The Rise of Advanced Analytics and Machine Learning in IT Security

As time goes on, it seems that there’s very little left in the world that is purely analog anymore. The business world is digital nowadays, and there are many benefits attached to that reality. The caveat is that there are inherent risks that come along with the digitization of society, and cybercriminals know it. Now that the IoT has grown and the world is becoming increasingly wireless, we’ve finally reached the point where even small businesses and private citizens are falling victim to data breaches and cyberattacks.

The problem is that as sophisticated as technology and IT security get, malicious actors, are always one step ahead, equally (if not slightly more) sophisticated themselves. Organizations are struggling to keep up and adapt to such a harsh digital landscape, while simultaneously recognizing that there’s no doing business outside of said landscape. This presents a catch-22 that becomes more visible within IT security every day.

Fortunately, advanced analytics and machine learning are presenting new opportunities in security fields. These much-needed innovations are bringing a modicum of certainty back to a nebulous arena and proving to be effective instruments in the face of old, dull tools.

The Issue of Human Error

The way that we currently protect ourselves from cyberattacks generally has to do with prevention planning and keeping people out. It’s the old fortress mode of thinking: build high walls and rest comfortably behind them. That mode, however, is being tested.

There are a couple of big reasons why cybercriminals are having a heyday with security: first, the more complex systems become themselves, the more difficult they will become to operate and maintain. Marc van Zadelhoff, writing for Harvard Business Review, points out that human error, ignorance, and social engineering are major factors in data breaches. Our tendency to see outsiders as the biggest threat blinds us to the fact that they’re enabled by those within our organizations or that they have infiltrated our organizations themselves.

To deal with this reality, we create systems to buck back up against human imperfection. The data experts at Record Nations write:

A large percentage of breaches and stolen information incidents are caused by simple mistakes and human error, but when a document management plan keeps a constant eye on the status of all documents ‘these errors can be caught before they lead to disasters like corporate identity theft and data breaches.

Components of these document management plans include retention and destruction schedules; training employees and keeping up communication on policy; and audits to make sure that these plans hold up. Unfortunately, this still relies quite heavily on human direction and intervention the same elements lining the heart of the issue in the first place.

Malware Proliferates, More Accessible Than Ever

Another reason that cyberattacks seem to be around every corner is the problem of proliferation. The many different types of operating systems and devices within one working environment makes for tough management. Experts point out that telecommuting will approach or even reach 50 percent by 2020, meaning potential vectors are growing big time. University of Alabama’s Collat School of Business points out that even social media usage presents a significant risk to companies as it grows but that’s only one half of the problem. Not only are connections between devices (as well as the software on those devices) proliferating in an exponential way, but so is the malware that infects those devices.

Ralf Benzm”ller, writing for G Data, mentions that in 2016 we counted 6,834,446 new malware specimen. This is an increase of 32.9%. On average this is 780 per hour. And this trend is continued in the first quarter of 2017. The 1,852,945 new malware specimen are 72.6% above the figure a year before. With an average of 858 per hour, this is 10.0% above the average of 2016.

Perhaps the most impressive figure presented in Benzm”ller’s article is that in 2016 every 4.6 seconds a new malware specimen emerged in the first quarter of 2017 this only takes 4.2 seconds.

Worse than many different types of malware that might work is the types of malware that almost always work. Ransomware is one of the most effective types of malware, one strain of which infected around 300,000 computers in 150 countries in 2017.

To top it all off, not only is malware more prevalent than ever, but new reports are showing that malware is cheaper and more accessible than ever as well. Some sources are showing that it costs as little as $10 to acquire personal records or credit card data that were lost in a data breach. Malware/hacking as a service (MaaS/HaaS) is also becoming popular, allowing for people who aren’t necessarily tech-savvy to launch their own career in cybercrime.

The Rise of Advanced Analytics and Machine Learning in IT Security

All of the above equates to a cyber landscape that is complex and hard to secure. Fortunately, advanced analytics now allows professionals to gather, store and analyze data on the functioning of the organization‘s systems. This is different than traditional antivirus, according to Wired, because:

…the algorithms train on vast catalogues of malicious programs to learn what to look for. But the ML approach has the added benefit of flexibility because the scanning tool has learned to look for characteristics of malware rather than specific signatures. Where attackers could stymie traditional AV by making just slight alterations to their malicious tools that would throw off the signature, machine learning-based scanners, offered by pretty much all the big names in security at this point, are more versatile. They still need regular updates with new training data, but their more holistic view makes a hacker’s job harder.

The upside here is that instead of working like traditional antivirus measures, whereby a program is constantly checking systems against a database of known threats, advanced analytics and machine learning check a system against itself. It can see human error as it happens and can defend against the malware that was created 4.2 seconds ago. Of course, these programs aren’t yet perfect, but they definitely point the direction in which the cybersecurity industry is headed.

Organizations need to face the reality that cyberattacks are just beginning to ramp up. The future will continue to be filled with attacks, and not only will they rise in quantity but also in damage wrought. Big data analytics and machine learning offer, perhaps, the only viable defenses. Business professionals that don’t realize this sooner rather than later are more likely to get hit in a way that they’re unable to recover from don’t let that happen to you.