October 17, 2016 By Mike Spradbery 3 min read

Earlier this month, more than 80 security leaders entered the next-generation security operations center (SOC) experience at IBM Business Connect in London to see the difference that Watson and Resilient could make to incident investigation and response. The audience sat in a darkened room facing five large screens and took advantage of the opportunity to watch a mock SOC — complete with IBM analysts — conduct typical security business.

Following a brief introduction of what was showing on the various screens — which included a quick look at IBM X-Force Exchange, IBM’s threat sharing platform — the audience watched as a Tier 1 SOC analyst began his shift at a fictitious professional services company. Before he even had time to get his morning coffee, the fictional analyst found that something was wrong.

Using IBM QRadar as the security intelligence platform, the analyst was alerted to some potentially suspicious behavior involving a known bad IP address. Based on the suspicious activity, an Incident was automatically created in the IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform to ensure that the SOC analysts were able to follow a well-defined process to investigate and respond to the threat. Having completed some basic investigation, including gathering information from X-Force Exchange, the analyst followed the defined process and turned to Watson for Cyber Security for insight about what was happening.

Using Watson, the SOC analyst was presented with some highly visual indicators alerting him to a potential threat involving some malware and a suspicious document. Watson was able to take all the known data, query its corpus of security information and deliver deep insight to the analyst.

In this case, it showed that Locky ransomware had infected six machines and was spreading through the network. Given this new information, the analyst changed the incident type and severity in the IRP, which triggered a new workflow and alerted a Level 2 analyst to get involved.

In the final stage of the scenario, the Level 2 analyst worked through the incident response plan, owning tasks or assigning to other departments as appropriate. Based on the type of data that was breached and the operating country, the response plan included quarantining infected servers, blocking a compromised user account and notifying the Information Commissioner’s Office.

To wrap up the event, the audience reflected on how differently this could have turned out. The time to detect, investigate and respond was significantly decreased by using new tools, ensuring that the attack was contained before it was able to propagate too far through the enterprise.

Now the question is: How quickly will your company be able to respond to the next cyberthreat?

Mike Spradbery is IBM’s Technical Leader for the UKI Security Systems Business, managing a diverse team of technical specialists who work with clients across all industries. During the past 20 years, Mike has worked with security, mobile, social and web experience technologies in a variety of business leadership, sales and technical roles.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today