Story image

Human-machine teaming a key ingredient for success in security operations centres

01 Aug 2017

Cybersecurity is not all about the machines and technology that power it, but also how human-machine teaming are pushing the boundaries of threat analysis.

McAfee released a report last week that showed how security operations centres (SOCs) have evolved to be on the cutting edge of threat hunting.

The report broke down security teams into four levels of development: minimal, procedural, innovative and leading.

McAfee defines threat hunters as professional members of a security team that examine threats by using clues, hypotheses and experience from researching cybercriminals.

As threat intelligence within an organisation becomes more sophisticated, firms are able to get better leverage from their investment in threat intelligence by emphasising local, private and paid intelligence sources, the company states.

The report also found that advanced SOCs devote 50% more time on threat hunting than their counterparts.

The collaboration between humans and machines, known as human-machine teaming, has also developed from the need for a focus on professional threat hunters and automated technologies.

The report says that 71% of ‘leading’ threat hunting organisations are using human-machine teaming, compared to those SOCs that operate at the minimal level (31%).

71% of advanced SOCs were able to close breach incident investigations in less than a week. 37% said they closed investigations in fewer than 24 hours.

Novice hunters can only find the cause of 20% of attacks, while leading hunters will find the cause of 90%.

“Threat hunters are enormously valuable as part of that plan to regain the advantage from those trying to disrupt business, but only when they are efficient can they be successful,” comments McAfee’s VP of corporate security products, Raja Patel.

As SOCs combine human and machine power and become more mature, they are more likely to spend time customising tools and techniques, automating parts of the attack investigation process, use a sandbox 50% more than entry-level SOCs and spend 50% more time on actual threat hunting.

McAfee also says that the threat hunters themselves are key to deploying automation in security infrastructure. They must select, curate and often build the security tools and then turn them into automated processes through customisation.

McAfee has furthered its encouragement of human-machine teaming, pledging support to OpenDXL.com, an independent collaboration portal for OpenDXL.com.

The portal was created to provide access to ideas and resources for application integrations.                      

The company believes that the combination of threat hunting and automation forms the basis of human-machine teaming, which is a critical strategy to preventing current and future threats.

“It takes both the threat hunter and innovative technology to build a strong human-machine teaming strategy that keeps cyber threats at bay,” Patel adds.

McAfee’s study gained responses from more than 700 IT and security professionals whose jobs include threat hunting. Respondents were from Australia, Canada, Germany, Singapore, the UK and US.

Why 'right to repair' legislation could be a new lease on life for broken devices
“These companies are profiting at the expense of our environment and our pocketbooks as we become a throw-away society that discards over 6 million tonnes of electronics every year.”
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
SAS partners with NVIDIA on deep learning and computer vision
“By partnering with NVIDIA, we combine our strengths to augment human intelligence and realise the true potential of AI.” 
Why businesses must embrace automation to ensure success
“For many younger workers, the traditional view of a steady job at one company, perhaps for life, simply doesn’t reflect reality."
Dropbox invests in hosting data inside Australia
Global collaboration platform Dropbox has announced it will now host Australian customer files onshore to support its growing base in the country.
TYAN unveils new inference-optimised GPU platforms with NVIDIA T4 accelerators
“TYAN servers with NVIDIA T4 GPUs are designed to excel at all accelerated workloads, including machine learning, deep learning, and virtual desktops.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
How Cognata and NVIDIA enable autonomous vehicle simulation
“Cognata and NVIDIA are creating a robust solution that will efficiently and safely accelerate autonomous vehicles’ market entry."