Modern Defense in Depth

Chapter 5. The Future of Defense in Depth

Today, we observe attackers who control vast numbers of infected machines (bots) conscripted into their botnets. These bots are integrated with the attacker and are often fully aware of one another. Thus, we now are seeing automation and even machine learning being used by attackers themselves in their fight against us. Can organizations take advantage of machine learning as well? The answer is yes.

In this final chapter, I explain how security operation centers (SOCs) can use supervised machine learning (SML) in the fight against attackers. I’ve included a checklist that will help your organization prepare for the future of SML and outlined steps that you can take to achieve success.

What the Future Holds

As more organizations move their web applications to one of the many cloud environments operating today, the entire industry will need to shift more toward integrated lines of defense, grouping technologies together based upon where they operate in the protocol stack and where it makes the most sense. For instance, there are already cloud security-as-a-service (SECaaS) offerings available today whereby the independent lines have already been eliminated through singular user interfaces (UIs), human-based oversight, automation, scripting, and the usage of application programming interfaces (APIs).

In the very near future, as learning-enabled machines observe the operations of SOC personnel and when these machines begin to perceive repetitive ...