Incident Response in the Age of Intelligent Bots

Incident Response in the Age of Intelligent Bots

How security teams can improve their defense strategy by integrating bots

Once upon a time, cybersecurity was pretty straightforward. It was based on monitoring and detecting threats such as worms and viruses. This type of defense was effective because the attacks were relatively simple. Today, the attacks are not only sophisticated, but also automated. Just protection is not enough anymore. We need a quick and intelligent response.

Malicious bots are one of the most popular types of attacks, accounting for 20 percent of all internet traffic. Companies need to update their incident response plan to be able to face these advanced threats. Fortunately, intelligent bots can be used for good. Read on to learn how bots are helping security teams improve their incident response.

What Is Incident Response?

Incident response is a systematic approach to managing security breaches or cyber attacks. Companies use an incident response plan to handle attacks effectively, thus preventing a greater impact. Typically, an incident response plan involves a step-by-step process that forms part of a company's business continuity plan.

An incident recovery team is typically in charge of implementing the incident response plan. The team includes IT personnel, as well as members of other relevant departments, such as legal counsel, human resources, and communications.

In the event of a physical or digital disaster, losing data or functionality can be very damaging for any company. An incident response strategy can help you mitigate risk. As no network is 100% secure, being prepared is crucial for saving time in the event of an attack.

Six Steps of an Incident Response Plan

An incident response plan is composed of a series of steps to address the security event in an organized way. The incident response stages are:

  1. Preparation—this includes ensuring your staff is properly trained in their incident response roles. Part of the preparation consists of establishing policies and procedures for incident response management. You should develop drill scenarios and test the incident response regularly.
  2. Identification—during this step, the security team collects data from tools and systems to identify indicators of compromise. The goal is to identify the type of attack as quickly as possible. The more information you can gather about the attack, the better your strategy will be.
  3. Containment—the containment strategy should include a coordinated shutdown, wiping the affected devices, and rebuilding the operating system.
  4. Eradication—once the attack is contained, you should eliminate the root cause of the threat. This includes removing all malware.
  5. Recovery—in this stage, the affected systems and devices are returning to operative status.
  6. Lessons Learned—after the incident is resolved, you should document any information that can help prevent similar incidents in the future. This includes completing an incident report, and doing post-incident monitoring.

Given the increasing number of attacks led by malicious bots, companies need to update their incident response against them. Fortunately, while some bots can wreak havoc in systems, others can be used to help security teams against the malicious bots. The following sections should give you a head start.

Using Bots as an Attack Vector

A bot is an autonomous software that interacts with users or computer systems. For example, a program that acts like a computer game player. Intelligent bots are trained to understand natural languages, and can extract information from text or voice conversations. They can identify the users' intent, and then help with specific tasks. The most common example is a chatbot.

Attackers use malicious bots for a myriad of uses, such as data breaches, or Denial of Service (DoS) attacks. Malicious bots can affect critical infrastructure and have already been in use for political and criminal activities. Unfortunately, while bots are easy to use, they are also difficult to detect.

A bot attack happens when an attacker connects several devices, which run one or more bots. This network of bots follows the attacker’s instructions, launching the desired attack to gain access to the network. Cybercriminals can rent bots, modifying them for malicious purposes, and then quickly deploying them to make the most impact.

The increasing penetration of the Internet of Things (IoT) devices broadens the attack surface, thus making things easier for attackers. Cybercriminals can hijack connected devices to create large botnets. For example, a botnet called 3ve carried on three interconnected operations in 2018, infecting 1.7 million computers.

A bots attack is difficult to detect because bots can impersonate legitimate traffic. Bots are so widely used to scrape data and create indexes, that it’s becoming increasingly difficult to distinguish between a good bot and a malicious one.

Malicious bots have been used for criminal and political reasons. For example, in the U.S elections in November 2018, Twitter reported more than 10,000 bots sending posts to encourage people not to vote. They are also used also for industrial and financial espionage.

Fighting Fire with Fire: Integrating Bots into Incident Response

Security teams can improve their incident response by integrating bots. An example is a response bot. A response bot is a program that is driven by artificial intelligence. It studies the actions of Tier 2 and 3 analysts in the event of a security threat and gives recommendations. The response bot learns from the details of the incident which prompted the reaction of the analysts and recommends actions to Tier 1 analysts.

Another example is how chatbots are used at incident response. Companies use chatbots to assist the incident response team with communications at the time of an attack. The chatbot binds the incident to a chatroom where all discussions regarding the incident take place. This not only centralizes the communications between the stakeholders but also helps with decision making.

Some actions are performed right from the chatroom, and the ones conducted outside are reported automatically by the chatbot in the room for everyone to see. Examples of actions conducted by the bot include rebalancing traffic or locking deploy stacks. Once the incident is remediated, the bot generates an incident report, which provides the incident response team with the information needed to improve their work.

Malicious bots become more prevalent every day, but security teams are turning the tables by using “good bots” against them. Chatbots streamline incident response, while response bots take it up a notch, recommending courses of action to analysts. Good bots even up the odds, equipping incident response teams with a weapon that equals that of their opponents.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2024: Post-Show Recap

    ISC West 2024 is complete. And from start to finish, the entire conference was a huge success with almost 30,000 people in attendance. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

Webinars

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3