Incident Response in the Age of Intelligent Bots

How security teams can improve their defense strategy by integrating bots

• By Gilad David Maayan
• Oct 16, 2019

Once upon a time, cybersecurity was pretty straightforward. It was based on monitoring and detecting threats such as worms and viruses. This type of defense was effective because the attacks were relatively simple. Today, the attacks are not only sophisticated, but also automated. Just protection is not enough anymore. We need a quick and intelligent response.

Malicious bots are one of the most popular types of attacks, accounting for 20 percent of all internet traffic. Companies need to update their incident response plan to be able to face these advanced threats. Fortunately, intelligent bots can be used for good. Read on to learn how bots are helping security teams improve their incident response.

What Is Incident Response?

Incident response is a systematic approach to managing security breaches or cyber attacks. Companies use an incident response plan to handle attacks effectively, thus preventing a greater impact. Typically, an incident response plan involves a step-by-step process that forms part of a company's business continuity plan.

An incident recovery team is typically in charge of implementing the incident response plan. The team includes IT personnel, as well as members of other relevant departments, such as legal counsel, human resources, and communications.

In the event of a physical or digital disaster, losing data or functionality can be very damaging for any company. An incident response strategy can help you mitigate risk. As no network is 100% secure, being prepared is crucial for saving time in the event of an attack.

Six Steps of an Incident Response Plan

An incident response plan is composed of a series of steps to address the security event in an organized way. The incident response stages are:

1. Preparation—this includes ensuring your staff is properly trained in their incident response roles. Part of the preparation consists of establishing policies and procedures for incident response management. You should develop drill scenarios and test the incident response regularly.
2. Identification—during this step, the security team collects data from tools and systems to identify indicators of compromise. The goal is to identify the type of attack as quickly as possible. The more information you can gather about the attack, the better your strategy will be.
3. Containment—the containment strategy should include a coordinated shutdown, wiping the affected devices, and rebuilding the operating system.
4. Eradication—once the attack is contained, you should eliminate the root cause of the threat. This includes removing all malware.
5. Recovery—in this stage, the affected systems and devices are returning to operative status.
6. Lessons Learned—after the incident is resolved, you should document any information that can help prevent similar incidents in the future. This includes completing an incident report, and doing post-incident monitoring.

Given the increasing number of attacks led by malicious bots, companies need to update their incident response against them. Fortunately, while some bots can wreak havoc in systems, others can be used to help security teams against the malicious bots. The following sections should give you a head start.

Using Bots as an Attack Vector

A bot is an autonomous software that interacts with users or computer systems. For example, a program that acts like a computer game player. Intelligent bots are trained to understand natural languages, and can extract information from text or voice conversations. They can identify the users' intent, and then help with specific tasks. The most common example is a chatbot.

Attackers use malicious bots for a myriad of uses, such as data breaches, or Denial of Service (DoS) attacks. Malicious bots can affect critical infrastructure and have already been in use for political and criminal activities. Unfortunately, while bots are easy to use, they are also difficult to detect.

A bot attack happens when an attacker connects several devices, which run one or more bots. This network of bots follows the attacker’s instructions, launching the desired attack to gain access to the network. Cybercriminals can rent bots, modifying them for malicious purposes, and then quickly deploying them to make the most impact.

The increasing penetration of the Internet of Things (IoT) devices broadens the attack surface, thus making things easier for attackers. Cybercriminals can hijack connected devices to create large botnets. For example, a botnet called 3ve carried on three interconnected operations in 2018, infecting 1.7 million computers.

A bots attack is difficult to detect because bots can impersonate legitimate traffic. Bots are so widely used to scrape data and create indexes, that it’s becoming increasingly difficult to distinguish between a good bot and a malicious one.

Malicious bots have been used for criminal and political reasons. For example, in the U.S elections in November 2018, Twitter reported more than 10,000 bots sending posts to encourage people not to vote. They are also used also for industrial and financial espionage.

Fighting Fire with Fire: Integrating Bots into Incident Response

Security teams can improve their incident response by integrating bots. An example is a response bot. A response bot is a program that is driven by artificial intelligence. It studies the actions of Tier 2 and 3 analysts in the event of a security threat and gives recommendations. The response bot learns from the details of the incident which prompted the reaction of the analysts and recommends actions to Tier 1 analysts.

Another example is how chatbots are used at incident response. Companies use chatbots to assist the incident response team with communications at the time of an attack. The chatbot binds the incident to a chatroom where all discussions regarding the incident take place. This not only centralizes the communications between the stakeholders but also helps with decision making.

Some actions are performed right from the chatroom, and the ones conducted outside are reported automatically by the chatbot in the room for everyone to see. Examples of actions conducted by the bot include rebalancing traffic or locking deploy stacks. Once the incident is remediated, the bot generates an incident report, which provides the incident response team with the information needed to improve their work.

Malicious bots become more prevalent every day, but security teams are turning the tables by using “good bots” against them. Chatbots streamline incident response, while response bots take it up a notch, recommending courses of action to analysts. Good bots even up the odds, equipping incident response teams with a weapon that equals that of their opponents.