Incident Response in the Age of Intelligent Bots

Incident Response in the Age of Intelligent Bots

How security teams can improve their defense strategy by integrating bots

Once upon a time, cybersecurity was pretty straightforward. It was based on monitoring and detecting threats such as worms and viruses. This type of defense was effective because the attacks were relatively simple. Today, the attacks are not only sophisticated, but also automated. Just protection is not enough anymore. We need a quick and intelligent response.

Malicious bots are one of the most popular types of attacks, accounting for 20 percent of all internet traffic. Companies need to update their incident response plan to be able to face these advanced threats. Fortunately, intelligent bots can be used for good. Read on to learn how bots are helping security teams improve their incident response.

What Is Incident Response?

Incident response is a systematic approach to managing security breaches or cyber attacks. Companies use an incident response plan to handle attacks effectively, thus preventing a greater impact. Typically, an incident response plan involves a step-by-step process that forms part of a company's business continuity plan.

An incident recovery team is typically in charge of implementing the incident response plan. The team includes IT personnel, as well as members of other relevant departments, such as legal counsel, human resources, and communications.

In the event of a physical or digital disaster, losing data or functionality can be very damaging for any company. An incident response strategy can help you mitigate risk. As no network is 100% secure, being prepared is crucial for saving time in the event of an attack.

Six Steps of an Incident Response Plan

An incident response plan is composed of a series of steps to address the security event in an organized way. The incident response stages are:

  1. Preparation—this includes ensuring your staff is properly trained in their incident response roles. Part of the preparation consists of establishing policies and procedures for incident response management. You should develop drill scenarios and test the incident response regularly.
  2. Identification—during this step, the security team collects data from tools and systems to identify indicators of compromise. The goal is to identify the type of attack as quickly as possible. The more information you can gather about the attack, the better your strategy will be.
  3. Containment—the containment strategy should include a coordinated shutdown, wiping the affected devices, and rebuilding the operating system.
  4. Eradication—once the attack is contained, you should eliminate the root cause of the threat. This includes removing all malware.
  5. Recovery—in this stage, the affected systems and devices are returning to operative status.
  6. Lessons Learned—after the incident is resolved, you should document any information that can help prevent similar incidents in the future. This includes completing an incident report, and doing post-incident monitoring.

Given the increasing number of attacks led by malicious bots, companies need to update their incident response against them. Fortunately, while some bots can wreak havoc in systems, others can be used to help security teams against the malicious bots. The following sections should give you a head start.

Using Bots as an Attack Vector

A bot is an autonomous software that interacts with users or computer systems. For example, a program that acts like a computer game player. Intelligent bots are trained to understand natural languages, and can extract information from text or voice conversations. They can identify the users' intent, and then help with specific tasks. The most common example is a chatbot.

Attackers use malicious bots for a myriad of uses, such as data breaches, or Denial of Service (DoS) attacks. Malicious bots can affect critical infrastructure and have already been in use for political and criminal activities. Unfortunately, while bots are easy to use, they are also difficult to detect.

A bot attack happens when an attacker connects several devices, which run one or more bots. This network of bots follows the attacker’s instructions, launching the desired attack to gain access to the network. Cybercriminals can rent bots, modifying them for malicious purposes, and then quickly deploying them to make the most impact.

The increasing penetration of the Internet of Things (IoT) devices broadens the attack surface, thus making things easier for attackers. Cybercriminals can hijack connected devices to create large botnets. For example, a botnet called 3ve carried on three interconnected operations in 2018, infecting 1.7 million computers.

A bots attack is difficult to detect because bots can impersonate legitimate traffic. Bots are so widely used to scrape data and create indexes, that it’s becoming increasingly difficult to distinguish between a good bot and a malicious one.

Malicious bots have been used for criminal and political reasons. For example, in the U.S elections in November 2018, Twitter reported more than 10,000 bots sending posts to encourage people not to vote. They are also used also for industrial and financial espionage.

Fighting Fire with Fire: Integrating Bots into Incident Response

Security teams can improve their incident response by integrating bots. An example is a response bot. A response bot is a program that is driven by artificial intelligence. It studies the actions of Tier 2 and 3 analysts in the event of a security threat and gives recommendations. The response bot learns from the details of the incident which prompted the reaction of the analysts and recommends actions to Tier 1 analysts.

Another example is how chatbots are used at incident response. Companies use chatbots to assist the incident response team with communications at the time of an attack. The chatbot binds the incident to a chatroom where all discussions regarding the incident take place. This not only centralizes the communications between the stakeholders but also helps with decision making.

Some actions are performed right from the chatroom, and the ones conducted outside are reported automatically by the chatbot in the room for everyone to see. Examples of actions conducted by the bot include rebalancing traffic or locking deploy stacks. Once the incident is remediated, the bot generates an incident report, which provides the incident response team with the information needed to improve their work.

Malicious bots become more prevalent every day, but security teams are turning the tables by using “good bots” against them. Chatbots streamline incident response, while response bots take it up a notch, recommending courses of action to analysts. Good bots even up the odds, equipping incident response teams with a weapon that equals that of their opponents.

Featured

  • Enforcing Zero Trust in a Hybrid Work Environment

    Enforcing Zero Trust in a Hybrid Work Environment

    The effects of the pandemic have rippled across the business world like a meteor hitting a pond, creating a new plethora of challenges that incorporated into MBA curriculum for years to come. Read Now

  • First Responders Give NIST Their Communications Tech Wish Lists

    First Responders Give NIST Their Communications Tech Wish Lists

    Our first responders have spoken. An extensive research project conducted by experts at the National Institute of Standards and Technology (NIST) reveals what our country’s police, fire, emergency medical and 911 dispatch responders think about the communications technology they use on a regular basis and how they would like developers to improve it in the future. Read Now

  • Study Finds U.S. Enterprises Hit by Short-staffed Security Operations Centers

    Study Finds U.S. Enterprises Hit by Short-staffed Security Operations Centers

    ManageEngine, the enterprise IT management division of Zoho Corporation, recently announced results from its new study, Cloud Security Outlook 2023. The study found that enterprises have a limited number of analysts running their security operations centers (SOCs) and are deploying multiple tools in an attempt to address their cloud security challenges. Read Now

  • Report: More Than Half of Organizations Have Experienced an Insider Threat in the Past Year

    Report: More Than Half of Organizations Have Experienced an Insider Threat in the Past Year

    Gurucul, a provider of solutions in the Next Generation SIEM market, and Cybersecurity Insiders, a 600,000+ member online community for information security professionals, recently released its annual 2023 Insider Threat Report. Overall, results indicate insider threats are a top concern at organizations of all kinds; only 3% of respondents surveyed are not concerned with insider risk. Read Now

Featured Cybersecurity

New Products

  • BIO-key MobileAuth

    BIO-key MobileAuth

    BIO-key International has introduced its new mobile app, BIO-key MobileAuth™ with PalmPositive™ the latest among over sixteen strong authentication factors available for BIO-key's PortalGuard® Identity-as-a-Service (IDaaS) platform. 3

  • Dinkle DKU Barrier Terminal Blocks

    Dinkle DKU Barrier Terminal Blocks

    New DKU screw type terminal blocks use a spring-guided system where the screws are integrated and captive within the terminal enclosure. These screws can be backed out so that ring- or U-shaped cable lugs can be inserted, without the possibility of losing the screw. 3

  • Hanwha Techwin Wisenet XRN-6410DB4 / mXRN-3210B4

    Hanwha Techwin Wisenet XRN-6410DB4 / mXRN-3210B4

    Hanwha Techwin America, a global supplier of IP and analog video surveillance solutions, unveiled two new Wisenet X series NVRs that support the industry’s first video playback and recording of up to 8K super-high-resolution images. 3