Why Machine Learning Will Help Improve Government Cybersecurity in 2017

Haiyan Song is senior vice president of security markets at Splunk.

Email security, ransomware, insider threats and state-sponsored attacks have been headline news for the past year. Cybersecurity, which is generally viewed as bipartisan issue, has officially made it into the mainstream consciousness as a result.

And while it’s certainly never good to see news that another breach occurred, one positive outcome has been increasing conversations about the cyber-oriented world in which we all live and work, and the serious security challenges private-sector and government organizations face going forward.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

These discussions are happening now and part of the focus needs to be on the future of cybersecurity, and identifying what’s on the horizon so organizations from every business sector can prepare. Below are some security predictions for 2017 that will undoubtedly affect both industry and government operations moving forward.

The internet is a critical infrastructure: Distributed denial-of-service attacks—like the Mirai botnet powered—on Dyn have shown us the foundation of our connected world, the internet, is tremendously vulnerable. As such, the internet must be treated as a critical infrastructure.

What does this mean?

The internet must be continually monitored and well-protected from debilitating attacks. The internet needs to be more resilient. As a society, we’re as dependent on internet as electricity. This issue carries even more importance in industries like health care and the government, for which downtime could mean life or death and national security.

To ensure systems stay online at all times, we’ll see more companies start to talk about and place emphasis on understanding what they need to detect—not just preventing attacks. This shift in mentality in which detection is valued over prevention has been in the works for years, but 2017 is the year the industry finally starts to turn over a new leaf. Attacks are unavoidable, but protecting critical assets and infrastructure (like the internet) through detection-centric technology will be the pursuit of cyber security professionals.

Machine learning, behavioral analytics and adaptive response come front and center: It’s clear hackers have refined their art and are outpacing enterprise security defenses. More organizations are adopting an analytics-driven approach to security, leveraging machine learning and enabling adaptive response, which encourages automating retrieval, sharing and response in multivendor environments. In 2017, adoption of machine learning and adaptive response will increase to make further inroads against the bad guys.

Machine-learning based solutions and Runbook automation will become more mainstream in 2017 as companies seek to become smarter and faster to identify and respond to threats. An example of this is behavioral analytics, which will allow companies to apply more data and automation techniques to monitor and verify identities, API requests, machine-to-machine interactions, and signal anomalies that could be a security threat.

Machine learning built into core platforms (like SIEM) is the next evolution, allowing greater flexibility and better efficiency in threat investigations, risk management and incident response. Many government agencies are also exploring the use of machine learning, with the Defense Department leading feds in embracing this technology.

A ransomware marketplace is emerging: In 2017, we’ll see ransomware being commoditized and democratized in dark web marketplaces. This is a real threat because it shows nefarious entities and cybercrime syndicates around the world work together to establish structure and a value chain for ransomware tools, which will generate greater profits.

In effect, this marks a fast-growing underground industry on the dark web in which the makings of cyberattacks can be bought and sold, and profit reinvested to better the tools to generate even bigger returns.

To combat this, enterprises and government agencies are seeking dynamic resources for real-time intelligence that help detect ransomware threats in real-time within their security nerve center. In the meantime, companies need to identify their risk tolerance to place the highest security around their most valuable assets and enterprises needs to revisit their business continuity plans to ensure critical IT infrastructure and mission-critical data are protected from taken hostage. This approach will increasingly help stop the propagation of ransomware and enable companies to put “bodyguards” around the assets that matter most.

Internet of things will be the new favored vector of cyberattacks: Backdoors in IoT infrastructures may provide hackers a gift—millions of unprotected gateways into IT or operation technology systems. Many reports will tell you large enterprises are already facing hundreds of millions of automated attacks per day, and IoT growth is likely to increase this figure exponentially. With the attack surface both widening and deepening, OT will become a popular and well-known acronym just like IT.

The proliferation of IoT devices and its lack of maturity in security design will demand better strategy in enterprise topology, network zoning and operational intelligence to protect the enterprise. As data collection within IoT poses news challenges, we’ll see instrumentation, automation and real-time monitoring and response get a lot of attention as well.

The weaponization of information: Information on your personal desktop enables you to work—but what happens when that information is stolen?

Historically, hackers have stolen data and extorted valuable IP or personal information for one reason: monetary gain. But over the past two years, that has changed. Whether it be the Democratic National Committee hack, the Sony breach, or the more recent hack of AdultFriendFinder, hackers are weaponizing information to damage reputations and brands.

Many tools will be needed to combat rogue stealing of secrets for purely malicious reasons, with user behavior analytics technologies being a key component of the solution. Expect to see further adoption of UBA in 2017 as organizations leverage the real-time insights these technologies provide to learn who has access to their most sensitive information