AI Tools in Cyber Security

In an ever-evolving cyberspace, the attackers are getting smarter in the best possible way. Every attack is so unique to make the lives of defenders always busy. With the AI boom, even attackers with not much sufficient knowledge can make malware via open AI models and can deliver via email. While the Gen AI boom has fired up in late 2022 after the arrival of ChatGPT, the AI itself has evolved much earlier than what we think about. In this article, let us dive into cyber security areas where AI is helpful.

AI IN IAM:

In recent times, attackers have taken advantage of admin/privileged accounts to carry out malicious operations or deploy ransomware, which requires high privilege. With AI, the organizations can have user behaviour analytics, wherein we can study user patterns and alert if any malicious activity deviates from the normal behaviour of users. AI can help detect malicious user signs and can block them effectively to prevent unauthorised attempts. AI detects abnormal activities involving privileged accounts, like studying user permissions/roles and system logs to identify any unauthorized usage of accounts, and also helps in user provisioning/de-provisioning. Some of the IAM tools that use AI are listed below but are not limited to:

1. AWS IAM
2. Google Cloud IAM
3. Azure AD/PIM
4. Sailpoint Point

AI in Vulnerability Management:

As the number of applications and devices increases, so do the vulnerabilities around them. For any organisation, vulnerability management involves monitoring, risk assessment, prioritization,remediation and reporting. AI in vulnerability management can involve various benefits, including auto-discovery of assets for the monitoring phase and risk assessment to categorize vulnerabilities based on exploitations in the wild. Tenable AIware, for instance, utilizes a vulnerability priority rating model machine learning to predict the likelihood of a CVE being targeted for exploitation in the next 28 days. Prioritization can use AI to categorize based on the risk categorization to urge the application server owners to patch of vulnerabilities. Remediation still needs to be done manually, as post-patching of vulnerabilities organizations might face discrepancies that could affect their productivity. It also helps red teamers/pen testers to look out for possible exploitation. Some of the vulnerability management tools are listed below, but those are not limited to:

1. Tenable.
2. Qualys.

AI in Incident Response:

AI in incident response is of great help to defenders across the world. The ability to handle a large volume of complex data and alert/remediate the threats/malware in real time gives a breathing space for defenders to act on complex cyber security incidents. For example, there is a real-time incident that tells us that there is a high data exfiltration attempt from one of the endpoints. With AI, we can analyze large and complex data across various devices and security tools to conclude the true or false positive nature of an incident. Some of the tools that aid in incident response are listed below:

1. Crowdstrike(Endpoint detection/response)
2. Defender product suite (includes identity protection, endpoint protection, and cloud app protection)
3. SENTINELONE

AI in network security:

AI in network security makes the life of professionals easier and more convenient. AI in network security detects real-time threats and prevents them from entering the network. In some cases, AI also helps in network segmentation. For example, with AI, we can categorise network segmentation based on subnets and by analysing the traffic. In some cases, with AI, we can categorise network traffic as legitimate, malware, or adware and proactively block traffic at the network level instead of manually. Some of the network security tools that are portrayed as NGFW (Next Gen Firewall) are listed below:

1. Zscaler
2. Palo Alto Global Protect

AI in GRC/Audit:

Auditing has been pivotal in cyber security. We as a cyber security professional always do it right, but it’s always a good practice to get constructive feedback from audit professionals. AI in GRC tools is a game changer for audit professionals. For example, by introducing AI in governance, we can eliminate manual tasks like report generation, checklists, etc. If you are working in the semiconductor industry, the AI can automatically create checklists for you pertaining to semiconductors; it can create checklists itself to review internal controls, misconfigurations, etc. Some of the tools include.

1. lockthreat.ai
2. Metricstream AI

Conclusion:

With AI, we can take our cyber security to the next level to ensure maximum protection for our customers across the globe. We could also leverage large or complex data sets to better strengthen our security posture. We at Symbiz Solutions have interacted with many customers across diversified domains like BFSI, manufacturing, energy sectors, etc. and have been providing cyber security solutions for them. We propose cyber security solutions to our customers based on their needs and budget and have been successful in delivering or driving key projects.