Malware sophistication is increasing as adversaries begin to weaponize cloud services and evade detection through encryption, used as a tool to conceal command-and-control activity. To reduce adversaries’ time to operate, security professionals said they will increasingly leverage and spend more on tools that use AI and machine learning, reported in the 11th Cisco 2018 Annual Cybersecurity Report (ACR).
While encryption is meant to enhance security, the expanded volume of encrypted web traffic— both legitimate and malicious — has created more challenges for defenders trying to identify and monitor potential threats. Cisco threat researchers observed more than a threefold increase in encrypted network communication used by inspected malware samples over a 12-month period.
Applying machine learning can help enhance network security defenses and, over time, “learn” how to automatically detect unusual patterns in encrypted web traffic, cloud, and IoT environments. Some of the 3,600 chief information security officers (CISOs) interviewed for the Cisco 2018 Security Capabilities Benchmark Study report, stated they were reliant and eager to add tools like machine learning and AI, but were frustrated by the number of false positives such systems generate. While still in its infancy, machine learning and AI technologies over time will mature and learn what is “normal” activity in the network environments they are monitoring.
“Last year’s evolution of malware demonstrates that our adversaries continue to learn,” said Scott Manson, Cybersecurity Lead – Middle East and Africa, Cisco. “We have to raise the bar now – top down leadership, business led, technology investments, and practice effective security – there is too much risk, and it is up to us to reduce it.”
Cisco 2018 Annual Cybersecurity Report Additional Highlights – The financial cost of attacks is no longer a hypothetical number; Supply chain attacks are increasing in velocity, complexity; getting more complex, scope of breaches is expanding; Security professionals see value in behavioral analytics tools in locating malicious actors in networks; Use of cloud is growing; attackers taking advantage of the lack of advanced security; Trends in malware volume have an impact on defenders’ time to detection (TTD)
