Translated from 日本語 • View original 
In this article, from the perspective of "How will AI change security operations?", we will summarize the challenges faced by traditional security operations, the automation and sophistication that AI can achieve, and the points to pay attention to when introducing them. Please refer to this as a hint for thinking about realistic defense strategies in the AI era.
Background: Limitations of Security Operations and the Inevitability of AI Utilization
Conventional security operations have focused on manual alert confirmation and rule setting. However, with the expansion of cloud usage, the rise of SaaS, and the entrenchment of remote work, the number of things to monitor has exploded. Even with SIEM and EDR in place, a large number of alerts are generated every day, and "alert fatigue" is a serious issue that misses important incidents.
In addition, the speed of the attack is also a problem. In some cases, the time from intrusion to damage occurs can be completed in a few minutes to a few hours, and the damage will expand while people are analyzing and making decisions. Against this background, there are limitations to the operation of "people see everything", and automatic analysis and judgment using AI have become essential.
AI is not just an efficiency tool, but a changemaker in the very assumptions of security operations.
The field of security operations will change with AI
AI is being used in various areas of security.
- Improved anomaly detection
AI can learn normal communication and operation logs and detect "unusual behavior". It does not rely on signatures and makes it easier to respond to unknown attacks. - Alert prioritization
It automatically scores high-risk alerts from a large number of alerts and narrows down the events that need to be addressed. - Automate incident response
When combined with SOAR (Security Orchestration, Automation and Response), initial response such as terminal isolation and account suspension can be automatically executed. - Analysis and survey support
By assisting in log correlation and estimation of attack scenarios, AI can significantly reduce investigation time.
These techniques can be said to create a state where people can concentrate on what they need to make rather than replacing people.
Risks and Challenges: A Perspective That Doesn't Leave AI to
On the other hand, there are some caveats to the use of AI.
AI relies on training data, so it doesn't mean zero false positives and misses. Another issue is the black box nature that makes it difficult to understand "why the decision was made".
It's especially important not to be overconfident in the AI's judgments. If the scope of automatic response is wrong, there is a risk that regular work will be stopped. Therefore, it is realistic to introduce it at the level of "notification and support" at the beginning and gradually expand the scope of automation.
Countermeasures: Multi-layered defense and operational design in the AI era
AI-powered defense strategies are also based on the concept of defense-in-depth.
- Environmental Preparation
Ensuring accurate log capture and data quality is a top priority. AI can't work without data. - Establishment of a monitoring system
Leverage AI-powered EDR and SIEM to automate anomaly detection and correlation analysis. - test operation
Auto-response rules are thoroughly tested in a validation environment to minimize the impact of malfunctions. - production operation
We will conduct hybrid operations that combine human review and AI judgment. - Continuous Improvement
It's important to keep updating your training data and rules to keep up with attack trends.
This mindset is also common to ransomware protection and the use of cyber threat intelligence.
Related articles:
What it should be: Security operations where humans and AI work together
The ideal image is a system in which AI is constantly responsible for monitoring and initial action, and people make decisions and improvements.
AI detects anomalies 24 hours a day, and people focus on the decisions and strategy design that really matter. If this division of labor can be realized, it will be possible to operate a strong security operation even with a small number of people.
And as NIST CSF 2.0 shows, security is not just a technology, it's a continuous maturation process. AI is a powerful tool to accelerate its maturity.
Related articles:
Conclusion
AI is significantly changing security operations from "human-centric" to "automated and sophisticated".
However, AI is not omnipotent and can only be effective with the right design and operation. The important thing is not to introduce AI itself, but to clarify "where to automate and where to be responsible for people."
In an era where attackers use AI, it is important for defenders to have a strategy based on AI, which will be a major differentiator in future security operations.