IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

The tech industry must embrace automation if it wants better security analysts

There’s no reason why we shouldn’t be automating menial security processes in 2019, according to McAfee

Cyber security automation mockup

Automating necessary, but menial and time-consuming functions in a business could be the key to unlocking the next wave of advanced analysts and threat hunters.

'There really isn't any reason to avoid automation,' according to Michael Leland, chief technology strategist at McAfee, adding that only through embracing the automation of tasks, specifically in a company's security operations centre (SOC), can they hope to free up valuable human brainpower for other things.

Speaking at (ISC)2 Security Congress, Leland said every tier 1 analyst wants to move up to tier 2, but are stymied by the relentless and menial work they have to do.

"A tier one analyst whose job is to pick through the events at a very low level I hate to call them it trained monkey work but at the end of the day, a lot of the work they're doing is mindless." he said.

"But I can tell them that I'm reducing the workload by 80% by allowing a bunch of the automation to do his job. That time restriction now is removed and he can start performing more advanced techniques that you might want to learn."

These monotonous duties preventing tier 1 analysts progressing to tier 2 and beyond include triaging all the events that pop up in the SOC and evaluating whether they need remediation.

The time it takes a human to triage an event and perform remediation takes around 75 minutes, what's known as dwell time. An automated process could do it in just two, according to Leland  and the efficacy of a SOC is measured, in part, on the dwell time it takes to remediate issues.

"The only way to achieve this kind of efficiency is to automate as many of these tasks as possible, whether that's an AI engine, whether it's machine learning or simply mining data," he said.

The value of a unified and automated architecture is huge. Automating processes in a SOC can lead to a 1,000% or more increase in event handling capacity, a 65% quicker triage rate and this is all done with a much greater degree of accuracy compared to what a human can produce.

This is due to a few things, the first being a human's inability to multi-task. Leland referenced an experiment McAfee did with people who were originally told to enter a room, scan it and then recall all the items they saw in that room after.

People were able to score a 98% recall rate in the first test condition, but when the researchers made them unlock a door before entering the room an added task the recall rate tumbled to 67%.

Related Resource

How AI and automation are changing the way work gets done

Intelligent automation will be a defining factor for the future workforce

Download now

"We think that the combination of humans and machines, the concept of human-machine teaming is probably the only way that we are going to achieve better accuracies, reduced timeframes for meantime detection, reduced meantime for remediation and reducing alert fatigue," said Leland.

Another factor affecting the effectiveness of a SOC program is the constraints on resources that businesses face. By freeing up tier 1 analysts, organisations can use their analyst's free time to explore opportunities to improve what those analysts are already doing, or do new things to benefit the business while the automated SOC works in the background.

The need for automation has never been greater for businesses and that's evidenced by the sheer number of events that trigger alerts in a SOC environment.

Leland said, on average, an enterprise of a significant size will be alerted to 3.2 billion events a month. 3,000 of these will require investigation and only 13 will be critically dangerous.

"How else would you find those 13 in 3.2 billion if you have a human bottleneck? Automation is the only way to achieve that."

Automation may be one of the industry's most feared buzzwords it threatens the jobs of many real people working in the industry but a rise in automation should instil fear in no-one, Leland claims.

"The idea behind robots replacing humans is probably something that we're not going to see in our lifetime," he said. "But what is more realistic is that we're going to build environments where humans and AI or computers work better together to create greater value."

Featured Resources

IT best practices for accelerating the journey to carbon neutrality

Considerations and pragmatic solutions for IT executives driving sustainable IT

Free Download

The Total Economic Impact™ of IBM Spectrum Virtualize

Cost savings and business benefits enabled by storage built with IBMSpectrum Virtualize

Free download

Using application migration and modernisation to supercharge business agility and resiliency

Modernisation can propel your digital transformation to the next generation

Free Download

The strategic CFO

Why finance transformation propels business value

Free Download

Most Popular

The big PSTN switch off: What’s happening between now and 2025?

The big PSTN switch off: What’s happening between now and 2025?

13 Mar 2023
Why Amazon is cutting staff from AWS

Why Amazon is cutting staff from AWS

21 Mar 2023
Why – and how – IP can be the hero in your digital transformation success story

Why – and how – IP can be the hero in your digital transformation success story

6 Mar 2023