Back in early 2000s, when the word AI was more of a Hollywood fantasy, the use cases involved were quite basic and sporadic, focused mainly on text-based data. Today, we have solutions that can identify possible terror suspects by analyzing a live video feed. Numerous industry surveys and reports have suggested that 2019 will witness an exponential adoption of AI and Machine Learning by the enterprises and information security will be one of the key drivers.
The integration of NoOps-DevOps-DevSecOps
An automated IT ecosystem, which can be abstracted from the underlying infrastructure creates a NoOps environment, something that CIOs are chasing today. Does that mean it’s putting an end to DevOps? Not exactly. Enabling NoOps culture in an organization allows the CIO to leverage the larger human capabilities to achieve better operational efficiency. There are two important aspects involved:
(1) How can applications move into production in the best time frame?
(2) How can vulnerabilities and risks be minimized?
“Artificial intelligence can elevate a security alert into a threat intelligence by providing the right context,” feels Sridhar Govardhan, CISO, Wipro. That’s where the culture of DevSecOps comes into picture. An opportunity for the CIO and CISO to work in a collaborative manner and deliver what the business needs. “A new avenue for revenue.” Govardhan further adds that certain alerts, which must be reviewed by multiple level of analysts can be automated to save both time and cost. This is not like an option that enterprises can weigh based on its core merits; rather it’s a necessity given the rapidly accelerating pace of the modern development cycle. So far, the acceptance of DevSecOps is lagging.
Can AI drive the adoption?
Business leaders will always demand faster turnaround time for any new application but to deliver at such a pace, while assessing potential security risks, is the biggest challenge for both CIOs and CISOs. “AI-based systems are particularly useful when the speed of detecting and analyzing threats are of the utmost importance. This becomes particularly difficult when the detecting systems are looking at very large data sets in real-time and analyzing data not only from their own internal systems but also threat intelligence data from outside the enterprise,” says Shivkumar Pandey, CISO, BSE India Ltd. Imagine what AI technologies can do in this context! There will be tighter deadlines but instead of skipping key security risk-assessment procedures, AI can help the DevSecOps teams by significantly decreasing the threat identification time along with increasing the false-positive identification.
Another key factor that goes against, especially, the CISOs is the lack of cyber security specialists in their teams. AI can play a part there too. It is not like AI will replace the humans in the workforce as human monitoring and inputs are shaping the AI technologies to arrive at the right conclusions. “Security teams should pair their human intelligence together with the advanced AI solutions to prevent the crime faster than hackers start to attack,” adds Pandey. A more specialized breed of data scientists and cyber security experts will be needed to train the AI on what to look for.
CIOs/CISOs always find it difficult to train/teach their developers about the potential security risks. With AI embedded into the DevSecOps culture, any potential risks that goes unchecked can be highlighted right at the development stage within the code so that when the application goes online, majority of the vulnerabilities are already known.