Tracking Anomalous Behaviors of Legitimate Identities
Feb 15, 2024
auto_awesome
Adam Koblentz, field CTO at Reveal Security, discusses monitoring anomalous behavior of users, understanding threat actors in networks, and the role of AI-based tools. They highlight the importance of context in anomaly detection, tracking past activities, and strong multifactor authentication. The chapter emphasizes the significance of anomaly detection and user profiling, with a mention of sponsor Reveal Security as a helpful resource.
The industry is still in its early stages when it comes to using AI to find anomalous identities and threat actors are leveraging AI better than defenders.
Context plays a crucial role in anomaly detection, and understanding and leveraging different levels and aspects of context effectively is a challenge.
Deep dives
Tracking anomalous behavior and the rise of AI
Tracking anomalous behavior is essential to detect and prevent breaches involving legitimate credentials. The industry is still in its early stages when it comes to using AI to find anomalous identities. Threat actors are leveraging AI better than defenders, and the state of the industry is still nascent. However, there is hope that the jump in AI technology will lead to significant improvements in tracking anomalous behavior.
Context is key in anomaly detection
Context plays a crucial role in anomaly detection. Anomalies can be benign or malicious, depending on the context. To unlock successful anomaly detection, it is important to automate the process of gaining context. Understanding the breadth of context is crucial, considering factors beyond authentication to include authorization and comprehensive understanding of identity behavior. The challenge lies in understanding and leveraging different levels and aspects of context effectively.
Leveraging AI and context for effective anomaly detection
Leveraging AI and machine learning algorithms to understand and analyze user behavior is crucial for effective anomaly detection. By comparing user journeys, identifying normal behaviors, and correlating business processes, anomalies can be accurately detected. Incremental friction, such as de-privileging accounts temporarily, can be used as a measure to mitigate risks. The challenge lies in applying these detection solutions to business applications and cloud environments, where obfuscation and lack of comprehensive visibility hinder progress.
All links and images for this episode can be found on CISO Series.
The Verizon DBIR found that about half of all breaches involved legitimate credentials. It’s a huge attack surface that we’re only starting to get a handle of.
Where are we in terms of monitoring anomalous behavior of our users?
Why are we still struggling to understand what happens after threat actors are in our networks?
How are new AI-based tools helping us to scale efforts?
What's working and where do we need to improve?
Thanks to our podcast sponsor, Reveal Security
Reveal Security ITDR detects identity threats - post authentication - in and across SaaS applications and cloud services. Powered by unsupervised machine learning, it continuously monitors and validates the behavior of trusted human users, APIs and other entities, accurately detecting anomalies that signal an in-progress identity threat. Visit reveal.security
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode