The critical need for automation in agency cyber defense

The rise of cyber attacks targeting the data and critical infrastructure of nation-states is undeniable, with no sign of slowing down. From state-sponsored hackers to hacktivists to criminal enterprises, groups are leveraging the power of automation to deploy malware with speed and scale, with federal agency data and critical infrastructure in the crosshairs.

Given the automated nature of many of these attacks, traditional manual approaches to defense are clearly no longer enough. However, there are ways federal agencies can protect critical information and infrastructure from compromise.

The automated threat landscape

Last year’s Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure emphasized agencies' migration to the cloud  as a key part of the strategy. Cloud adoption, however, is proving to be both a blessing and a curse. While the cloud introduces scalability and flexibility that traditional networks struggle to provide, it also expands the attack surface with out-of-band threat vectors like shadow IT and personal cloud services. In addition, an increasing reliance on connected devices to automate and perform everyday tasks reduces the security profile of agencies and invites unwanted visitors.

Even encryption, meant to foster security, also has a dark side. While helpful for maintaining privacy, it presents challenges to threat monitoring and detection. Organizations -- especially those with higher HTTPS ratios -- cannot afford to turn a blind eye toward threats that might be lurking within encrypted communications.

Cloud and encryption allow today’s malicious actors to deliver attacks faster, farther and more cheaply. Even more troubling, a huge proportion of exploit activity today is fully automated using tools that methodically scan wide swaths of the internet, probing for opportunistic vulnerabilities. These modern tools, combined with the growing “crime-as-a-service” infrastructure, enable attackers to operate on a global scale at digital speeds.

The significant threat posed by automated attacks

Federal IT security teams are facing an avalanche of security alerts, and many simply don’t have the resources or even the expertise to respond to them. Additionally,  modern attacks, especially automated ones, have a short half-life; the indicators of compromise linked to these attacks fade quickly, which means teams must be able to respond when an attack is visible, not after the attack has occurred.

This is a complex and difficult task in agencies with deployed network point solutions that rely primarily on humans for the necessary integration. In such environments, responding to automated attacks using defensive automation -- the orchestration of alerts through devices like security information and event management products, sandboxes and similar solutions -- is incredibly important.

That’s at the agency level. There is also a trend towards increasingly malicious cyber activity targeted at the nation’s critical infrastructure -- including water systems, transportation, energy, finance and emergency services --  that is particularly worrisome because the interruption of those services can have devastating effects on the economy, impact citizens' well-being and even cause the loss of life.

In its report last year on securing critical infrastructure, the National Infrastructure Advisory Council raised concerns that the public and private sectors remain unable to move actionable information to the right people at the speed required to address cyber threats. This is primarily because many of the security systems in place require a significant level of human intervention to detect and respond to threats, and real-time threat intelligence between organizations is either limited or nonexistent.

Best practices for defeating automated attacks

As various security components begin to work together as an integrated system, through direct communication and coordination, agencies can begin to let the technology start to make some automated decisions. While automatically removing the actual threat may still be a distance away, once a threat is detected, automated systems can help immediately contain or isolate a breach. This gives incident response teams more time to fight the attack.

To realize the potential advantages of a coordinated and automated security strategy, agencies can adopt and integrate five strategies that unify control across all attack vectors to stop automated attacks:

1. Zero in on visibility. Use threat intelligence solutions to deepen understanding of attackers' identity, tactics and procedures, and then start intelligently defending according to that information. Know where critical assets are located, and prioritize security efforts there.

2. Patch management is non-negotiable. Mirai, Hajime and newer threats such as AutoSploit are stealthier and more advanced generations of self-propagating malware that exemplify the kind of damage that can be done when IT teams fail to patch known vulnerabilities.

3. An intrusion prevention system is the first line of automated defense. Because manufacturers still aren’t accountable for securing internet-of-things devices, there are billions of connected devices that are vulnerable to attack, with no patches in sight. IPS provides “virtual patching” by blocking hacks and attacks targeted at vulnerable IoT devices.

4. Redundancy and segmentation is a must. Some ransomware can not only infect data but also seek out and infect data backups, which can be disastrous. IT managers must make sure that data backups are not only occurring but that they’re segmented and stored off-network.

5. Improve response time. Once the above measures are in place, resources should be focused on tightening up the time to respond. Agencies must leverage proactive solutions and look at ways to create interoperability between different security systems so that information on an event identified on one device is automatically shared across the entire distributed security architecture. The challenge is that most organizations have deployed many different solutions from different providers that do not natively communicate, share threat information or even digest threat intelligence and convert it into actionable protections. Agencies should strive to reduce that complexity by further integrating solutions, focusing on interoperability as devices are purchased or replaced and consolidating existing security devices so that they can leverage a common operating system or management interface.

Unite and conquer

However strong a federal IT security team may be, it cannot keep up with automated attacks unaided. New generations of network incursions must be detected and dealt with quickly, before they can do damage and before their trail fades away. A system of integrated, orchestrated security solutions enables organizations to fight automation with automation, using cybercriminals’ own tactics to turn the tables on them and shorten the time to detection so that forensic analysis can begin immediately and the security lifecycle can be strengthened.

This can’t be done in isolation. The public and private sectors must come together to find ways to automate the protection of the nation's critical infrastructure. The government can’t solve the problem alone. Critical infrastructures are primarily owned and operated by the private sector, and commercial firms can’t be expected to take on other nations’ cyber militaries. By working together in small ways, beginning with broadening security expertise and conducting joint cyber projects, industry and government can combine their strengths to defeat bad actors.