How can AI improve incident response in the event of a security breach?

Anomaly detection (a specialized filed of ML) is used for a long time in Cyber Security and we have no way around it. Analyst are drowning in signals, being real positives or false positives. Only AI system can reduce the signal and the noise to a manageable level for humans. It even can take automatic action such as suspending a user or shutting down a system if we allow it. In short, AI is used for detection and alerting for a long time but the technology providers have not necessary stated this, while now it is a selling point (since November 2022, the release of ChatGPT).

AI-driven security tools are transformative, as they can sift through vast datasets that would be impossible for humans to analyze manually. By using machine learning algorithms, these systems become more adept over time at detecting subtle threats, such as zero-day exploits or advanced persistent threats (APTs), which often evade traditional security measures. The ability to reduce false positives is crucial, as it allows security professionals to focus on genuine threats, optimizing their response time and effectiveness in mitigating potential breaches.

Prior to 2022, investigation and triage were heavily based on hum work. Deciding what to investigate and which logs files to analyze manually using languages like AWK. It was an expert job because speed matters in these things or company gets compromised. Therefore, hiring juniors was a very risky endeavor. Now, generative AI can be fine-tuned to automatic analyze incidents because it can generate the same investigation programming statements for example AWK like humans. Once the IDS founds evidence of an intruder it can now on top generate the statements to isolate the hacker. Advanced systems can even create full reports for human readers how an attack happens and where the lateral movement was coming from. It can be even done by juniors.

AI-driven incident response systems can significantly reduce the mean time to respond (MTTR) to security incidents by automating the initial analysis and prioritization processes. By leveraging machine learning, these systems can evolve and improve their detection and response strategies over time, becoming more adept at identifying false positives and focusing on genuine threats. Furthermore, AI can assist in orchestrating complex response actions across various security tools, ensuring a coordinated and comprehensive approach to incident management. This orchestration is critical in complex IT environments where manual coordination may be slow or prone to error.

In my opinion, remediation and recovery (R&R) are not so much depend on AI as many want us to think. Your R&R is much more depend on automated deployments using DevSecOps and a proper configuration management database (CMDB) including a complete listing of library dependencies of your software. These allow you to have fast processes for Cyber Resilience after the isolation of compromised systems to restore them to the previous stage. AI might help you in the stage before to identify which vulnerability was the root-cause but what do you do if you do not have vendor patch because of a Zero-Day? Furthermore, patching of vulnerable systems requires testing of the patch. Still, AI can speed things ups because it is automation in the end.

More Thoughts: 1.Adversarial Attacks: Cybercriminals can use adversarial techniques to deceive AI systems. - feeding them misleading data to trigger false negatives - creating malware that can evade AI detection. Cyber threats are constantly evolving, and new types of attacks are being developed all the time by creative humans. 2.False Sense of Security: Relying too heavily on AI can lead to a false sense of security. Human oversight is recommended to manage and respond to threats effectively. 3.Lack of Explainability: AI systems often operate as a “black box”, making it difficult to understand why they made a certain decision. This can be problematic in cybersecurity. Understanding the reasoning behind a threat detection can be crucial.