Advanced ThreatsAIAnomaly ReportingCyber SecurityData SecurityNetworkThreat Detection

Threat Detection and Response – How to Stay Ahead of Advanced Threats

Threat Detection and Response – How to Stay Ahead of Advanced Threats

Threat Detection and Response - How to Stay Ahead of Advanced Threats

Cyber Attack methods are continuously evolving, and there is an ongoing 'arms-race' between cybercriminals and those tasked with cyber-defence. Attacks often have multiple components at the same time designed to probe for weaknesses in defence across various parts of the IT infrastructure landscape. The human element is also tested via Phishing attempts and other social engineering attack methods.

It's an ongoing and challenging task for organisations to stay ahead of the curve when dealing with ever-evolving threats. The threat surface that needs to be monitored and protected has grown massively over the last few years with the addition of mobile devices and IoT solutions as part of Industry 4.0. With the accelerating adoption of 5G, this trend will only increase throughout 2020 and beyond.

Machine learning (ML) based systems are ideal for assisting organisations with the defence of their IT infrastructure. ML-based algorithms can monitor the activity on networks over time and learn the normal traffic patterns. This can take into account periodic fluctuations such as any end of month processing spikes or other regular increases in network use. If there is unusual activity detected that is not normal, the ML system can immediately take action to prevent data loss or a system breach, as well as alert the IT staff responsible for the network.

This is what the CyGlass Network Defence as a Service (NDaaS) solution does. It is a Cloud-based solution for network defence that does not require any additional hardware, software, or staff resources to deploy. When enabled in the Cloud and linked to a network, CyGlass uses powerful ML-based algorithms to learn the layout of the network and the typical traffic patterns over time. In other words, it determines what is normal for each particular network. It should be noted that this occurs without any personally identifiable information being sent to the Cloud. So there is no information leakage that could be a problem under GDPR or other privacy legislation. As of February 2020, CyGlass is now a Nominet company. Nominet is a UK based DNS security and domain name registrar.

See www.cyglass.com for details of the NDaaS solution, and contact Renaissance to discuss how we can help you deploy it. Read on for an overview of what CyGlass delivers.

How CyGlass is Different

CyGlass is not designed to replace existing Security Information and Event Management (SIEM) systems but rather augments them with powerful ML-based threat detection. Organisations will still need their existing anti-virus, anti-malware, and other endpoint security tools in place.

CyGlass focuses on detecting anomalous behaviour on the network after it has learned the typical usage patterns, and to quickly stop emerging threats before they can do damage. The ML algorithms have been honed and tested for many years in critical cyber defence and military deployments. In addition to detecting unknown and emerging threats, the algorithms are updated with newly identified threat methods as they emerge. So the full global deployment of CyGlass feeds into better defence for everyone. CyGlass is always learning and improving. Built on AWS CyGlass handles petabytes of network data across millions of nodes. If required CyGlass is also available for private deployment on-premise or in a private cloud.

CyGlass learns about each new network it is set to protect. But each organisation will have digital assets that are of different value. CyGlass allows the most critical assets to be identified by organisations based on the interactions. Often the learning process highlights systems that were previously unknown, or not deemed significant.

The ML-based approach that CyGlass uses is not based on a single algorithm but instead on an ensemble of ML and cognitive algorithms that provide broad protection. Similarly, the data collected to monitor and protect the network is taken across a wide range of sources including from network traffic analysis, log files, Active Directory, and from digital asset metadata.

Use Cases

With its continuously learning via a global distribution and ML-based algorithms, CyGlass can enhance the security of any organisation. Here is a sample of some of the ways it can help deliver better cyber protection:

  • Minimise false alerts - the ML-based algorithms in CyGlass can put context around any detected threats and reduce the false alerts that less smart systems generate.
  • Free up security professionals - experienced and knowledgeable IT security professionals will spend less time dealing with threats and anomalies. This frees them up to spend more time on projects that drive the business forward.
  • Detect insider threats - abnormal data behaviour from users within the network are quickly detected. This can help prevent accidental or malicious data loss.
  • Critical asset protection - CyGlass knows which digital assets are the most important and can enhance security for them.
  • Detect rogue network devices - With the proliferation of personal mobile devices and sensor-based IoT devices, they can be introduced into corporate networks without consent of IT. CyGlass learns about the network continuously and so will detect and highlight any new additions.
  • Demonstrate compliance for auditors - Demonstrating IT security provision is essential for the auditing process within a business. CyGlass's continuous monitoring and detection, coupled with its comprehensive reporting engine, makes this process much more manageable.

Conclusion

CyGlass can provide an excellent ML-based additional layer of cybersecurity to any network. As IoT, industry 4.0, and 5G become more prevalent, then automated monitoring and security will become essential. CyGlass delivers this today with its ever-improving ML-based solution. Contact Renaissance today to find out more.