Businesses everywhere are constantly under cyber-attack. To protect themselves, companies deploy intrusion detection systems, firewalls, strong authentication, and various other security products. Unfortunately, while these security tools provide useful data about attack-related events as they unfold, they offer very little, if any, information about what an attacker is likely to do next.
The best defense is a proactive defense
Most security solutions are designed to stop an attack after it has started. Doug Clare, vice president of Cyber Security Solutions at FICO, commented in a recent FICO news release that, “current cyber security solutions leave a wide gap in coverage. It’s like having a burglar alarm that doesn’t go off until after the burglar’s done his work, left the premises and crossed the county line.”
Taking a reactive approach will always result in being two or more steps behind the attacker. A better outcome could be realised by taking a proactive stance to prevent the attack from ever happening.
One approach to achieving this is to figure out when and how a future breach on your network could take place. To figure this out, a security analyst might ask:
- What malware will the attacker install next?
- Which system is the attacker’s likely target?
- What security tools will the attacker attempt to disable?
- Will logs be altered, or will the attacker attempt to erase his tracks in some other way?
- Will privileged user accounts be compromised?
- Which applications might be probed for vulnerabilities?
- What data will the cybercriminal attempt to steal?
- How will the attacker transmit the data outside our network?
Answering these questions, however, would not only involve quite a bit of groundwork, it would rely on data collected from previous attacks, making it essentially a reactive instead or proactive technique. Instead, let’s change course and use a truly proactive strategy.
All types of data
Cyber-attack prediction requires lots of data and the ability to analyse it. As a result, early attempts at commercial attack prediction solutions have been disappointing. But improvements are being seen.
In the last few years, inexpensive storage and processing technologies have transformed the ability to capture, store, and process enormous amounts of data. In addition, the quality and
quantity of data that is available today are dramatically better than even a few years ago. So are the capabilities to analyse it.
Not only is it possible to capture, store and process data like never before, there is more data to be used to inform cyberattack predictions, including data created by social media and mobile devices. According to IDC, a global market intelligence firm, the data we create and copy annually will reach 44 zetabytes by 2020 – this will equate to 44tn gigabytes.
Light at the end of the cyber tunnel
With such advances, the promise of predicting cyber-attacks and criminals’ next move before they even take place is becoming closer to reality. But there are a few more pieces that need to be put into place:
- Global information sharing. The more data the better (as long as it’s good data). An organisation can capture and analyse its own data, but for many, that won’t be enough. It’s imperative that cyber-attack data from across the globe be shared on a larger scale.
- Integration of social data. While enterprise network data like logs and alerts are critical, so is non-enterprise data from social networks, traditional media reports, mobile communications, and other unclassified sources. Cyber-attack prediction systems will need to do a good job of integrating and analysing this external data.
- Network environment matching. Attack methods and sequences vary dramatically from one network environment to another. The machine learning algorithms are highly dependent on the organisation’s specific network infrastructure. However, global threat intelligence doesn’t always include network configuration information. The machine learning algorithms will need to improve to overcome this challenge.
- Adoption. Adoption has been slow. However, like most new technologies, maturity only comes with actual, real-world experience. Fortunately, early adopters are emerging who are willing to pay the price to bring cyber-attack prediction to the forefront and push it towards widespread availability.
It’s always interesting to watch new, revolutionary technologies emerge, and that’s certainly the case with cyber-attack prediction. Today’s analytics engines make it easier to start believing that the security industry is not far from effectively predicting a cybercriminal’s next move.
The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.