The Evolving Landscape of Security Awareness: Beyond the Surface
In an ever-evolving cybersecurity landscape, security awareness training has historically placed significant emphasis on equipping individuals to recognize unmistakable warning signs. Steve Povolny, the Vice President of AI Strategy and Security Research at Exabeam, sheds light on an unsettling trend where cyber adversaries have not only adopted these recognizable patterns but have also refined their tactics accordingly. Povolny articulates that the security industry has for years been instructing employees on how to identify suspicious activity, such as grammatical errors in communications, unusual hyperlinks, or login attempts from geographically improbable locations. However, attackers have been keenly observing these lessons and adapting their strategies to camouflage their actions more effectively.
This adaptation has led to an alarming emergence of intrusions that appear entirely legitimate upon initial examination. Povolny points out that a stolen session token can seamlessly authenticate a user in a system, while a compromised employee could mislead security measures by utilizing applications that are completely authorized. He provides examples that underscore this shift, such as a hypothetical North Korean IT worker who gains access through the regular hiring process rather than through traditional exploit methods. Additionally, AI-driven agents can execute authorized actions that yield outcomes that are not inherently harmful but still undesired. This complex interplay between legitimacy and malicious intent raises critical questions about the current approach to cybersecurity.
Simultaneously, the information overload within modern security operations centers (SOCs) exacerbates the challenge. Nick Tausek, Lead Security Automation Architect at Swimlane, emphasizes that the dilemma facing SOCs is not a lack of data but rather a decision-making quandary. Security analysts are inundated with alerts, threat intelligence, identity validation data, and endpoint telemetry. The bottleneck occurs when analysts seek to discern which signals merit immediate attention, what contextual information may be lacking, and what appropriate actions should follow.
In this context, Povolny advocates for a paradigm shift in detection methodologies, urging organizations to move away from evaluating isolated incidents toward discerning patterns of behavior over time. He argues that individual events have become increasingly irrelevant when assessed in isolation. “Modern detection has to understand behavior over time,” he explains. Key questions arise: What resources does this identity typically access? Which systems and applications are engaged? How does today’s activity sequence compare with historical behavior? The answers to these questions can shed light on whether an action is indeed legitimate or could signify a malicious endeavor.
This evolving perspective necessitates a recalibration of expectations surrounding employee awareness. Povolny cautions that abnormal signals may not always manifest as singularly dramatic actions; rather, they may emerge as seemingly innocent series of legitimate activities that have previously never coalesced. While employees ought to be aware enough to report suspicious requests or interactions, it is unreasonable to expect them to recognize benign logins, approved tools, or a sequence of common actions that only becomes alarming in specific contexts.
Piyush Sharma, co-founder and CEO of Tuskira, identifies similar issues in vulnerability management and presents a thought-provoking scenario. He poses a question: if two vulnerabilities exist—one with a critical severity score on a well-protected, isolated system and another deemed less severe that connects an exposed application to a privileged identity leading into production—which vulnerability would get prioritized for remediation? Historically, severity has driven vulnerability management decisions, but as Sharma points out, attackers do not sort vulnerabilities according to standardized metrics; they exploit combinations of weaknesses to gain access to valuable systems.
To navigate this landscape effectively, Sharma believes that AI can empower defenders to perceive their environments through the lens of potential attackers. Employing AI-assisted attack-path analysis can illuminate the connections between identities, cloud infrastructure, networks, and applications, allowing organizations to recognize which vulnerabilities are genuinely exploitable. Such tools can also reveal whether existing security controls effectively mitigate risks before reaching critical assets.
However, utilizing AI effectively in SOCs requires careful consideration. Tausek highlights that AI must justify its role, asserting that not every scenario demands the same depth of analytical treatment. Routine incidents may be resolved through deterministic automation, while more ambiguous activities could benefit from AI-supported investigations. Complex threats may warrant full agentic analysis, preserving human judgment for decisions where experience is paramount.
Both Tausek and Sharma share a common perspective: organizations need clarity over sheer numbers. Many already grapple with uncomfortable vulnerability totals and require a nuanced understanding of which vulnerabilities might lead to actual breaches. The relentless pursuit of speed in threat detection is insufficient; organizations must develop frameworks that transform knowledge into actionable insights without compelling analysts to reconstruct contextual understanding each time an incident arises.
Ultimately, for Povolny, the overarching lesson for security campaigns going forward centers on embracing the ambiguity present in various scenarios. The essence of security programs and detection mechanisms should factor in the subtleties of behavior. Credentials may be valid, tools may be pre-approved, and actions might frequently appear normal. However, it is the behavioral context that offers security teams the necessary insights to discern when these ostensibly innocuous elements no longer coalesce harmoniously.
In the landscape of contemporary cybersecurity, the battle between legitimate appearances and malicious intentions becomes increasingly complex. As organizations strive to navigate this terrain, the importance of contextual understanding becomes increasingly paramount, marking a significant shift in the approach to security operations.