Rules vs. Reasoning: Applying probability to transform security operations

No ratings

Presented at FutureConAtlanta 2019 by

Mr. Triolo

You may have heard this before: "What got you here, won't get you there." This is exactly the problem we're facing today in the modern security operations center: due to the exponential increase in security alerts and complexity of cyber attacks, we've grown past the point where correlation rules can effectively help us find malicious and actionable security incidents. Correlation rules are too simplistic to reduce security alert volume to a manageable level or to avoid false positives. In this talk, we'll discuss the future of security operations: machines that can reason like humans to perform initial alert monitoring and triage. And how human-to-machine automation is about to disrupt a whole industry.