Complex security architectures and innovation
by Mirko Zorz - Thursday, March 29 2012.
Martin Borrett is the Director of the IBM Institute of Advanced Security in Europe. He leads the Institute and advises at the most senior level in clients on policy, business, technical and architectural issues associated with security. In this interview Borrett discusses information security innovation, the importance of artificial intelligence in complex security architectures, CISO nightmares, and more.

A myriad of new security technologies appeared in the past decade. Regardless, the rapid evolution and increasing sophistication of the threat landscape ensured a never-ending battle with the bad guys, often with millions of dollars as collateral damage. What can the information security industry do to truly innovate, not just follow the tactics of cybercriminals and, ultimately, act as a giant band aid?

Intelligence is the innovation play in security. We believe that tackling cybersecurity is more than any one individual step; it is a continuous process where you need to: Learn, Monitor, Analyse, Decide and Respond.

Today’s cyber threats require: continual inspection and analysis of high volumes of dynamic data from sensors and other devices to gain accurate insights into possible threats and system compromise in real time. Pattern and behavioural analysis across diverse data streams from many channels is necessary to detect evasive attacks.

Advanced situational awareness provides the context and alerting to enable decision making and appropriate response in circumstances when humans cannot keep up with the pace of the threat when under attack.

Defences need to be able to fuse information from a variety of sources, including real-time observations, and make them available within the right context. Such real-time analysis will have an impact on business processes that will need to be thought through carefully and automated in order to adapt and respond to the threat dynamically.

When do you expect to see the application of artificial intelligence on a large scale in complex security architectures? Could we expect to have a type of self-healing system in the future?

Artificial intelligence in security is all about advanced correlation and predictive analytics. Nothing is ever quite as random as it seems. There are patterns to be discovered in almost everything we do and security is no exception. The challenge is deploying software that not only can identify those patterns, but also ultimately share that intelligence with other systems and applications in a way that is actionable.

IT organizations need access to security tools that make it easier to identify anomalies that are usually indicative of a security breach. That “brain” first works to identify the natural operational rhythms of the business. Once those are determined it becomes a lot easier to identify unusual activity, such as a system that is sending large amounts of data at irregular hours of the day.

That capability is then integrated with IBM network operations centres around the globe that work to analyse 13 billion security events a day.

Once correlated information about that potential security threat suddenly gains a lot a more context.

The fact of the matter is that most security breaches are not discovered for months, even years. And it’s usually someone outside the IT organization that discovers it. Security intelligence is about giving the internal IT organization the tools they need to identify those breaches before anyone else does.


Most IT pros have seen potentially embarrassing information about their colleagues

More than three-quarters of IT professionals have seen and kept secret potentially embarrassing information about their colleagues, according to new research conducted by AlienVault.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Feb 10th