legitimate, analysts can simply label the activity as part of the routine . Machine learning integrates that data into subsequent data analysis for corporate cybersecurity . The crucial step is normalizing behavior , which ensures that that precise action will no longer generate notifications.
Obviously, in the early stages of system installation, the notifications will be numerous . As AI reduces these false positives by “learning”, whenever moves away from normal behavior, l and notifications become more urgent for safety.
The benefits of combining UEBA, machine learning and security
The use of machine learning together with user behavior data provides a level of proactivity to cybersecurity that is not possible when relying on traditional sign-based detection and prevention systems . This is because you are able to detect subtle changes in behavior that are difficult to detect with traditional systems. It is simply not possible to configure a system with every single permutation of rules to detect all attacks.
Detecting low-level reconnaissance activities using UEBA and machine learning is far more likely to trigger your spider senses than other methods. This provides a huge advantage, making it much more difficult for attackers to evade control by flying under any rules-based radar.
The added value
The advantages of using a UEBA security solution built on a machine learning platform for cybersecurity are many. Because their ability to manage network activity routines is refined, not only they can detect abnormal changes in behavior, but this information can become part of a proactive process , identifying and preventing certain behaviors before they occur.
But perhaps most importantly, machine learning is entering the scene at a very sensitive time for cybersecurity. The number of analysts needed to sift through the data by hand and identify threats is exceeding the number of professionals available. Removing the man from a task for which he is not particularly suitable , is free to focus on areas where it can add value, such as further developing cybersecurity protocols.
So, does machine learning add value to cybersecurity? We really believe so.
Costs and proposed solutions
In terms of costs in general, with a UEBA system maintenance is reduced and does not require the hiring of new professionals, especially if you consider the use of the service in SaaS solution.
We at SOD offer the machine learning and UEBA system, together with a SIEM Next Gen in an ideal solution for those who do not want to invest in the installation of dedicated hardware . Our SOC as a Service is designed to optimize your investment and maximize the return in terms of quality of security procedures.
To find out more, visit the service page or contact us to find out how this solution can be useful for your business. We will answer all your doubts.
Useful links:
Useful links:
UEBA: Behavior Analysis Explained
Acronis Active Protection: defense against ransomware
mproving Staff Workflow with Cloud Technology
Acronis Active Protection is an advanced anti-ransomware technology. It actively protects all the data on your systems: documents, data of all kinds and Acronis backup files. It is a technology available for Windows and Mac OS X operating systems and protects against the latest ransomware actions such as Petya, WannaCry, Locky and Osiris.
What is Ransomware?
Ransomware is a particularly painful type of malware. Malware is “hostile or intrusive software” illegally introduced into your system for malicious reasons. When ransomware infects the system, it blocks access to data. Whoever introduced the malware will then make a cash request to unlock the data. In short, the mechanism is that of redemption.
To defend against this type of attack, it is necessary to constantly monitor the activities that take place in the system.
Find the patterns
Acronis Active Protection constantly observes the patterns in how files and data are changed. A set of behaviors can be typical and expected. Another may report a suspicious process that aims to initiate hostile actions against the data.
Acronis’ approach is as follows: examine these actions and compare them with patterns of malicious behavior. This approach can be exceptionally powerful in identifying ransomware attacks, even from variants that have not yet been reported. The latest version of Acronis Active Protection adds additional behavioral patterns to improve ransomware detection.
Acronis has invested heavily in a new dedicated machine learning infrastructure used for telemetry and data processing. The first step in the process is a stack trace analysis. It is possible to detect malicious code by using the stack trace analysis of a process based on the machine learning approach.
The data to be studied and analyzed are the stack trace dumps / frames which are sent as input to the Acronis Machine Learning module. The output of the analysis will be the verdict: clean or infected data. This approach takes active protection to a new level, especially when it comes to threats never used before (called Zero Day).
The system does not require signatures of any kind, but rather creates a model of what is acceptable and what is not. In this way, when hackers will find a new vulnerability or a new approach to infiltrate the system, they will hardly be able to pass this behavior check made thanks to the models applied by Acronis.
Defense against advanced threats
Acronis Active Protection can detect very sophisticated ransomware threats that usually appear as legitimate operations. The detection of attacks takes place thanks to the application of advanced heuristics and machine learning, but not only.
In fact, special mathematical approaches are also adopted to calculate the entropy of the files, in order to understand if the file has been modified even if the header remains the same. Many anti-ransomware solutions, on the other hand, only act based on file headers.
One way that criminals could choose to compromise files would be to attack the backup software itself to corrupt the backup files it creates. To protect against this, Acronis has implemented a robust self-defense mechanism that will not allow criminals to interrupt the work of the Acronis application or the contents of the backup files. In addition, Acronis Active Protection checks the Master Boot Record of Windows-based computers. Hence, it will not allow illegitimate changes to be made to prevent the computer from starting.
How it intervenes
If the ransomware attack starts encrypting files, Acronis quickly detects and stops this process. Since Acronis is a backup solution, any data that was exposed and encrypted before the process was stopped can be recovered from a variety of sources. This is remarkable, considering that not only can anti-ransomware solutions commonly fail to terminate an attack once it has begun, they also have no way of recovering files encrypted by the attack.
Acronis Active Protection detects and deflects attacks and restores files of any size.
The methodologies detect and deflect attacks and advanced file recovery. These protection approaches are not only leading the way against criminals, but they are more innovative and advanced than any other anti-ransomware methodology available.
The Acronis solution is able to identify:
– Hackers trying to infect or compromise local or cloud backups
– Reduced attacks and usually more difficult to detect (for example, changing only a small portion of a document or a photo stored deep in the hard disk)
– Attackers who come up with creative new ways to attempt maliciously manipulating files
Conclusions
The application of artificial intelligence in the field of cyber security has made giant strides in defense possible and is making life extremely complicated for hackers. The search for innovative solutions is now oriented towards the implementation of machine learning to try to capture malicious behavior rather than the attacks themselves. Acronis Active Protection does this and does it effectively, offering complete and efficient protection from ransomware attacks.
The threats do not end once the security of your systems and perimeter has been verified, you must adopt constant defense and verification solutions to ensure your data in the best possible way.
Useful links:
Classic cyber threat defense tools and systems are rapidly becoming obsolete, and there are ways to overcome them. What remains confidently common among cyber criminals attempting an attack is the intent of the attack itself. Indeed, knowing that there are systems capable of detecting indicators of compromise (IOC), it is natural that competent hackers will try not to leave traces traceable to standards. User and Entity Behavior Analysis (UEBA) offers a more comprehensive way to make sure your business has world-class IT security. At the same time, it helps detect users and entities that could compromise the entire system.
A definition of User Entity Behavior Analytics
User and Entity Behavior Analysis or UEBA, is a type of cybersecurity process that takes note of standard user behavior. In turn, the system detects any abnormal behavior or cases where there are deviations from the “normal” patterns mentioned above. For example, if a particular user regularly downloads 10MB of files every day, and suddenly downloads 1GB, the system would be able to detect this anomaly and immediately alert operators. The behavior may be legitimate, but it’s worth checking out.
The UEBA system uses machine learning, algorithms and statistical analysis to know when there is a deviation from established patterns. Next, it shows which of these anomalies could result in a potential and real threat. Additionally, UEBA can aggregate report and log data, as well as analyze file, stream and packet information.
With a UEBA all users and entities of the system are tracked. In this way the system focuses on insider threats, such as dishonest employees, compromised ones and people who have access to the system and then carry out targeted attacks and fraud attempts, as well as the servers, applications and devices that work inside. of the system.
Advantages
It is the unfortunate truth that today’s cybersecurity tools are rapidly becoming obsolete. Now the most skilled hackers and cyber criminals are able to bypass the perimeter defenses used by most companies. A few years ago you were sure if you had web gateways, firewalls, and intrusion prevention tools. This is no longer the case in the complex threat landscape, and is especially true for large companies that have proven to have very porous IT perimeters that are also very difficult to manage and supervise.
The key point? Preventive measures are no longer sufficient. Firewalls will not be 100% infallible and attackers will enter the system at one point or another. That’s why detection is just as important: when hackers successfully enter your system, then you need to be able to quickly detect their presence to minimize damage.
How does it work?
The premise of the system is actually very simple. You can easily steal an employee’s username and password, but it is much more difficult to mimic the person’s normal behavior once inside the network.
For example, let’s say you manage to steal John Smith’s password and username. However, it is almost impossible to act exactly like Mario Rossi once inside the system, unless extensive research and preparation is also done in this direction. Therefore, when Mario’s username is logged into the system and his behavior is different than typical, that’s when the UEBA alarms start ringing.
Another related analogy would be the theft of a credit card. A thief can steal your wallet and go to a luxury store and start spending thousands of dollars. But, if the spending pattern on that card is different from that of the thief, the fraud detection department will recognize the anomalous expenses and block suspicious purchases, either by sending you an alert or asking you to verify the authenticity of a transaction. .
What can UEBA do?
UEBA is a very important component of modern IT security and allows you to:
1. Detect insider threats: It is not too far fetched to imagine that an employee, or perhaps a group of employees, could disobey, steal data and information using their login. UEBA can help you detect data breaches, sabotage, abuse of privileges and policy violations by staff.
2. Detect Compromised Accounts: Sometimes, user accounts are compromised. It could be that the user has unintentionally installed malware on his machine, or that sometimes a legitimate account has been forged. UEBA can help eliminate compromised users before they can do any damage.
3. Detect Brute Force Attacks: Hackers sometimes target cloud-based entities as well as third-party authentication systems. With UEBA, you are able to detect brute force attack attempts, allowing you to block access to these entities.
4. Detect permission changes and super user creation: Some attacks involve the use of super users. UEBA allows you to detect when super users are created, or if there are accounts that have been granted unnecessary permissions.
5. Detect Secure Data Breach: If you have secured data, it’s not enough to keep it safe. Know when a user accesses this data if they have no legitimate business reason for doing so.
UEBA and SIEM
Security Information and Event Management, or SIEM, is the use of a complex set of tools and technologies that provides a complete view of the security of your IT system. It leverages event data and information, allowing you to see normal patterns and trends, and to warn of anomalies. UEBA works the same way, only it uses information on user (and entity) behavior to verify what is normal and what is not.
SIEM, however, is based on rules, and competent hackers can easily circumvent or evade these rules. Furthermore, the SIEM rules are designed to immediately detect threats that occur in real time, while the most advanced attacks are usually carried out over months or years. The UEBA, on the other hand, is not based on rules. Instead, it uses risk scoring techniques and advanced algorithms that allow it to detect anomalies over time.
One of the best practices for cybersecurity is to use both SIEM and UEBA to have better security and detection capabilities.
How a UEBA should be used
UEBA was born out of the need to identify the harmful behavior of users and other entities. UEBA tools and processes are not intended to replace legacy monitoring systems, but should instead be used to complement them and improve a company’s overall security. Another great practice is to take advantage of the storage and calculation capabilities of big data, using machine learning and statistical analysis to avoid receiving an avalanche of unnecessary alarms and being overwhelmed by the large volume of data. generated.
And this is exactly what happens in the SOCaaS offered by SOD, where the SOAR is also guaranteed by the collaboration of these systems.
UEBA uses machine learning and algorithms to strengthen security by monitoring users and other entities, detecting anomalies in behavior patterns that could be indicative of a threat. By taking a proactive approach to security and gaining greater visibility into user and entity behavior, today’s businesses are able to build stronger security systems and more effectively mitigate threats and prevent breaches.
Useful links:
A SIEM solution in IT is one of the essential components of a SOC (Security Operation Center). Its task is to collect information and analyze it in search of anomalies and possible breaches in the system. But the defense process hasn’t always been that simple. What we now call SIEM, Security Information and Event Management, is the union of two different types of cyber security tools.
SIM and SEM: the origins
Before the arrival of a complete SIEM solution in computing, security was heavily focused on perimeter security and did not keep the internal network adequately controlled. The first solutions developed in the 90s were basic and basically dealt with security information management (SIM) or security event management (SEM). They were solutions available as tools that had to be deployed on-site in the data center to be protected. This limited scalability, because adding capacity required the purchase of additional equipment.
These early solutions were also built on proprietary databases that forced customers to use technology from a single vendor. If you wanted to move your data to another system, the process was long and complicated. It should also be noted that archiving was more expensive, so only the most valuable data was collected. Furthermore, although the SIM and SEM solutions contained all the data necessary for the defense, the search and alarm were rudimentary. Additionally, they depended on experienced security analysts to research, understand and interpret what they found in the data.
SIEM origins in computer science
As data became more sensitive and technology more powerful, SIEM systems (SIM + SEM) became capable of ingesting, processing and storing a great deal of data. Next-generation SIEM IT solutions are able to use signature-based alerts to identify threats in collected data. However, only those alerts that have identified indicators of compromise (IOC) of a certain threat can be identified in this way.
To be clear, if the type of attack to which a system is subjected has not been cataloged in a series of IOCs, a first generation SIEM is not able to detect it. The main drawback of those systems was the very limited ability to detect unknown cyber threats.
To give a practical example: it was possible to use a rule like this: “give a warning if a user enters 10 consecutive wrong passwords“. In theory this could be used to detect brute force password attacks. But what if the attacker only tried 9 passwords in a row? Or what if the alarm was given for a very forgetful user?
Next Gen SIEM (NGS)
A next generation SIEM is built on a large data platform that provides unlimited scalability and is hosted in the cloud. A next gen SIEM includes log management, advanced threat detection based on behavior analysis and automatic incident response, all on a single platform.
This eliminates the problems that old on-premises systems were prone to. Not having to install anything and being able to send the necessary data to the cloud quite simply, the computing power of the local machine is not compromised and the SIEM can manage all the data safely.
How a SIEM proceeds in cyber threat analysis
1. Data Collection: An IT SIEM solution collects data from across the organization using agents installed on various devices, including endpoints, servers, network equipment and other security solutions. Next generation SIEM includes support for cloud applications and infrastructure, business applications, identity data and non-technical data feeds.
2. Data enrichment: Enrichment adds further context to events. SIEM will enrich data with identity, resources, geolocation and threat information.
3. Data storage: The data will then be stored in a database so that it can be searched for during investigations. The next generation SIEM exploits open source architectures and big data architectures, exploiting their scalability.
4. Correlation and Analysis: SIEM solutions use several techniques to draw actionable conclusions from SIEM data. These techniques vary greatly.
5. Report: A SIEM, particularly a next generation SIEM, gives you the ability to quickly search for data, allowing you to dig through alerts and search for threat actors and indicators of compromise. The displayed data can be saved or exported. It is also possible to use out-of-the-box reports or create ad hoc reports as needed.
What a SIEM is used for
Threat hunting and investigation
The ability to perform threat hunting on a SIEM is critical to understanding the true patterns of attacks based on access, activity and data breaches. By developing a detailed and contextual view of attacks, security analysts can more easily develop policies, countermeasures and incident response processes to help mitigate and remove the threat.
Response in case of an accident
An effective response to incidents is essential to intervene more quickly and reduce the residence time of the threat. For this, a SIEM provides an incident response playbook with configurable automated actions. A SIEM is able to integrate with third party solutions for security orchestration (SOAR) or individual case management.
Defense against insider threats
The reason why insider threats are such a big problem is because it’s not about entering the perimeter, but about exploiting insider positions. They can be your employees, contractors or business associates. It may be they themselves wanting to exploit their location, or their account may have been hacked.
With all kinds of internal threats, the attacker tries to stay hidden, gathering sensitive data to exploit. This could cause significant damage to the company, its position in the industry and its relationship with consumers or investors. By using a SIEM, you avoid this risk.
Cyber threat detection
Your organization is likely to have at least one sensitive data repository. Cybercriminals thrive on looting this data for financial gain. Many breaches begin with a simple phishing email against an organization’s target. Simply clicking on an attachment can leave malicious code behind. A SIEM will allow you to monitor advanced cyberthreat patterns such as phishing, beaconing and lateral movement.
Compliance standards
For many industries, adherence to compliance standards is critical. A SIEM can help by providing reports focused on data compliance requests. Integrated packages covering all major mandates, including PCI DSS, SOX, and ISO 27001, are a standard feature of SIEMs as well.
Next Generation SIEM
A next generation SIEM is not just a cloud hosted system. It also makes use of the implementation of AI and Machine Learning to increase the defense of the IT system.
We will see it in a future article, but it is right to specify that the SOCaaS offered by SOD makes use of the latest generation technology offered by Next Gen. SIEM systems. Contact us to find out more about it and talk to experts who can dispel all your doubts.
[btnsx id=”2931″]
Useful links:
Security: Pentest and verification of vulnerabilities
What is a Network Lateral Movement and how to defend yourself
Is SOCaaS useful for your business?
Computer network security: PT vs. VA
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
{subscription_form_1}Products and Solutions
Partners
Cloud Models
News
- From Secure Online Desktop to Cyberfero: rebranding of the leading cybersecurity company May 6, 2024
- NIS: what it is and how it protects cybersecurity April 22, 2024
- Advanced persistent threats (APTs): what they are and how to defend yourself April 17, 2024
- Penetration Testing and MFA: A Dual Strategy to Maximize Security April 15, 2024
- Penetration Testing: Where to Strike to Protect Your IT Network March 25, 2024
Google Reviews
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Ottimo supportoread more
E' un piacere poter collaborare con realtà di questo tiporead more
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2024 Cyberfero s.r.l. All Rights Reserved. Sede Legale: via Statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Cod. fiscale e P.IVA 03058120357 – R.E.A. 356650 Informativa Privacy - Certificazioni ISO