4 keys to successful cyber defense automation

Government IT administrators are responsible for putting out security fires, but that can be tough to do when they’re constantly drinking from the firehose. Agencies operate under tight budgets and low resources, and IT teams are often forced to prioritize that day’s squeaky wheels (an application failure here, a network bottleneck there) ahead of proactively developing new ways to defend against cyber threats.

But results from a recent SolarWinds federal cybersecurity survey suggest there’s never been a more important time to tackle evolving threat vectors. A majority of government IT professionals feel that threats by careless or malicious insiders and foreign governments are at an all-time high. Attackers are becoming more sophisticated and adept at targeting government networks and are using employees to gain access to sensitive data.

IT professionals are therefore faced with a dilemma. They understand that the best defense against cyberattacks is a good offense. But how do they initiate that offense when they’re strapped for funds, resources and time?

Automation can reduce the need to perform mundane tasks, improve efficiency and create a more agile response to threats. For example, administrators can use artificial intelligence and machine learning to ascertain the severity of potential threats and remediate them through the appropriate automated responses. They can also automate scripts so that they do not have to repeat the same configuration process every time a new device is added to their networks.

But while automation can save enormous amounts of time, increase productivity and bolster security, it’s not necessarily appropriate for every task, nor is it something that can simply operate unchecked. Here are four strategies for effectively automating network security within government agencies.

1. Earmark what should -- and should not -- be automated. While it’s tempting to adopt a “set it and forget it” mentality and automate everything, that’s not necessarily the best approach. Since setting up automation can take time, it may not be worth the effort to automate smaller jobs that only require a handful of resources or a small amount of time to manage. IT staff should also conduct application testing themselves and must always have the final say on security policies.

Security itself, however, is ripe for automation. With the number of global cyberattacks rising, the challenge has become too vast and complex for manual threat management. Administrators need systems that can continually police their networks, automatically updating threat intelligence and monitoring and responding to potential threats.

2. Identify the right tools. Once the strategy is in place, it’s time to consider which tools to deploy. There are a number of security automation tools available, and they all have different feature sets. Choosing the most appropriate solution can be a daunting task. Begin by researching vendors that have a track record of government certifications, such as Common Criteria, or are compliant with the Defense Information Systems Agency requirements.

Then, look for features that should be considered table stakes. For example, continuous network monitoring for potential intrusions and suspicious activity is a basic necessity. Being able to automatically monitor log files and analyze them against multiple sources of threat intelligence is critical to being able to discover and, if necessary, deny access to questionable network traffic. The system should also be able to automatically implement predetermined security policies and remediate threats.

3. Augment security intelligence. Artificial intelligence and machine learning should also be considered indispensable, especially as IT managers struggle to keep up with the ever-changing threat landscape. Through machine learning, security systems can absorb and analyze data retrieved from past intrusions to automatically and dynamically implement appropriate responses to the latest threats, helping keep administrators one step ahead of hackers.

Other useful features are those that allow administrators to get smarter about the overall security landscape, such as updated cyber threat intelligence reports from sources like IP and domain reputation databases, compliance reporting capabilities and more.

4. Remember that automation is not automatic. The old saying “trust but verify” applies to computers just as much as people. Despite the move toward automation, people are and will always be an important part of the process.

Network administrators must conduct the appropriate due diligence and continually audit, monitor and maintain their automated tasks to ensure that they are performing as expected. Updates and patches should be applied as they become available, for example.

Administrators should also take heart in knowing that, as smart as machines have become, there will always be a place for people in the security process. Software can make split-second decisions and detect issues that humans cannot, but IT professionals are still the final checkpoint when it comes to analyzing security data and determining how to use that knowledge to develop effective security policies.

Automating an agency’s security measures can be a truly freeing experience for time- and resource-challenged IT managers. They will no longer have to spend time tracking down false red flags, rewriting scripts or manually attempting to remediate every potential threat. Meanwhile, they’ll be able to rest easy knowing that the automated system has their backs and that their agencies’ security postures have been improved.