Cybersecurity Today Heads to the Future

New cyberthreats are introduced every day at an increasingly rapid pace. Fortunately, for every new threat that’s introduced, someone, somewhere, has figured out how to remediate it and blogged about it.

The problem? With over 2.5 quintillion bytes of data being produced around the world daily — and thousands upon thousands of cybersecurity blogs out there — finding the solution to a threat you don’t yet know exists is an impossible human feat. Fortunately, we no longer have to rely solely on human cognizance.

What Does Cybersecurity Today Look Like?

Cognitive computing systems have advanced at a remarkable rate in recent years and are able to contribute tremendously to cybersecurity today. By using tools such as data mining, machine learning, natural language processing and human-computer interaction to mimic the way the human brain works, cognitive systems can help organizations remediate cyberthreats in record time.

Enhancing SOC Analysis

Through the automated ingestion of information — such as research reports and best practices — and the ability to understand both structured and unstructured data, cognitive systems can provide junior analysts with real-time input. This allows them to do the job of a higher-level analyst without the additional years of experience.

Speeding Up Response Time

Remember the impossible-to-find cybersecurity blog holding the answers to today’s latest cyberthreats? By crawling through external intelligence on the Internet, cognitive systems can quickly discover what the next zero-day exploit is — and how to protect against it.

Making the Most of Advanced Analytics

Cognitive security systems may use analysis methods such as machine learning, clustering, graph mining and entity relationship modeling to identify potential threats. This can help speed detection of risky user behavior, data exfiltration and malware before damage occurs.

Strengthening Application Security

By understanding the semantic context of your analytics and data, while simultaneously exploring code and code structures, cognitive systems can take thousands of vulnerability findings, refine results to a small set of actionable items and take you to locations in your code where you can fix them.

Improving Enterprise Risk

In the future, cognitive systems could use natural language processing to find sensitive data in an organization and redact it.

As you can see, artificial intelligence is no longer a dream of the future. Intelligent computers — cognitive computers — exist, and there’s nothing artificial about it. Cybersecurity today can benefit as a result.

Watch the on-demand webinar: Cognition and the Future of Security

Cognitive Security | Cybersecurity

Sandy Bird

IBM Fellow, CTO for IBM Security

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

What Does Cybersecurity Today Look Like?

Enhancing SOC Analysis

Speeding Up Response Time

Making the Most of Advanced Analytics

Strengthening Application Security

Improving Enterprise Risk

More from Threat Intelligence

IBM identifies zero-day vulnerability in Zyxel NAS devices

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

GootBot – Gootloader’s new approach to post-exploitation

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

Topic updates