Proactive and detective risk reduction
When an organization faces many potential adversaries and advanced threats, it is important to have sophisticated tools, techniques, and trained personnel to protect our information systems. Advanced persistent threats (APTs) may mean we missed initial indicators of compromise (IOCs) and continue to be targeted by adversaries. We need to identify where attacks are originating, what systems may have been compromised, and prepare appropriate responses. It is common to deploy teams of security professionals, both internal and external, to combat the ever-increasing number and complex attacks. To aid investigators using forensic techniques, it is also common to use automation. Big data techniques and machine learning (ML) are now commonly used to process raw logged data. We will take a look at these technologies in the following section.
