{"id":2066,"date":"2022-09-05T07:56:19","date_gmt":"2022-09-05T07:56:19","guid":{"rendered":"https:\/\/exceltic.com\/?p=2066"},"modified":"2026-03-19T13:31:33","modified_gmt":"2026-03-19T12:31:33","slug":"soc-cyber-threats-ia","status":"publish","type":"post","link":"https:\/\/exceltic.serquo.com\/en\/soc-cyber-threats-ia\/","title":{"rendered":"SOC: management and prevention of cyber-threats using AI"},"content":{"rendered":"

According to Matt Ahlgre (2022, WSR<\/a>), the ransomware or 'data hijacking' attacks <\/strong>occur every 10 seconds and it is estimated that the global cost of cyber-threats in 2025 will be 10.5 trillion.<\/p>\n\n\n\n

However, in spite of these data, the future of the cybersecurity <\/a>looks promising. Numerous advances in detection and response to these threats, using technologies such as machine learning or deep learning<\/strong>, they are able to detect them at an early stage.<\/p>\n\n\n\n

In 2020, Garner <\/strong>establishes \"SECURITY MONITORING PYRAMID<\/em>\"<\/strong> o \"triangle of virtue<\/strong>covering most of the cyber security spectrum through threat detection, prevention and response solutions:<\/p>\n\n\n\n

\"Cyber-threats<\/figure>\n\n\n\n
EDR<\/mark><\/strong><\/td>EDR<\/strong>, Endpoint detection and response (EPR) is a system that monitors suspicious activity at endpoints<\/strong> (computers connected to a network, not the network itself).

It enables the collection and analysis of data on endpoint security risks with the objective of detecting security breaches as they occur, providing a rapid response to identified or suspected threats.\u00a0The capabilities and details of an EDR system can vary substantially depending on how it is implemented.<\/td><\/tr>
NDR<\/mark><\/strong><\/td>Network detection and response allows you to monitor traffic for threats and suspicious behaviour that could cause a security breach in the future. 

Traditional signature-based methods are no longer 100% effective against modern threats, creating a false illusion of security for many businesses. 

Greater and deeper network visibility provides businesses with an additional layer of security and advanced prevention capabilities.<\/td><\/tr>
SIEM<\/mark><\/strong><\/td>Security information and event management<\/strong>, is the umbrella term for the services of software <\/a>that collect and examine (suspicious) behaviour in their digital infrastructure from numerous sources. 

SIEM's main function? <\/strong>Collect security information from databases, servers, domain controllers and network hardware. Identify risks, identify trends, examine alarms and locate network vulnerabilities by applying analytics to this data.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Why use an NDR?<\/p>\n\n\n\n

SIEM programmes<\/strong> can generate comprehensive reports on incidents and events, including malware and other transgressions. However, they are not able to adjust on their own and are often unable to it is difficult to interpret large amounts of data. <\/strong><\/p>\n\n\n\n

An advanced NDR<\/strong>, in contrast, it can quickly decrypt a large number of protocols to identify suspicious attacks and patterns of behaviour with sufficient context and evidence for analysts to act with confidence. In addition, NDR complements EDR by filling in the gaps that EDR does not detect.<\/p>\n\n\n\n

Each of the SIEM, EDR and NDR<\/strong> has particular advantages and disadvantages. When all three are combined, each element can reinforce the others.<\/strong><\/p>\n\n\n\n

HOW TO STOP RANSOMWARE<\/p>\n\n\n\n

Ransomware attacks<\/strong> are changing, in fact, new generations often use stolen credentials in order to gain privileged access.<\/p>\n\n\n\n

The attacker's intent <\/strong>is to get administrator access to the domain controller, as from this position it is easy to gain access to most of the valuable data. It is also possible to deploy ransomware incredibly quickly, using administration tools that have GPOs (Group Policy Objects).<\/p>\n\n\n\n

The modern RansomOps attacks do not deploy the binary code all the way to the end<\/strong>So by the time you see the attack, it is too late. Early detection of it, in the earlier stages, is vital.<\/p>\n\n\n\n

For this reason, it is absolutely essential<\/strong> monitor the use of all privileged accounts. We have observed that this is certainly one of the most valuable attack detection signals.<\/p>\n\n\n\n

Recommendations:<\/p>\n\n\n\n

Prevention<\/strong>:<\/p>\n\n\n\n