ML and AI in cyber security: real opportunities overshadowed by hype
If you define AI as something that can emulate human decision-making, there’s a chance you’ll be disappointed when you find out how limited AI solutions for cyber security really are.
Ahead of his keynote speech at Custodian’s Talking Tech, April 25 2019, Etienne Greeff, CTO and founder of SecureData, admitted that he often rolls his eyes when he hears about AI solutions for cyber security.
He argued: “In cyber security and in application security, there’s actually no known application of AI. There’s no autonomous agent that automatically defines threats; that does not happen yet, and it’s not very close to happening.”
It appears some enterprises are challenging the hype too. Last year, the Financial Times published an article in which an engineer from a UK-based company claimed its Darktrace system regularly sent out false alerts that many IT staff just ignored — back then, the company was spending around $10,000 a month to use it. The engineer, who didn’t want to be named told the FT: “Half my team won’t look at it once during the day . . . I do think it’s very expensive, I’m not going to lie.”
But at the same time, according to Greeff, dismissing the potential of AI and its subset ML in cyber security outright might be like throwing the baby out with the bathwater. For him, enterprises really just need to manage expectations.
“AI and ML are just tools, and it’s how you use the tools that matter,” said Greeff. “There’s certainly a role for ML and AI in cyber security; for example, they are very good at dealing with lots of information and trying to understand what is normal and what’s anomalous.”
For Greeff, ML can also be used to automate responses to common vulnerabilities and remove some of the heavy lifting around time-consuming protocols.
While some AI/ML-based systems have already proved to be successful at tackling complicated tasks, be it playing chess or participating in debates, at the crux of Greeff’s argument is the view that AI and ML should be used to augment security staff.
Avoiding the hype
But if organisations want to implement AI and ML in their cyber security strategy, how can they avoid falling into a hype-trap?
Information Age suggests that enterprises explore vendors that have an expansive approach to accommodating diverse data sources for analytics.
Beyond this, they need to get someone on board who gets actually AI and ML, or, at least, partner with someone who does.
Enterprises should always be cautious about bold claims. If you hear something like ‘we automatically detect unknown attacks’ chances are its nonsense.
Perhaps most importantly, before acquiring any new solutions, define the particular problem that you’ve got and then figure out if ML or AI is the right way of solving the problem. There may even be a much better traditional way of solving the problem.
Greeff added: “Often in cyber security, we hunt for the complicated solutions but in the end, solutions are often terrifyingly simple.
“Sometimes vendors just get in the way; often the money being spent on shiny new solutions is money not spent on getting the fundamentals right.”
Ultimately, organisations need to spend time shaping the machine learning output with business context, which will ensure that the results are more meaningful and insightful. This requires analysts to spend time on the system and infuse it with their context and insights.
source informationage
Industry: Artificial Intelligence & Cyber Security News
Latest Jobs
-
- Azure Identity Consultant
- Netherlands
- discussed on applications
-
Are you a cybersecurity expert passionate about identity and access management? We are seeking a talented IAM Technical Specialist to join our Sec Ops team. In this role, you will play a pivotal part in developing and maintaining our IAM infrastructure, ensuring the highest levels of security and compliance. What you'll do: Design, implement, and maintain IAM solutions for both on-premise and cloud environments. Collaborate with cross-functional teams to integrate IAM systems into various applications and processes. Conduct security assessments and risk analysis to identify and mitigate vulnerabilities. Stay up-to-date with the latest IAM technologies and industry best practices. What we're looking for: Experience: experience as a technical specialist with expertise in AD management. IGA concepts: Experience with Identity Governance and Administration (IGA) concepts such as RBAC, PAM, SIEM, SSO, segregation of duties (SoD), data classification, and recertification. Azure Identity Management: Minimum 2 years of demonstrable experience with Azure identity management, specifically within complex organizations. IT knowledge: Good general knowledge of IT environments such as Active Directory, Azure Cloud, Office 365, SharePoint Online, etc. Protocol knowledge: Familiar with SAML, OIDC, OAuth, and SCIM. Programming languages: Minimum 3 years of experience with development languages such as PowerShell; knowledge of Java or C# is a plus.
-
- Cloud Architect- German Speaker
- Hungary
- Upto €48000 per year + bonus + benefits
-
As a Senior Pre-Sales Solutions Architect, you will play a pivotal role in driving our sales success by translating complex technical solutions into compelling proposals that resonate with our clients. You will collaborate closely with our sales teams to understand customer needs, design tailored solutions, and negotiate successful deals. Responsibilities: Solution Design: Develop comprehensive technical solutions that align with customer business objectives and industry best practices. Proposal Development: Create compelling proposals, including requirements gathering questionnaires, presentation materials, and Statements of Work (SOWs). Customer Engagement: Build strong relationships with clients, understanding their technical, business, and commercial requirements. Collaboration: Work closely with sales teams, delivery teams, and third-party partners to ensure successful project execution. Pricing Strategy: Define and deliver pricing strategies that align with customer needs and company objectives. Requirements: Experience in technical pre-sales or sales support roles. Proven track record in designing and delivering successful customer solutions. Strong technical foundation in areas such as VMware, Azure, AWS, cloud computing, and data center technologies. Excellent understanding of sales principles, account management, and negotiation techniques. Ability to explain complex technical concepts clearly and concisely. Experience working in international teams and supporting clients across multiple regions. Fluency in German and English is essential. Benefits: Competitive salary and benefits package Opportunity to work on challenging and rewarding projects Collaborative and supportive work environment Potential for career growth and advancement Please note that this role is focused on supporting German clients, but will also involve global client support as needed.
-
- Microsoft Sentinel Architect
- United Kingdom
- discussed on applications
-
Microsoft Sentinel Architect We're seeking a talented and experienced Microsoft Sentinel Architect to be responsible for the design, deploy of a new Sentinel solution into an expanding Services business. As a key member of our team, you'll play a vital role in driving security operations and protecting clients' assets. Responsibilities: Solution Design: Develop comprehensive Microsoft Sentinel architectures aligned with our clients' specific needs and industry best practices. Deployment and Configuration: Oversee the deployment and configuration of Sentinel components, including data connectors, analytics rules, and playbooks. Integration: Integrate Sentinel with other security tools and platforms within our MSSP ecosystem. Tuning and Optimization: Continuously monitor and optimize Sentinel performance to ensure maximum effectiveness and efficiency. Training and Mentoring: Mentor junior team members and provide training on Sentinel technologies and best practices. Required Skills and Experience: Proven experience as a Microsoft Sentinel Architect with a deep understanding of its capabilities and limitations. Strong technical skills in Azure, security operations, and data analytics. Experience designing and implementing complex security solutions, into a services environment Knowledge of threat intelligence, incident response, and compliance frameworks. Excellent communication and problem-solving skills.
-
- Network & Security Consultant
- Romania
- €54000 plus benefits
-
Senior Network & Security Engineer to join a Managed Network & Security Team in Europe. In this critical role, you will: Play a pivotal role in managing and securing network infrastructure across datacenters, customer connections, and on-premise deployments. Proactively monitor network and security devices, analyse incidents, and implement solutions to ensure optimal performance and security. Collaborate with colleagues and customers to troubleshoot issues, troubleshoot outages, and implement effective resolutions. Lead and participate in network system installations for new facilities and expansions. Develop and maintain network infrastructure procedures, recommend technical strategies, and propose improvements to enhance network capabilities. Stay up-to-date on the latest network and security technologies and trends. Work as part of a collaborative international team, contributing to team presentations and knowledge sharing. To be successful, you'll need: Proven expertise in Cisco network solutions (CCNP R&S/Sec/Wireless preferred) for both BAU and project work. In-depth knowledge of network security principles and experience with Fortinet firewalls. Experience deploying and managing large, complex network infrastructure (routing, switching, wireless, security). Solid understanding of ITIL v3 framework for incident, change, and problem management. Excellent troubleshooting skills with experience using Wireshark or similar protocol analysers. Strong communication and teamwork skills, with the ability to work independently and collaborate effectively.