Microsoft recently announced how to use ChatGPT to augment security operations, specifically security incident response (CSIR) teams, with the help of AI. This advertisement was part of a more significant action in which clients shared their experiences scaling IR teams with AI. Effectively analysing the existing stages of incident response and exploring the stages most impacted by AI, we can conclude that with the help of AI, the mean time to resolution could be improved. The difficulty for numerous organizations will be adopting these tools at scale in a way that provides a positive impact and does not inject bad data into already fast-moving processes while being reproducible and auditable for later investigation and analysis. When considering the adoption of Generative AI in the cyber teams, we must first define our operating principles: All applications of Generative AI should be approved by the CISO and other risk-informed executives. They should have direct visibility into where this capability is being used and which processes are excluded from this technology application due to a larger-then-tolerable risk profile. The application of Generative AI should focus on the augmentation of existing teams and workflows with measured goals of enhancing their effectiveness and accuracy. Tools should not be used for the first time during a live event. All learned and applied generative AI tools should be used multiple times in simulated events and tabletop exercises. Transparency should be part of the research and application of generative AI, especially when providing inaccurate information. Transparency allows organizations to fine-tune where, how, and vendors' capabilities are used. Transparency allows all teams to see the knowledge influencing how processes are planned, executed and communicated.
All interactions with generative AI should be recorded, verifiable, and maintained for the lifetime of the product deployed in the enterprise. The right questions are half the answer. This requires logs and transparency to build organizational trust in generative AI, improve processes for effective application, and prove diligence to external parties when needed. These logs are also becoming an important part of our internal training programs to enhance the effectiveness of our employees' tools. Finally, no post on generative AI would be complete without exploring hallucinations. Each case is unique. ChatGPT and related tools can reveal past experiences in useless or harmful ways. Hallucinations are a growing concern in the AI community. They lead many people to demand to be informed about the decision-making process to ensure that these results are not accepted. Models are regularly improved by understanding how symptoms translate into user outcomes. While Generative AI is not ready to take over the role of our IR teams, it is another powerful tool to augment teams and provide complete coverage of events, timelines, system interactions, and remediation guidance. As part of an IR toolbox, Generative AI can provide better accuracy when understanding a series of events and deeper insight into their relationship and influence when investigating cyber incidents. These tools do not replace the Investor Relations team or help reduce the size of the team. As generative AI tools continue to evolve, the winners in this market will be those that provide industry expertise and in-depth knowledge of an enterprise`s specific architectures, traffic patterns, user behaviour, and threats. A big success will be LLMs trained to combine industry and localized company data. Their intersection is useful for incident response and other cybersecurity operations.
Today, artificial intelligence will help improve cybersecurity and deliver greater security benefits. Building a strong security system requires three key elements. Understand complex measured external and internal threats, risk behaviours and signals. Implementation of preventive measures. Collecting all relevant data and using big data techniques to manage, organize and understand it is essential. To effectively analyze and apply data, we need human and machine-generated intelligence. As Wikipedia defines, intelligence is "the ability to perceive or infer information, and to retain it as knowledge to be applied towards adaptive behaviours within an environment or context." Human intelligence is challenging for security analysts to scale. Plus, with the increasing complexity of data, analysts require advanced skills and expertise that take years to develop -- and it`s a talent pool that`s in short supply. Consequently, AI is a practical solution for scaling cybersecurity. Powerful AI systems allow businesses to reduce their reliance on experts in both data and security. Here are four ways AI can improve enterprise security: Advanced threat detection. AI can help identify signals such as dangerous or unusual behaviour that are difficult to detect and measure with traditional rule-based methods—signal processing. Understanding your signals will help you make them meaningful and actionable. This means potential impacts and threats can be compared, amplified and assessed. Better understand potential risks with risk modelling that includes all signals and context from big data. A clear risk statement. Language and machine learning models (LLMs) can help you effectively and timely communicate risks and situations to larger audiences. Are AI Algorithms Ready for Prime Time? The quality of an AI algorithm depends on its training data. How can we ensure that our AI models generate more false positives to live up to expectations and that alerts are exciting? Artificial intelligence systems have seen significant improvements over the years, and not all systems necessarily require supervised learning methods. Unsupervised systems such as anomaly detection are widely used and in high demand in security applications. For example, anomaly detection can significantly reduce false positives. With the support of standards organizations like MITRE, which maintains an ontology of the ever-changing threat landscape, it is possible to develop highly complex AI systems that do not have sample data. AI systems for cybersecurity continue to improve regardless of the hype and should be part of every cybersecurity team's arsenal.