October 17, 2016 By Mike Spradbery 3 min read

Earlier this month, more than 80 security leaders entered the next-generation security operations center (SOC) experience at IBM Business Connect in London to see the difference that Watson and Resilient could make to incident investigation and response. The audience sat in a darkened room facing five large screens and took advantage of the opportunity to watch a mock SOC — complete with IBM analysts — conduct typical security business.

Following a brief introduction of what was showing on the various screens — which included a quick look at IBM X-Force Exchange, IBM’s threat sharing platform — the audience watched as a Tier 1 SOC analyst began his shift at a fictitious professional services company. Before he even had time to get his morning coffee, the fictional analyst found that something was wrong.

Using IBM QRadar as the security intelligence platform, the analyst was alerted to some potentially suspicious behavior involving a known bad IP address. Based on the suspicious activity, an Incident was automatically created in the IBM Resilient Security Orchestration, Automation, and Response (SOAR) Platform to ensure that the SOC analysts were able to follow a well-defined process to investigate and respond to the threat. Having completed some basic investigation, including gathering information from X-Force Exchange, the analyst followed the defined process and turned to Watson for Cyber Security for insight about what was happening.

Using Watson, the SOC analyst was presented with some highly visual indicators alerting him to a potential threat involving some malware and a suspicious document. Watson was able to take all the known data, query its corpus of security information and deliver deep insight to the analyst.

In this case, it showed that Locky ransomware had infected six machines and was spreading through the network. Given this new information, the analyst changed the incident type and severity in the IRP, which triggered a new workflow and alerted a Level 2 analyst to get involved.

In the final stage of the scenario, the Level 2 analyst worked through the incident response plan, owning tasks or assigning to other departments as appropriate. Based on the type of data that was breached and the operating country, the response plan included quarantining infected servers, blocking a compromised user account and notifying the Information Commissioner’s Office.

To wrap up the event, the audience reflected on how differently this could have turned out. The time to detect, investigate and respond was significantly decreased by using new tools, ensuring that the attack was contained before it was able to propagate too far through the enterprise.

Now the question is: How quickly will your company be able to respond to the next cyberthreat?

Mike Spradbery is IBM’s Technical Leader for the UKI Security Systems Business, managing a diverse team of technical specialists who work with clients across all industries. During the past 20 years, Mike has worked with security, mobile, social and web experience technologies in a variety of business leadership, sales and technical roles.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today