The average time between initial contact and full domain compromise has decreased dramatically over the past years. AI plays an increasingly large part in that. Jan Bervar, Group Security Architect at Conscia, argues that automation is the real accelerator. What does that mean for an organization’s security strategy?
There has been and still is a lot of attention for AI-powered offensive tools. “Attackers don’t use AI that much, but mostly automation”, Bervar says. In other words, a lot of people are focussing on the wrong things. It’s no surprise then that he also feels that Mythos was “very overblown”. Off-the-shelf generative AI models are already capable of performing most of the same tasks, he says.
Defenders benefit equally from AI
In discussions about AI and cybersecurity, there’s usually a lot of focus on what attackers can do with it. However, Bervar points out that defenders can (and should) use AI too. In fact, defenders can create corresponding defensive rules to new attacks with roughly 10% additional effort, he says. According to Bervar, this symmetry means AI is not a revolution for attackers. Defenders can match it quite quickly, provided they have the right tools and culture of continuous improvement.
Conscia has the tools to make sure that organizations can defend themselves quickly against new attacks. When a new threat is described in human-readable threat intelligence, Conscia processes that description, replicates the attack behavior in a customer environment, and generates defensive rules. It can do that in a matter of one or two hours. Something like this used to take around 24 hours, but AI has made it possible to speed that up significantly.
Zero days trigger existing detection rules
Being able to create defensive rules based quickly is only part of the story, though. When it comes to zero days, organizations need more detection to stay ahead of potential attacks. Bervar argues that this is something that companies should invest in more.
It’s important to understand, however, that not all zero days are equal. Not in terms of potential impact, but also not in terms of how hard it is to protect against. Anomaly-based and behavior-based detection means that broad detection rules already cover the vast majority of zero-day exploits.
According to Bervar, approximately 90% of new zero day exploits will trip existing detection rules without any modification. That is because new ones are typically mutations of known techniques, not genuinely novel attack classes. Also, even completely new zero day exploits in general need around ten steps before they can be exploited. It’s very hard for attackers to take all of those ten steps without anyone or any tool noticing. The combination of the high percentage of zero days that trip existing rules and the complexity to exploit them means Bervar is actually not that worried about them.
Not SIEM but XDR helps
For zero days to be detected quickly, detection and response is critical, Bervar argues. A more traditional tool like SIEM won’t be much help. He still sees the latter being used for it, however, with differences per region as to what is the dominant tool. Using SIEM as the only tool for detection and response purposes is very dangerous, he says: “If you do that, you will be hacked.” He sees a correlation between regions in Europe, whether these regions have moved on to MDR or not and how often breaches occur.
The fact that Bervar advocates MDR isn’t extremely surprising of course, as that is what Conscia offers to its customers. However, that doesn’t necessarily mean that he’s incorrect. MDR is, for most companies, a very important layer in their security stack.
Black, white and grey zones
Bervar thinks of how secure organizations are in terms of black and white on the one hand, and grey on the other. Black and white is the basis for every organization. Those are what you could call the traditional prevention methods, like segmentation and least-privileged access, but also firewalls, policy-based controls and patching. These pieces of the security puzzle reduce the attack surface and represent the baseline of what every organization should have in place. Zero trust is part of this strategy too. According to Bervar, that term is mostly the modern marketing term for what is essentially least-privileged access combined with segmentation.
Apart from the black and white area, there’s also what Bervar calls the grey zone. This deals with all of the things that prevention misses. It is also where MDR comes in. In the grey zone, the basic principle is not that nothing gets through the preventative measures. It is the opposite: the assumption is that there has been a breach and it is important to find and resolve that as quickly as possible.
Defense in depth
Bervar still sees a lot of investment into the black and white (i.e. prevention) part. That’s not very wise if there’s no investment in detection and response as well, he argues. Prevention suffers from diminishing returns anyway, he says. Detection and response, on the other hand can help organizations realize a better defense in depth, another very popular term in the cybersecurity industry.
What detection and response primarily offers is a lot of redundancy. “Even if you’re not patching, there’s still detection and response”, Bervar says. At the end of the day, good security is about how high the assurance is that you will be able to stay secure. In order to get the highest possible assurance, you cannot rely on a single mechanism.
Of course, all of this only makes organizations more secure if the detection and response on top of the prevention is done right. Bervar has also seen detection and response being done very poorly. In such a case, it won’t be much help.
That’s where companies like Conscia (and many others), who sell MDR services to customers, come in. Detection and response consists of a collection of different services, tools, telemetry, observability and so on. If you have the people to set this up yourself, you can, but you would need to build some kind of SOC (Security Operations Center) to bring everything together. That’s not very realistic for many companies. Outsourcing to a managed provider with an established SOC is usually more effective and more economical.
“Guilty until proven innocent”
When we ask Bervar what makes Conscia an MDR supplier worth considering, he sheds some light onto how the company looks at things. It has an approach Bervar calls “guilty until proven innocent”, or “shoot first, ask questions later”. This is necessary to address attack scenarios that unfold in seconds. That is too fast for even a five-minute investigation window to catch.
In Conscia’s approach, the moment a suspicious event is detected in a customer’s environment, automated containment actions are taken immediately: the affected host is isolated. In other words, investigation follows the action rather than preceding it. If everything turns out to be alright, the host is released within approximately five minutes, with minimal disruption to the user.
The approach Conscia takes is rather radical. This type of automation works on user-facing endpoints like laptops, but may encounter resistance in other areas of organizations. Servers running critical workloads or OT environments cannot be isolated and/or taken offline as easily. According to Bervar, customers have full configurability over which systems and populations fall under this model. A hospital, for example, can define specific device groups where the trigger-happy approach applies, while leaving the rest alone.
Not steps but miles ahead with MDR?
In general, Bervar is quite upbeat about the cybersecurity situation. That’s a nice change from the doom and gloom some other people project when we sit down and talk about cybersecurity with them. It is no surprise then that he states at the end of our interview that there’s no need to become extremely nervous, also not about Mythos and the powerful models that followed it.
At the end of our conversation, Bervar alludes to the concept of trying to stay one step ahead of the attackers. According to him, that is not ambitious enough. “We need to be miles ahead”, he says. With the right combination of prevention, detection and response and offensive security testing, this is possible, he claims.
Even if trying to be miles ahead turns out to be a bit too ambitious, it’s good to know not everyone in the security industry is preaching doom and gloom. The key message here is that there is already a lot you can do to protect organizations against attacks, even in the age of AI. Existing detection mechanisms can already detect many of the zero days the new (and older) AI models can unearth. It is mostly how you respond to them that makes the difference.
Our biggest takeaway from our conversation with Bervar is that organizations need to look at speeding up the time to response. Using the “Guilty until proven innocent” approach where they can is a good start.
Also read: Post-Mythos security is still very much pre-Mythos security