New Algorithms Learn from Security Response Patterns within an Organization; Platform Now Leverages Open-Source MITRE ATT&CK Framework
IBM Security today announced new capabilities for the company's AI-based security platform, QRadar Advisor with Watson, which expand the platform's knowledge of cybercriminal behavior and allow it to learn from security response activities within an organization. IBM Security also is embracing the open-source MITRE ATT&CK framework, a playbook to help analysts understand how an attack has evolved and what might happen next based on real-world observations from the security community.
With some estimates predicting as many as 3.5 million cybersecurity vacancies by 20211, security teams today are struggling with the capacity and skills needed to effectively analyze and respond to a massive amount of cybersecurity incidents and alerts. The use of AI and machine learning technologies like QRadar Advisor with Watson, which learns from the latest research available in the external security community as well as activities happening within an organization, can equip analysts with the knowledge and automation needed to help them escalate critical threats faster and more effectively.
As part of the latest release, IBM has developed new analytic and learning models which enable QRadar Advisor to identify long and slow attack patterns and adapt to the local client environment. This learning loop gets smarter with time based on additional interactions and engagement with analysts, allowing the tool to provide stronger recommendations on how to respond, as well confidence ratings based on how incidents align with historical data.
"Standards like MITRE ATT&CK, which take advantage of the collective knowledge of the security community, are crucial to advancing the industry and helping security teams stay ahead of increasingly sophisticated threats," said Chris Meenan, Director of Security Intelligence Offering Management and Strategy, IBM Security. "Combining the ATT&CK framework of known adversary tactics with Watson for Cyber Security's ability to stay current on the latest security research, QRadar Advisor can help arm analysts of all levels with the knowledge needed to better respond to the threats they're facing."
Connecting the Dots for More Decisive Threat Escalation
MITRE ATT&CK is an open-source playbook of cybercriminal behavior developed with real-world examples and insights from cybersecurity experts across the industry, which defines step-by-step patterns and actions that a threat can take as it evolves.
Using the ATT&CK framework, QRadar Advisor with Watson is moving beyond identifying the threat and providing external research on it, to now also shedding light on how external attacks and internal threats have progressed within the client infrastructure – for instance, whether a malware has just landed within an organization, or if it has collected data such as passwords or credit card information. This added context also includes a confidence level as well as the relevant evidence for each stage of the attack. By helping analysts visualize how an attack has evolved, this capability allows analysts to understand immediately where an incident stands in a threat lifecycle and what it might do next, which can significantly improve response times and effectiveness.
These additional insights from QRadar Advisor can augment the skills of analysts and help them connect the dots to see the full scope of an attack in a way that a higher-level analyst or threat hunter could do. Advisor can also use ATT&CK to recommend a more decisive incident escalation process to analysts, helping them understand the immediate next steps to take based on where the threat falls in its lifecycle. Leveraging the ATT&CK framework allows QRadar Advisor to provide this context in an industry standard that maps to company's incident response playbooks.
Applying New Learning Models to Threats within an Organization
IBM Security is also deepening the intelligence of QRadar Advisor with Watson by enabling it to learn and contextualize behavior of threats and security response actions happening inside an organization.
The initial release of QRadar Advisor with Watson enabled Watson to gather, read, and understand structured and unstructured security data from external sources, and bring the most relevant information to analysts' fingertips to help them understand what was already known and published on a specific threat. Now, QRadar Advisor is also learning from the actions being taken within customers' environments – both events happening in real time, as well as what has happened with certain types of events historically. Two new capabilities IBM is introducing for QRadar Advisor include:
- Threat Disposition Models: QRadar Advisor uses new algorithms to build a model for specific types of threats, based on the actions and outcome of previous similar events that have happened within an organization. When a new investigation comes in, this model can be used to help rule out false positives, or help the analyst decide whether the threat should be escalated as malware, data exfiltration, or other specific types of threats. This capability becomes increasingly intelligent the more it's used, learning and adapting based on interactions with analysts.
- Cross-Investigation Analytics: Within a company's Security Operation Center (SOC), multiple analysts may be working on different offenses which are related to each other, or alerts over many months might be part of a long-term adversarial campaign. This capability allows QRadar Advisor to find commonalities across investigations using cognitive reasoning, and automatically group together investigations that are related to avoid duplication of efforts, as well as provide fuller context to aid in the investigation.
Combining these new learning models, which add context to activities within the network, with Watson for Cyber Security's investigative capabilities and ability to digest current research being published in the security community, analysts can now use QRadar Advisor to help drive deeper, more consistent investigations and respond faster and more efficiently.
About IBM Security
IBM Security offers one of the most advanced and integrated portfolios of enterprise security products and services. The portfolio, supported by world-renowned IBM X-Force® research, enables organizations to effectively manage risk and defend against emerging threats. IBM operates one of the world's broadest security research, development and delivery organizations, monitors 60 billion security events per day in more than 130 countries, and has been granted more than 8,000 security patents worldwide. For more information, please check www.ibm.com/security, follow @IBMSecurity on Twitter or visit the IBM Security Intelligence blog.
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online