Technology & Innovation

Predicting cyber-attacks, not as far-fetched as it sounds

June 30, 2017

Global

June 30, 2017

Global
Brian Laing

VP of Products and Business Development

Brian Laing is Vice President, Business Development & Products at Lastline. For more than 20 years, Brian Laing has shared his strategic business vision and technical leadership with a range of start-ups and established companies in various executive level roles. The author of “APT for Dummies,” Brian was previously vice president of AhnLab, where he directed the US operations of the internationally known security and software leader. He founded Hive Media and served as CEO. As the co-founder of RedSeal Systems, Brian conceived of the overall design and features of the product and was granted two patents related to network security. Brian was also founder and CEO of self-funded Blade Software that released the industry’s first commercial IPS/FW testing tool.

Knowing your assailant’s next move can protect you from the next data breach. Armed with such information, security analysts could take proactive measures to protect sensitive data, patch or update vulnerable software, bolster security settings and block the attacker’s access and progress.

Businesses everywhere are constantly under cyber-attack. To protect themselves, companies deploy intrusion detection systems, firewalls, strong authentication, and various other security products. Unfortunately, while these security tools provide useful data about attack-related events as they unfold, they offer very little, if any, information about what an attacker is likely to do next.

The best defense is a proactive defense

Most security solutions are designed to stop an attack after it has started. Doug Clare, vice president of Cyber Security Solutions at FICO, commented in a that, “current cyber security solutions leave a wide gap in coverage. It’s like having a burglar alarm that doesn’t go off until after the burglar’s done his work, left the premises and crossed the county line.”

Taking a reactive approach will always result in being two or more steps behind the attacker. A better outcome could be realised by taking a proactive stance to prevent the attack from ever happening.

One approach to achieving this is to figure out when and how a future breach on your network could take place. To figure this out, a security analyst might ask:

  • What malware will the attacker install next?
  • Which system is the attacker’s likely target?
  • What security tools will the attacker attempt to disable?
  • Will logs be altered, or will the attacker attempt to erase his tracks in some other way?
  • Will privileged user accounts be compromised?
  • Which applications might be probed for vulnerabilities?
  • What data will the cybercriminal attempt to steal?
  • How will the attacker transmit the data outside our network?

Answering these questions, however, would not only involve quite a bit of groundwork, it would rely on data collected from previous attacks, making it essentially a reactive instead or proactive technique. Instead, let’s change course and use a truly proactive strategy.

All types of data

Cyber-attack prediction requires lots of data and the ability to analyse it. As a result, early attempts at commercial attack prediction solutions have been disappointing. But improvements are being seen.

In the last few years, inexpensive storage and processing technologies have transformed the ability to capture, store, and process enormous amounts of data. In addition, the quality and

quantity of data that is available today are dramatically better than even a few years ago. So are the capabilities to analyse it.

Not only is it possible to capture, store and process data like never before, there is more data to be used to inform cyberattack predictions, including data created by social media and mobile devices. According to IDC, a global market intelligence firm, the data we create and copy annually will reach 44 zetabytes by 2020 – this will equate to 44tn gigabytes.

Light at the end of the cyber tunnel

With such advances, the promise of predicting cyber-attacks and criminals’ next move before they even take place is becoming closer to reality. But there are a few more pieces that need to be put into place:

  • Global information sharing. The more data the better (as long as it’s good data). An organisation can capture and analyse its own data, but for many, that won’t be enough. It’s imperative that cyber-attack data from across the globe be shared on a larger scale.
  • Integration of social data. While enterprise network data like logs and alerts are critical, so is non-enterprise data from social networks, traditional media reports, mobile communications, and other unclassified sources. Cyber-attack prediction systems will need to do a good job of integrating and analysing this external data.
  • Network environment matching. Attack methods and sequences vary dramatically from one network environment to another. The machine learning algorithms are highly dependent on the organisation’s specific network infrastructure. However, global threat intelligence doesn’t always include network configuration information. The machine learning algorithms will need to improve to overcome this challenge.
  • Adoption. Adoption has been slow. However, like most new technologies, maturity only comes with actual, real-world experience.  Fortunately, early adopters are emerging who are willing to pay the price to bring cyber-attack prediction to the forefront and push it towards widespread availability.

It’s always interesting to watch new, revolutionary technologies emerge, and that’s certainly the case with cyber-attack prediction. Today’s analytics engines make it easier to start believing that the security industry is not far from effectively predicting a cybercriminal’s next move.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week