6 Terms You Need to Know To Improve Your Threat Management
by Tori Thurmond / February 13th, 2023
We’ve all seen the jumble of letters that make up the world of cybersecurity. But do you know what they all mean? These technical terms can be overwhelming, so we want to make sure you understand what you need to know about threat management, or how your organization manages and mitigates threats that may negatively affect your security posture.
At the 2022 Information Systems Audit and Control Association (ISACA) conference in Chicago, Anthony Sabaj from Check Point Software Technologies broke down some of the terminology surrounding deep learning, a newer, more advanced version of machine learning that is designed to function more like the human brain than previous technology, and how it can benefit the security of your organization.
Below, we’ve included the terms Sabaj discussed in his talk and their definitions pulled from Gartner.
- MDR (Managed Detection and Response): A service that provides customers with remotely delivered modern security operations center (SOC) capabilities allowing organizations to rapidly detect, analyze, investigate and actively respond through threat mitigation and containment. MDR service providers offer a turnkey experience covering areas such as endpoint, network and cloud services to collect relevant logs, data and contextual information. This process allows for investigation by skilled threat hunters.
- XDR (Extended Detection and Response): A SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system that unifies all licensed component.
- EDR (Endpoint Detection and Response): Solutions that record and store endpoint-system-level behaviors, use various data analytics techniques to detect suspicious system behavior, provide contextual information, block malicious activity, and provide remediation suggestions to restore affected systems.
- SIEM (Security Information and Event Management): Analyze event data in real time for early detection of targeted attacks and data breaches, and to collect, store, investigate and report on log data for incident response, forensics, and regulatory compliance.
- SOAR (Security Orchestration Automation Response): Solutions that combine incident response, orchestration and automation, and threat management capabilities in a single solution. SOAR tools can be used for many security operations tasks, including documenting and implementing processes.
- CIEM (Cloud Infrastructure Entitlement Management): CIEM offerings are specialized identity-centric SaaS solutions focused on managing cloud access risk via administration-time controls for the governance of entitlements in hybrid and multicloud IaaS.
How Does AI and Deep Learning Relate to Security?
It can be overwhelming to try to keep up with the constantly evolving world of cybersecurity. Not only is new technology continuously being rolled out, but new threats are arising just as quickly. All of these changes can be difficult for a security team to keep up with on their own.
Artificial intelligence (AI) is one way to help bear the burden by stopping threats before they can become a problem. The more advanced AI technology becomes, the better it can protect your important data. Although rapidly changing technology, like AI, can be difficult to keep up with, many of these changes can benefit our organizations if we understand how they can help us.
If we look at the latest, cutting-edge AI technology, we’ll see that deep learning processes all file bytes resulting in a 30% better detection rate and 90% less false positives compared to classes machine learning. This technology not only benefits you but your auditors, making the data more accessible and easier to identify and remediate issues before they cause too much damage.
How to Implement These New Programs into Your Organization
In order to implement these new programs into your organization’s cybersecurity initiative, you’ll need:
- Good algorithms
- Relevant data
- Lots of data (and a place to store it)
- To constantly evolve
- People that understand the problem
Deep learning, when used correctly, will help mitigate threats that would compromise your organization’s security posture.
Is This Technology Right for Your Organization?
While automation and AI can certainly make your job easier, they can’t be used exclusively. You need to have processes that ensure the technologies you’ve put in place are working like you intended: efficiently and securely. An audit is the perfect way to get assurance that the technologies you’re relying on are supporting your security and compliance goals.
At KirkpatrickPrice, we are dedicated to helping you achieve your security goals, whether that’s through performing your compliance audits, assessing your organization’s risk, testing your threat management through penetration testing, or simply answering your questions.
If you have questions about new technology or would like your security posture assessed, connect with a KirkpatrickPrice security expert today.
