Home / Resources / News and Trends / Newsletters / AtIsaca / 2021 / Volume 41 / Artificial Intelligence Uses in Blue Team Security Whats Working and What Isnt

Artificial Intelligence Uses in Blue Team Security: What’s Working and What Isn’t?

AI Uses in Blue Team Security
Author: ISACA Now
Date Published: 8 December 2021

Artificial intelligence (AI), machine learning (ML), and deep learning (DL) are often applied in cybersecurity, but their applications may not always work as intended. ISACA’s new publication, AI Uses in Blue Team Security, looks at AI, ML and DL applications in cybersecurity to determine what is working, what is not working, what looks encouraging for the future and what may be more hype than substance.

Leveraging interviews with some of the engineers behind these technologies, firsthand examination and use of some of the related products, and observations of chief information security officers (CISOs) and chief information officers (CIOs), the publication outlines the three areas in cybersecurity where the engineers believe that ML helps:

  1. Network intrusion detection/security information and event management (SIEM) solutions: Keeping an intrusion detection system (IDS) up to date can be a manual and time-consuming process. In the market today, ML capabilities are helping enhance and reimagine the IDS methods of signature-based intrusion detection and anomaly-based intrusion detection.
  2. Phishing attack prevention: There are bots and automated call centers that pretend to be human; ML solutions such as natural language processing (NLP) and Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHAs) help prove whether users are human or a machine, in turn detecting potential phishing attacks.
  3. Offensive cybersecurity application: ML is being applied to help with phases of penetration testing, specifically in reconnaissance, scanning and fuzzing/exploit development.

On the other hand, there are a few areas where ML is overused. Developers may be using ML for problems that do not require it, or in some instances, ML solutions may be ineffective. The paper explores those areas as well as malicious uses of ML and DL, specifically in social engineering and phishing.

AI Uses in Blue Team Security a free download at https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004L3CjEAK. For more emerging technology resources, visit https://www.isaca.org/resources/emerging-technology-resources.