Incident Response in the Age of Intelligent Bots

Incident Response in the Age of Intelligent Bots

How security teams can improve their defense strategy by integrating bots

Once upon a time, cybersecurity was pretty straightforward. It was based on monitoring and detecting threats such as worms and viruses. This type of defense was effective because the attacks were relatively simple. Today, the attacks are not only sophisticated, but also automated. Just protection is not enough anymore. We need a quick and intelligent response.

Malicious bots are one of the most popular types of attacks, accounting for 20 percent of all internet traffic. Companies need to update their incident response plan to be able to face these advanced threats. Fortunately, intelligent bots can be used for good. Read on to learn how bots are helping security teams improve their incident response.

What Is Incident Response?

Incident response is a systematic approach to managing security breaches or cyber attacks. Companies use an incident response plan to handle attacks effectively, thus preventing a greater impact. Typically, an incident response plan involves a step-by-step process that forms part of a company's business continuity plan.

An incident recovery team is typically in charge of implementing the incident response plan. The team includes IT personnel, as well as members of other relevant departments, such as legal counsel, human resources, and communications.

In the event of a physical or digital disaster, losing data or functionality can be very damaging for any company. An incident response strategy can help you mitigate risk. As no network is 100% secure, being prepared is crucial for saving time in the event of an attack.

Six Steps of an Incident Response Plan

An incident response plan is composed of a series of steps to address the security event in an organized way. The incident response stages are:

  1. Preparation—this includes ensuring your staff is properly trained in their incident response roles. Part of the preparation consists of establishing policies and procedures for incident response management. You should develop drill scenarios and test the incident response regularly.
  2. Identification—during this step, the security team collects data from tools and systems to identify indicators of compromise. The goal is to identify the type of attack as quickly as possible. The more information you can gather about the attack, the better your strategy will be.
  3. Containment—the containment strategy should include a coordinated shutdown, wiping the affected devices, and rebuilding the operating system.
  4. Eradication—once the attack is contained, you should eliminate the root cause of the threat. This includes removing all malware.
  5. Recovery—in this stage, the affected systems and devices are returning to operative status.
  6. Lessons Learned—after the incident is resolved, you should document any information that can help prevent similar incidents in the future. This includes completing an incident report, and doing post-incident monitoring.

Given the increasing number of attacks led by malicious bots, companies need to update their incident response against them. Fortunately, while some bots can wreak havoc in systems, others can be used to help security teams against the malicious bots. The following sections should give you a head start.

Using Bots as an Attack Vector

A bot is an autonomous software that interacts with users or computer systems. For example, a program that acts like a computer game player. Intelligent bots are trained to understand natural languages, and can extract information from text or voice conversations. They can identify the users' intent, and then help with specific tasks. The most common example is a chatbot.

Attackers use malicious bots for a myriad of uses, such as data breaches, or Denial of Service (DoS) attacks. Malicious bots can affect critical infrastructure and have already been in use for political and criminal activities. Unfortunately, while bots are easy to use, they are also difficult to detect.

A bot attack happens when an attacker connects several devices, which run one or more bots. This network of bots follows the attacker’s instructions, launching the desired attack to gain access to the network. Cybercriminals can rent bots, modifying them for malicious purposes, and then quickly deploying them to make the most impact.

The increasing penetration of the Internet of Things (IoT) devices broadens the attack surface, thus making things easier for attackers. Cybercriminals can hijack connected devices to create large botnets. For example, a botnet called 3ve carried on three interconnected operations in 2018, infecting 1.7 million computers.

A bots attack is difficult to detect because bots can impersonate legitimate traffic. Bots are so widely used to scrape data and create indexes, that it’s becoming increasingly difficult to distinguish between a good bot and a malicious one.

Malicious bots have been used for criminal and political reasons. For example, in the U.S elections in November 2018, Twitter reported more than 10,000 bots sending posts to encourage people not to vote. They are also used also for industrial and financial espionage.

Fighting Fire with Fire: Integrating Bots into Incident Response

Security teams can improve their incident response by integrating bots. An example is a response bot. A response bot is a program that is driven by artificial intelligence. It studies the actions of Tier 2 and 3 analysts in the event of a security threat and gives recommendations. The response bot learns from the details of the incident which prompted the reaction of the analysts and recommends actions to Tier 1 analysts.

Another example is how chatbots are used at incident response. Companies use chatbots to assist the incident response team with communications at the time of an attack. The chatbot binds the incident to a chatroom where all discussions regarding the incident take place. This not only centralizes the communications between the stakeholders but also helps with decision making.

Some actions are performed right from the chatroom, and the ones conducted outside are reported automatically by the chatbot in the room for everyone to see. Examples of actions conducted by the bot include rebalancing traffic or locking deploy stacks. Once the incident is remediated, the bot generates an incident report, which provides the incident response team with the information needed to improve their work.

Malicious bots become more prevalent every day, but security teams are turning the tables by using “good bots” against them. Chatbots streamline incident response, while response bots take it up a notch, recommending courses of action to analysts. Good bots even up the odds, equipping incident response teams with a weapon that equals that of their opponents.

Featured

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.