Intelligent security tools
Assessing intelligent tools for cyber security
Pages
Page 5 of 6
Available skills and resources
One of the most significant factors determining the effectiveness of any intelligent tool is the availability of resources needed to support its use, and skills required to set-up or manage it.
Identifying and implementing intelligent tools should be seen as a step that will improve the security operations of an organisation, by complementing current activity.
Interaction
Although intelligent tools may act autonomously, there are often many forms of interaction required for them to be effective.
If no one understands, or is able to act on the information that a tool produces, then it will have no value. Likewise, a tool which automates some activity can have a detrimental effect if it can’t be configured correctly.
Support costs
Intelligent security tools are new. As a result, you may be dependent on the vendor for support. This could limit the availability of support for installation, training and maintenance.
Using and maintaining the tool could require some very specialised expertise. As with many roles in cyber security, it can be difficult to find and recruit people with these skills. For this reason, you should not consider intelligent cyber security tools to be a replacement for skilled people, but rather a way of further augmenting their capabilities.
Principles
As well as the requirements for collecting and storing data, you may need to consider other hardware and software upgrades to ensure the tool will function correctly. AI can be computationally expensive and is often run in the cloud for this reason.
With intelligent tools, there is no guarantee that installation will be as simple as plug and play. It's likely that there will be some configuration needed. This may be manual, requiring appropriate skills and knowledge about your organisation. Or it may be automatic, meaning the tool 'learns' about how your organisation works. If the tool needs to learn about your organisation, it can take some time to become operational.
It's important to know what purpose the tool serves and ensure that it's configured appropriately. There is a generally acknowledged trade-off between fast computation of results and the accuracy of the results produced.
The overheads for getting the desired results from some intelligent tools are very high.
Being prepared
- Do you have all the appropriate hardware and software available to make use of the tool?
- Do you know what the implementation of the solution entails?
- Do you understand how to configure the tool? Do you know who will install and configure the tool?
- Do you know how the system will be maintained?
When introducing a new tool, you will need to ensure that relevant members of staff are able to interact with it correctly.
In many cases, the number of people who will directly interact with the tool will be just those in (or acting as) a security operations centre (SOC). But in some cases, the tool may be interacting with your entire workforce, and different people may be required to interact in different ways.
At this stage, the nature of the interaction needs to be considered. Specifically, what is expected of the user if they are to get what they need from the tool.
In most cases this will just be familiarisation with the functionality and interfaces, however in some cases it might require specific skills.
Working with intelligent devices is a new experience for many people, so you may find your current user base requires training. Ask your vendor what skills are required and whether training is available. Your current people may not find the tools easy to adapt to, and you may need to hire additional specialist operators to work directly with the tool.
Making the necessary skills available
- Identify who will use the tool
- Identify any specific skills that are needed. Are people with those skills readily available?
- Ensure that you can access appropriate training for users
It's almost a certainty that you will need support at some point during the life of an intelligent product. Knowing where to go for that support and how much is available will be vital for getting the most out of any tool.
Whether you choose to accept the potential impact of any support gaps or employing outside expertise, there will be an associated cost. This should be factored in when purchasing an intelligent tool.
Due to the dynamic nature of the underlying technology, intelligent tools may change more rapidly than static ones. As a result, support requirements can be more pronounced. Since working with AI based tools may require specialist knowledge, you could be almost totally reliant on the vendor for this support.
Securing support
- Do you know what support is provided for the tool across its lifetime?
- Have you identified what documentation and support material is available?
- Do you know where gaps in support exist? Have you identified how those gaps can be filled?
