STE WILLIAMS

A typical cybersecurity analyst is never short of work, a lot of which can be futile. According to a 2015 Ponemon Institute study, by the end of the year the average security operations center has spent around 20,000 hours just on chasing alerts that prove to be false alarms. Traditional security systems generate a lot of noise that needs to be waded through, which creates even more work. At the same time, a vast pool of security information is published across multiple media in natural languages that can’t be quickly processed and leveraged by these systems.

Cognitive security, or artificial intelligence, can “understand” natural language, and is a logical and necessary next step to take advantage of this increasingly massive corpus of intelligence that exists. These solutions, which have recently come into the market from a number of vendors including IBM Resilient, can be effective in all functions of cybersecurity, but perhaps none more so than in the response phase. Here the key metric is how quickly your team can mitigate the threat and get back to normal operations. Pairing humans and cognitive security solutions will help make sense of all this data with speed and precision, accomplishing response in a fraction of the time.  

But using cognitive solutions is not about man vs. machine. To borrow from an earlier era of artificial intelligence, it’s not as much Kasparov vs. Big Blue as it is Kasparov consulting with Big Blue before deciding on his next move against an unknown opponent. Defense works best when people and machine work together.

There are three fundamental reasons why this is true, especially when responding to a cyber incident:

1. Level playing field: Cyber attacks and their breaches aren’t executed by technology; they’re the work of human beings. Therefore, it’s good business sense to level the playing field by having real humans on the other side of this. It’s even been referred to as “hand-to-hand combat.” This symbiosis between cognitive technology and human being is crucial and will ensure your organization is best equipped to respond.
2. Information curation: While cognitive solutions can process information in nanoseconds and make key suggestions, not all information is relevant. Systems need to accept input from the analyst to set the broader context of an incident. They also need to be able to describe and document their findings and remediation steps and rank the information, Spotify-style, to separate what was relevant from any red herrings. This all helps to inform the next suggested response.
3. Risk of false positives: The cost of a cyber attack is well researched, but the cost of a false positive is more elusive. Consider a penetration test: an automated incident response system may see what looks like an attack on the database and shut it down. This kind of decision is a high-stakes scenario that needs a human in the loop.

AI-Assisted Incident Response the Skills Shortage
Another key benefit: atificial intelligence will help address the talent management issue of “infosec burnout.” One analyst who documented how long it takes to fill open senior-level security positions theorizes that people bail early in their security careers after getting a taste of what the job is all about. Stress in this job is real but can be reduced if analysts work at a more strategic level by curating, not just reacting, and by consulting with a cognitive system that can share what others have done. 

In the face of an increasingly hostile environment, keeping humans in the loop and backing them up with a data-rich cognitive system is what will give businesses their best shot.

Related Content:

• 8 Most Overlooked Security Threats
• Facebook Offers $1 Million for New Security Defenses
• Get Ready for the 2038 ‘Epocholypse’ (and Worse)

John Bruce is a seasoned executive with a successful track record of building companies that deliver innovative customer solutions, particularly in security products and services. Previously chairman and CEO of Quickcomm, an Inc. 500 international company headquartered in New … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/why-cybersecurity-needs-a-human-in-the-loop/a/d-id/1329505?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The US Department of Justice has released a framework to help businesses develop formal vulnerability disclosure programs. More businesses are adopting vulnerability disclosure programs to better detect security problems that could lead to data compromise and disruption.

Some informally accept vulnerability reports with no structured process; others have formal programs with policies to dictate how they accept vulnerabilities and share the information with those affected. These policies may also include authorized methods for finding flaws in a business’ systems, services, and products.

The framework, created by the Criminal Division’s Cybersecurity Unit, provides a process for designing and administering a program, as well as a set of considerations that could help inform vulnerability disclosure policies. It doesn’t specify the goals and structure for these programs as every business has different goals and priorities.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/doj-launches-framework-for-vulnerability-disclosure-programs/d/d-id/1329514?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The owners of Bitcoin wallets associated with this year’s WannaCry attack have withdrawn their funds, the BBC reports. More than $140,000 in Bitcoin has been removed from the online wallets, leaving their collective balance at zero.

WannaCry victims were asked to pay between $300 and $600 in Bitcoin to restore their data when the ransomware outbreak hit earlier this year. Despite experts’ warnings that payment wouldn’t guarantee recovery, many victims decided to pay anyway. Part of the funds were withdrawn in late July; the rest were removed this week.

Experts don’t anticipate the collectors will attempt to turn the digital currency into real money, a move that would help determine who is behind this. Many expect the Bitcoin will be put into a “mixer” and mixed into a larger series of payments so it’s harder to track.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/wannacry-ransom-bitcoins-withdrawn-from-online-wallets/d/d-id/1329538?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Meetings at the office can be a battlefield for women and minorities in the cybersecurity field. 

“Many women lack confidence, but you want your ideas to be heard by the team you are with,” says Telle Whitney, CEO and co-founder of the Anita Borg Institute. Programmers or team members want to be seen as their professional role, not as a woman programmer or a black programmer, she says.

“Every woman that we work with – that is their goal,” she says.

There are strategies for making meetings more inclusive so that all members of the team get to contribute:

Encourage all voices and ideas.

Research has shown that women are interrupted more than men in meetings and their ideas valued less by team members, but there are ways to reduce that behavior, say inclusion experts.

Managers and team leaders should set ground rules before a meeting, says Mary Chaney, vice president at International Consortium of Minority Cybersecurity Professionals (ICMCP).

“As the leader, I set the tone for the meeting,” says Chaney, who previously ran the security operation for Johnson Johnson. “My rules were no interrupting other people or talking over others. As a leader, you want to make sure all voices are heard. You want a complete view.”

In some situations, team members may want to lead the conversation. A leader can step in and interrupt a dominant speaker and say something along the lines of “I understand how you feel, but I want to see what other people think as well,” Chaney advises.

Co-workers can play a role in providing space or an entry point to participate in discussions, says Aubrey Blanche, global head of diversity and inclusion for software company Atlassian, which released a 2017 State of Diversity Report in March. When she was in college and served on a board of directors at a nonprofit, she faced a male-dominated board and was uncomfortable with their communication style. “It was nothing malicious on their part, but I did not feel comfortable,” Blanche recalls.

She approached a fellow board member with whom she had a good working relationship and asked if he could help her participate in meeting discussions. During the meetings, he would turn to Blanche and ask for her thoughts or opinion, she recalls. After being called on several times to solicit her opinions, Blanche says she eventually felt comfortable providing them unprompted in the meeting.

When women and minorities get interrupted while speaking, they should try some basic communications strategies, say inclusion experts. “Interrupters often don’t realize they are interrupting,” Blanche says. “You can say their name to get their attention and then let them know you would like to ‘finish up’ your thought.”

When in a meeting with peers or those in higher roles, Chaney will put her finger up in the air and say, “please let me finish my thought” when interrupted, she says. “I figure they took the same leadership training as I did and should know better, so I will call them on it.”

Quash idea-stealing.

Another common issue women and minorities face in meetings is having their ideas pilfered, say inclusion experts. When women present ideas in a meeting, they are generally more collaborative and humble, speak in general terms and a tentative manner, and phrase their ideas as questions, says Caroline Turner, principal with DifferenceWorks. As a result, the idea tends to lay their quietly until a male colleague picks it up, claims it as their own idea and receives kudos from co-workers, Turner says.  

Men tend to communicate in a “hey, look at this” fashion, which is more apt to gain attention in a meeting, Turner explains.

Turner herself faced this issue when working for a company as a high-level executive. She mentioned this concern to her CEO on a Friday, who dismissed the notion, but the following Monday, he witnessed it firsthand during a meeting. Turner presented an idea and it failed to generate an immediate response. Then, moments later, a co-worker picked up Turner’s idea and presented it as his own, she recalls. Turner shot a knowing look to the CEO, who appeared surprised and said to the co-worker, “I see you agree with Caroline’s idea,” she recalls.

Although the conversation in the meeting continued as though nothing was amiss, Turner says, “I felt empowered. I was validated. I was no longer invisible. The power of that endorsement made me feel on par with everyone in the meeting.”

Women in President Obama’s administration used an “amplification” strategy” in which they would support each other by recognizing and commenting on any great ideas that fellow female co-workers presented in the meetings, Blanche explains.

The amplification comments would go along the lines of “great point and I would like to add on thatm” Blanche says as an example.

Women and minorities should hold open discussions with managers and executives when their ideas are hijacked, Turner says, citing her own former CEO as an example.

“Once I pointed it out to him and he saw it happen, he will never forget it,” Turner says, noting the CEO went on to validate other women’s ideas when similar situations arose.

Inclusion experts also note women and minorities can advocate for themselves in a light-hearted way while in meetings by saying such things as, “I’m glad you liked my idea and wanted to build on it.”

Eradicate dismissive behavior and attitudes.

In Silicon Valley, there is a belief that the best people have a particular style of coding, and some men are dismissive to female colleagues if they don’t employ the same coding style, says Whitney.

And in other cases, companies have fostered a confrontational culture, she says. “Intel used to have a culture of constructive confrontation, with the idea that by taking serious criticism a company could only get better,” Whitney says. “But Intel has since changed this culture to one where it wants it to be collaborative.”

Managers can tackle this head-on. “As a manager, when you see dismissive behavior you can take [the culprit] into a private conversation and tell them the behavior does not contribute to the job being done,” Whitney advises.

She adds that managers can also provide women and minorities who are dismissed by their male counterparts to have an opportunity to demonstrate their work and discuss it when the project they were working on is reviewed.

Seeking allies is one way to fend off a particularly rude co-worker, inclusion experts say. Any co-worker can approach an offending team member and recount the contributions made by a female or minority infosec member, Whitney says.

However, she notes, some co-workers who are insecure about contributions they have made to the team may not be willing to stand up in another co-workers defense.

So women and minorities should seek out allies to fend off obnoxiously rude co-workers, Whitney advises. “One of the most successful strategies in this situation and others is to find allies,” she says. “This is one of the reasons it is so important to have more women in the workforce.”

Related Content:

• How to Build a Path Toward Diversity in Information Security
• How Diversity Can Bridge The Talent Gap
• How You Can Support InfoSec Diversity, Starting With The Colleagues You Already Have
• 6 Steps to Find Your Next Dozen Cloud Security Experts

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/making-infosec-meetings-more-inclusive/d/d-id/1329539?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple