RSAC 2024 Trend: AI-based threat intelligence analysis will be widely adopted

The RSA 2024 conference was held in San Francisco last week, gathering industry elites and attracting experts and corporate representatives from all over the world. This conference highlighted the focus on future security challenges, as well as the innovative solutions and strategies required to address them.

▌RSAC 2024 Key Views and Trends Summary

• The Dual Nature of AI Security:
  In the past, AI was seen as a powerful tool to improve security defense, but at RSA 2024, AI was not only given the identity of a protector, but also viewed as a potential attack vector. At the same time, the application of AI technology in the security field is becoming more and more widespread, for instance, it can be utilised to provide enterprises with comprehensive security visibility and threat response guidance.

• Focus on the Vulnerability of Critical Infrastructure:
  The rise of AI technology has triggered concerns about the security of critical infrastructure. The potential security threats brought by artificial intelligence have led various industries to attach greater importance to the protection of critical infrastructure, which became one of the important topics of this conference.

• Flourishing Innovation and Investment:
  RSAC 2024 demonstrated the innovation capabilities and investment enthusiasm of the security industry. Numerous start-ups showcased innovative security solutions at the conference, attracting the attention of investors. Meanwhile, merger and acquisition activities among large security companies continue, reflecting the competition and vitality within the industry.

• Tool Consolidation vs. Diversification:
  Despite the security industry's call for tool consolidation and simplification, the number of security technology vendors is actually still increasing. Surveys show that security professionals generally plan to increase their security technology vendors in the future, reflecting the security industry's demand for diversified security solutions.

• Risk Assessment Based on Threat Intelligence:
  Threat intelligence analysis is regarded as an important security defense method. Utilizing artificial intelligence and threat intelligence technology, security teams can more accurately assess the risks faced by the organization and formulate corresponding security strategies and response measures.

▌Application Prospects of AI in the Cybersecurity Field

The application and prospects of artificial intelligence (AI) in the field of cybersecurity have received unprecedented attention. Discussion and publicity regarding Generative AI (GenAI) were rampant at this conference, but in reality, cybersecurity professionals have already begun to try its application in areas such as security posture management, incident response, and threat intelligence analysis.

Data shows that 75% of cybersecurity professionals state they use open GenAI applications regularly, while another 19% use them occasionally. Although many are just conducting pure experimentation, it is undeniable that GenAI has rapidly become the tool of choice for threat analysts, malware analysts, red teamers, and others, being heavily utilized in the following scenarios:

• Security Posture Management: Utilizing GenAI for the analysis and prioritization of security posture management. The importance of this application area lies in the continuously expanding and changing attack surface, leading to a large number of vulnerabilities and critical exposures. GenAI can help security teams identify high-risk vulnerabilities on attack paths, enabling them to prioritize the correct actions to mitigate cyber risks.

• Security Data Source Analysis: Utilizing GenAI to analyze security data sources to determine which data sources should be optimized or retired. AI has the ability to analyze data sources based on factors such as targeted industry threats, known tactics, techniques, and procedures (TTPs), the Mitre ATT&CK framework, and past security incidents, and then recommend ways to optimize security data management.

• Incident Response and Investigation: Utilizing GenAI for incident response and forensic investigation. This is currently one of the mainstream use cases internationally. GenAI can automate response actions, or at least guide analysts in the correct direction for investigation, thereby improving the efficiency of security teams.

• Threat Intelligence Analysis: Utilizing GenAI for threat intelligence analysis. Threat intelligence analysis is an advanced skill that many organizations cannot afford, or cannot hire security professionals with the right skills to perform.

▌Important Trend: Enabling Enterprise Security Deployment with Threat Intelligence

Whether from a macro perspective or from the application prospects of AI, threat intelligence capability is the key to driving the future development of cybersecurity, and threat intelligence will also be heavily applied in active security defense.

At this conference, Robert Boyce, Managing Director and Global Lead of Cyber Resilience Services at Accenture, stated that Accenture will dedicate itself to "helping organizations leverage threat intelligence data to make it meaningful within their business environment."

SecOps Validation provides enterprises with first-hand victim threat intelligence, and offers organizations overall "end-to-end" visibility of defense capabilities through the SecOps Security Metric Validation Platform, mapping with the MITRE ATT&CK framework; it empowers various existing security defense measures or operations platforms like SOC to achieve proactive deployment in advance by displaying details of various tactics and techniques used by hackers through the SecOps Security Metric Validation Platform. Security teams can prioritize risks based on the organization's threat landscape, while also obtaining highly normative, actionable remediation guidance to mitigate and reduce risks, achieving an effective enhancement of security defense capabilities.