4 ms·

Note that the systems that they used to measure incidents relied on a centralized point of data acquisition. The reason those incidents aren't found is simple:

Note that the systems that they used to measure incidents relied on a centralized point of data acquisition. The reason those incidents aren't found is simple: too much data and too much alerts to handle, given that CSIRT teams are less than 10 people even for a company the size of Siemens, which manages all kinds of critical infrastructure (including nuclear power plants, which I'd say is far more than critical if anyone of the white house reads this). All those elastic search based dashboards simply don't cut it, and most malware lays low for a while because they assume that nobody has petabytes of storage available due to absurd pricing for those. That's why there's literally a timeout for a couple days until the persistence and lateral movement step is done, and signs of breaches are gone because the database has to be wiped. Also, this is the reason why bigger threat actors like APT28 and APT29 make use of social shitstorms (/pol/, kiwifarms, 4chan, anonymous groups on telegram etc) to hide their tracks. They simply flood the logs of the target's system until there's no storage capacity left to hide the actual breach of the actually targeted system. That's why I started to push EDR into the decentralization age of networking, signing, isolation and proactive communication between peers with my startup. That's the only way to scale those kind of incident logs effectively and the only way to effectively deal with assumptions of compromise to find out which accounts have what kind of access across the network.

Root_Denied 3y ago
>The reason those incidents aren't found is simple: too much data and too much alerts to handle, given that CSIRT teams are less than 10 people even for a company the size of Siemens Hey, wanna guess where they're trying to push AI driven "insights" right now? That's right, all of cybersecurity roles. Rather than add headcount to teams, or spin up new teams to section off pieces of a business that might need more customized attention, AI is now being shoved down the throat of security engineers and SIRT teams to handle the massive amount of data involved and to present a human with some little nugget of information to act on, all the while sweeping away the rest as irrelevant. Useful as a tool? Sure. Able to reduce workload on existing teams? Absolutely. Able to replace the need for more human eyes looking at the problem space and figuring out ways to filter the data for meaningful events? Eh, maybe but I'm not going to hold my breath on it either. It's the same story with AI across every industry right now.
- cookiengineer 3y ago
  Most people in charge don't have a technological background, so all the AI intelligent whatever-BS systems will fail eventually due to lack of meaningfully labelled data or lack of supervision. As long as deep learning concepts are used across the board which lose symbolic inference, this approach won't work. But who am I to tell them, we're still using AlphaGo agents in an ES/HyperNEAT simulation for pentesting and nobody believes us when we tell people this is the only way to make this work in that problem space. We are just too uncool for the LLM hypetrain, I guess.

Root_Denied 3y ago

>The reason those incidents aren't found is simple: too much data and too much alerts to handle, given that CSIRT teams are less than 10 people even for a company the size of Siemens Hey, wanna guess where they're trying to push AI driven "insights" right now? That's right, all of cybersecurity roles. Rather than add headcount to teams, or spin up new teams to section off pieces of a business that might need more customized attention, AI is now being shoved down the throat of security engineers and SIRT teams to handle the massive amount of data involved and to present a human with some little nugget of information to act on, all the while sweeping away the rest as irrelevant. Useful as a tool? Sure. Able to reduce workload on existing teams? Absolutely. Able to replace the need for more human eyes looking at the problem space and figuring out ways to filter the data for meaningful events? Eh, maybe but I'm not going to hold my breath on it either. It's the same story with AI across every industry right now.

cookiengineer 3y ago
Most people in charge don't have a technological background, so all the AI intelligent whatever-BS systems will fail eventually due to lack of meaningfully labelled data or lack of supervision. As long as deep learning concepts are used across the board which lose symbolic inference, this approach won't work. But who am I to tell them, we're still using AlphaGo agents in an ES/HyperNEAT simulation for pentesting and nobody believes us when we tell people this is the only way to make this work in that problem space. We are just too uncool for the LLM hypetrain, I guess.