The Glorious Promise of AI-Driven Cybersecurity

I don't love publishing here, mostly because I don't like the font. But here goes.

Those who know me well enough (and have exposure to my past writing) may sense cynicism in the title of this post. But I might tell you that this time is different.

It is rare in my line of work - the work of cybersecurity in a hospital - to find cause for optimism.

Threats to healthcare have escalated to a point where criminals will shut down your systems, hold them for ransom, and post vulnerable photos of your patients on the internet as a bargaining chip.

Most US hospitals still have no cybersecurity FTE, let alone an adequately staffed team of FTEs to do the work of cyber defense in a healthcare setting.

Solution equity in our nation's hospitals feels like it's at an all-time low. Then again, cybersecurity tooling has never been equal opportunity. You either have the budget, and therefore capability to defend, or you don't. And from the largest multi-campus health system, to the smallest rural critical access hospital, the safety of the same vulnerable human beings is at stake.

Okay this is already moving in a pretty rough direction, despite my original intentions of positivity!

Truthfully, these topics of escalating threats, and staffing, and accessibility of security products - we could do hours on each of those. But having acknowledged them, let's continue.

Something all of cybersecurity has long struggled with is orchestration and automation. These two words promise so much - to provide signal enrichment and magic button pushing and do the work that spares the human security analyst brain a few cycles, or maybe lots of cycles, and preserves that brain for what it does best - contextual understanding. People know the business. The machines do not.

But security orchestration and response - SOAR - (the most aspirational acronym for something so complex) - traditionally - it needs so much engineering and process maturity and trust, and those things are hard to come by.

To me, the promise of AI in cybersecurity is to answer questions which require incredible amounts of effort to answer, that we have long hoped SOAR would help with. Questions such as:

• What is the origin of this suspicious process? How was it born?
• Is what this user is doing on my network typical for them?
• Are my trusted 3rd parties sending malicious email to my organization?

The next decade will see AI change the face of cybersecurity. Really change. Solutions will answer these natural language questions, as effortlessly as other AI solutions today are composing music and creating artwork and writing code.

A new generation of analysts will emerge - who do not necessarily understand how to mechanically reverse engineer a threat, but know how to ask a security augmentation tool for the answers such engineering could reveal. The best will be adept at both. But the latter will still thrive in a world no longer restricted by a lack of supporting engineering resources. The blue team will be very happy with this future.

And consider the strategic implications of an AI-assisted security program. Program pillars and security initiatives are no longer mysterious and lack priority. An environment containing an AI compass could know where your policies live, and what they're made of, and infer, through signal analysis, what state of compliance they are in. Are they too heavy on administrative controls. Are technical controls present, but not working to potential. Where are there wholesale voids in your program, mapped against the framework of your choosing. There exists potential for a living, breathing approach to something that is generally assessed on an annual basis through a laborious interview process.

AI is very buzzworthy right now and commands every headline. But beyond the clickbait, I really do see a horizon five years out from now that sees material improvement in the way we are conducting the business of cybersecurity through AI augmentation. I'm here to argue that no vertical stands to benefit more from this evolution than healthcare. I hope it takes shape in the ways I've described.

sidebar philosophical tangent:

It's fashionable to call the threats against healthcare "asymmetric warfare". I was on the cusp of using that phrase in this post myself. The asymmetry is spot on, in that those who wish harm on healthcare generally have capabilities which exceed those of their victims. But warfare - a conflict - we have no conflict. Healthcare has no quarrel. Hospitals care for human beings. That's where that sentence ends. Not politically, not with agendas, not with discrimination. We are here for everyone. No matter who you are, or what you did or didn't do. We are a public service. This engenders vulnerability. We are implicitly trusting and open. I've never fully understood the callousness which drives individuals to prey on this. Quickly I think you see we could delve into an entirely separate conversation. But to me, the predatory behavior against hospitals - places that every person on Earth will at some point require the services of - feels like poisoning your own water. You'll have to drink at some point. If we're not around, you may not be either.