Next Generation (NG) information security solutions

Ruslan Rakhmetov, Security Vision

Traditional information security tools are currently unable to cope with the flood of cyberattacks, are ineffective against covert and complex cyber operations, require significant setup and administration, and still require extensive manual intervention by information security specialists. To address modern cybersecurity challenges, it is advisable to use products equipped with advanced functionality for blocking, preventing, detecting, and responding to cyberattacks – such tools include next-generation (NG) information security solutions, which we will discuss in this article.

The cyber threat landscape is constantly evolving, but it has – changed dramatically in the last four to five years, and this global trend is particularly evident in Russia. The tense geopolitical situation is provoking an escalation of destructive cyber activity, import substitution is increasing the heterogeneity of IT infrastructures and necessitating the hasty replacement of traditional defenses, the rapid development of AI systems is providing attackers with unprecedentedly powerful tools, and the shortage of qualified cybersecurity professionals is only exacerbating the challenges facing Russian companies in cyberspace. Cyber threats are currently evolving at an unprecedented rate, thanks in part to the evolution of AI, the widespread use of Open Source, and the rapid adoption of new technologies. The rise of cybersecurity in the enterprise segment, companies' growing dependence on opaque supply chains and complex trust relationships with counterparties, as well as the activity of motivated, organized cybercriminal groups and hacktivists, are causing traditional approaches to cybersecurity to become less effective. Classic information security systems were built on the principles of reactive defense: detecting traces of an active or past cyberattack (malware samples, accessing a malicious IP address, deleting or encrypting important files) and then "putting out the fires" – recovering the consequences of the hack by searching for compromised devices and accounts, blocking malicious activity, and restoring systems to a safe state from backups.

Traditional information security systems, such as antiviruses, IDS/IPS, firewalls, email and web traffic filters, and static access control policy solutions, rely on signatures, detection rules, firewall ACLs, and lists of malicious IPs/URLs/hashes. Such classic reactive defenses can only be considered effective against known attacks and specific TTPs (tactics, techniques, and procedures) of attackers, for which detection methods have been developed based on the consequences of successful cyberattacks. The classic "Protection -> Detection -> Response" sequence, in which a detection rule or signature is written for known threats, matches are searched for, and a response is then initiated to the cyberattack that has already caused damage, has obvious drawbacks: the damage has already been done, new types of attacks cannot be detected, advanced attackers are difficult to counter, and signatures and rules must be constantly updated and adjusted to meet evolving threats. The advantages of the classic approach include its well-studied nature and accessibility, low resource consumption (for example, static network rules can be configured on the most common household routers), and, most importantly, its high effectiveness in filtering out well-known and "noisy" attacks (e.g., automated infrastructure scanning, simple DDoS attacks, and pattern attacks by low-skilled attackers). Furthermore, classic information security systems were actively developed over 10-15 years ago, so they may also share certain characteristics of older products: a focus on perimeter protection, on-premise installation only, lack of integration with cloud infrastructures, limited telemetry analysis capabilities, a high degree of manual labor in administration and operation (writing signatures and rules, processing logs and searching for significant events, and incident analysis), and a lack of integrated ML and AI mechanisms.

Proactive cyberdefense involves a fundamentally different, more modern approach, which focuses on predicting and preventing cyberattacks, ensuring cyber resilience, using predictive analytics and identifying cyberthreat trends, and extensively utilizing ML, AI, and Big Data technologies. Thus, modern information security systems enable proactive action and the prevention of even previously unknown cyberattacks – such security products are called NG (Next Generation) solutions. The key characteristic of Next-Gen information security systems is the ability to detect and respond not to individual events, but to the entire cyberattack chain proactively, automating most actions and blocking malicious activity in real time. Examples of Next-Gen information security solutions are NG SIEM (next-generation Security Information and Event Management), NG SOAR (next-generation Security Orchestration, Automation and Response system), NG TIP (next-generation cyber threat intelligence management platforms), NG SGRC (next-generation information security, cyber risk, and compliance management platforms), NG VM (next-generation vulnerability management systems), NG FW (next-generation firewalls), NG AV (next-generation antiviruses), NG EDR (next-generation endpoint protection solutions), NG XDR (next-generation advanced threat detection and response systems).

The characteristic features of Next-Gen information security solutions are the following functions:

1) Behavioral analytics, detection of anomalies and hidden multi-stage attacks:

Modern complex cyberattacks rarely follow a standard pattern using known malware samples. Hackers modify viruses, encrypt the malicious payload, exploit covert control channels for infected devices, and utilize system utilities, legitimate tools, and traffic tunneling and remote PC control. Therefore, complex cyberattacks cannot be detected without analyzing the behavior of various objects (information systems, devices, processes, and accounts). Next-generation cybersecurity products can learn from network traffic and typical interactions between systems and accounts, enabling them to build a model of the normal behavior of objects within the infrastructure. Deviations from the established behavioral model are then detected. If a device or user performs unusual actions, this may indicate an incident. For example, if a user typically connects to the corporate infrastructure from a Linux PC in Moscow during work hours, and then attempts to connect from a Windows PC in Bangladesh at night on a weekend, it is likely that this employee's account has been compromised. Another example: if the winword.exe process spawns a powershell.exe process, which then downloads a file object from the internet and transfers control to it, there's a 99% chance that malicious activity is taking place. In these examples, a classic network security system would allow the connection because only the login/password pair (likely compromised) is checked, while a traditional antivirus would not issue a warning because all launched processes are legitimate programs and are not considered malicious in and of themselves. An approach based on anomaly detection and behavioral analytics allows Next-Gen security solutions to focus not on static rules and signatures, but on sequences of actions that are unusual for a user or legitimate application but are often used by attackers.

2) Application of ML and AI mechanisms, including AI assistants and AI agents:

The use of AI and machine learning in cybersecurity offers a number of advantages: simplification of phishing and malware analysis, detection of network attacks and anomalous activity, vulnerability searches, configuration security audits, assessment of network infrastructure connectivity, and threat detection in telemetry streams. Furthermore, AI assistants in copilot mode provide employees with response prompts tailored to the incident context, AI-powered chatbots provide analysts with recommendations for configuring security solutions and information on current cyberthreats, and AI agents automatically perform threat containment and mitigation actions in real time within the protected infrastructure, enabling them to keep pace with malicious attacker activity. Furthermore, in-depth investigations into the root causes of incidents, reporting, and analysis of applicable legal regulations regarding the timeframes and procedures for responding to cyber incidents are all simplified.

3) Integration with cloud, hybrid, on-premise, and infrastructure solutions, using advanced telemetry:

Unlike traditional information security systems, Next-Gen security solutions were designed to operate in heterogeneous distributed environments, which include traditional on -premise systems alongside cloud-based systems (SaaS, PaaS, IaaS), containers, and microservices, as well as hybrid interaction schemes and the integration of IT and OT infrastructures. Consequently, Next-Gen information security solutions can receive telemetry, events, and logs from a wide variety of sources (network and infrastructure equipment, servers, workstations, cloud systems, IoT / IIoT devices), increasing the transparency and controllability of the entire infrastructure.

4) Contextualization of events, identification of attack chains:

Traditional information security systems provided specialists with only fragmented information about information security breaches – for example, when a known malware sample was launched or when connecting to a malicious URL. Each such event alone cannot provide an analyst with a complete understanding of what is happening – for example, a firewall does not provide information about the process that initiated the connection to a malicious domain on the endpoint, and an antivirus does not indicate how a suspicious file entered the system directory on the device. Furthermore, some attacks are extremely protracted: between the first attempt to access the network using compromised credentials and the encryption/destruction of the infrastructure, the hacker goes through numerous intermediate stages, which must be manually reconstructed piecemeal from various systems during the investigation. By deeply integrating with various systems and receiving extensive telemetry from disparate sources, Next-Gen information security solutions allow one to "see" the entire attack chain, from initial access to damage.

5) Integration with cyber intelligence sources and the use of cyber threat analytics:

Threat Intelligence allows you to enrich events with the necessary context and identify threats that are not detected by traditional means. Indicators of compromise (IoC) allow you to detect already known threats, malware, and cyber campaigns, and indicators of attack (IoA) make it possible to identify suspicious activity based on the attackers' signature, tactics, techniques, procedures, and tools. Attackers can easily modify a virus, migrate C2 servers (Command and Control servers) and Control (managed by hackers) on new infrastructure, create new malicious domains, but the approach to conducting cyber operations evolves slowly, which is why it is so important to operate not only with static IoCs (IPs, URLs, domains, hashes), but also dynamic IoA, which characterize the sequence of actions (receiving a phishing email -> opening an Office document with a macro -> launching a command interpreter -> executing a malicious payload -> connecting to a C2 server). Indicators of compromise allow for processing the event stream with a quick match search or performing retrospective searches in historical data, and attack indicators allow for more in-depth analytics, which together enable Next-Gen information security solutions to detect hidden cyber threats where traditional information security systems are ineffective.

6) Automation of actions, proactive counteraction to threats:

AI technologies are actively used by attackers to automate all stages of cyberattacks, searching for vulnerabilities, developing complex malware, and creating plausible phishing messages. To keep up with the speed of attacks, defenders also need to leverage automation – quickly detecting and blocking breaches, analyzing and classifying incidents, and predicting threat development. Next-generation security solutions significantly reduce the routine workload of cybersecurity professionals by automating the most labor-intensive steps in responding to cyberattacks: event enrichment and contextualization, incident analysis and triage, checking for false positives, detecting weak correlations and anomalies, searching for events in the vicinity of the incident, searching for matches in the IoC database, and implementing active countermeasures such as network isolation of the infected device, account blocking, terminating the malicious process, and severing the network connection to the attacker's server. Automation is also needed for other information security processes, such as asset management, vulnerability management, configuration management, and change management; cyber risk assessment; ensuring business continuity and infrastructure recovery; and verifying compliance with legal requirements. The functionality of Next-Gen information security solutions can also be used for these purposes. For example, asset management systems can integrate with other information security systems and calculate the cyber risk level for each device; vulnerability management systems can be enriched with cyber threat intelligence data on trending vulnerabilities and exploits available to cybercriminals; and configuration management systems can obtain analytical data on the most vulnerable system settings.

7) Risk and data centricity for prioritization of events and focus on critical assets:

Not all cyberattacks are equally critical, and the need to prioritize responses stems from the fact that incidents can occur simultaneously on different assets, each with varying levels of impact on the company's well-being. Accordingly, it is necessary to assess the importance and calculate the risk level (score) of assets: an asset's criticality is determined by the importance of the information system and the corresponding business process it depends on, while the risk metric depends on the asset's security level, the presence of vulnerabilities and insecure settings, and the history of incidents on that asset. Maintaining an asset inventory, assessing vulnerabilities and configurations (including the availability of security updates, current software versions, user account privileges, and network access), determining the asset's value to the company and attackers, and analyzing the likely attack route allow for the prioritization of information security events on a specific asset. For example, an incident recorded on a test server in an isolated subnet will be less of a priority than an incident on a web server in the production segment. Next-Gen security solutions take into account asset properties, event history, risk metrics, and other characteristics to prioritize incidents.

8) Account protection:

Attackers tend to take the path of least resistance to increase the effectiveness of their attacks, so they often don't develop complex exploits for new vulnerabilities, but instead resort to phishing and use compromised login/password pairs from various data leaks. Accordingly, modern Next-Gen information security solutions must use information about accounts, their privileges, status, take into account risk metrics and apply conditional access mechanisms. Each account in the corporate infrastructure has specific privileges and access levels to information resources. To protect accounts, in addition to standard passwords, multifactor authentication (MFA) is used, along with connection security checks that take into account the account's compromise history and suspicious activity. Conditional access functionality is also used, including checking the remote connection's geographic location and performing posturing checks (OS version, availability of working security tools on the device, absence of critical vulnerabilities). Accordingly, if a user doesn't use MFA, has previously performed suspicious actions, or connects remotely from an unauthorized geographic location, they will be denied access to corporate resources.

9) Using Zero Trust Network Architecture:

Next-Gen security solutions using the Zero Trust model can solve several problems:

• control of employee and administrator accounts, including minimization of privileges, implementation of a role-based or attribute-based access control model, multi-factor authentication, provision of access based on an assessment of the risk of account compromise, provision of time-limited and privilege-limited access for administrators, outsourcers and contractors, as well as control of their actions;

• inventory and control of devices connecting to the infrastructure, including checking the installed security tools and the absence of malicious activity on the devices (posturing);

• network microsegmentation, encryption of internal traffic, implementation of conditional network access (conditional access), ensuring network security at the L7 level (application control);

• managing secure software development, checking installed software and updates, vulnerability management;

• control and prevention of data leaks, monitoring the state of infrastructure, implementation of cyber incident response processes.

10) Platform and ecosystem :

Next-generation (NG) information security products typically operate within a single vendor's unified ecosystem. This platform-based approach enables the native integration of multiple solutions, resulting in synergies: one component ensures endpoint security, another is responsible for network traffic, a third collects and correlates events, a fourth automatically responds to and eliminates threats, and a fifth ensures compliance with applicable data protection legislation. This ecosystem-based approach improves infrastructure visibility and control, ensures broad coverage of event sources, and facilitates the exchange of information security-relevant data between ecosystem components.

All Security Vision products fully qualify as Next-Gen information security solutions, as they make extensive use of AI and ML mechanisms, implement anomaly detection and behavioral analytics, and utilize the automation capabilities of most specialist actions. Furthermore, Security Vision products offer a wide range of integrations, the ability to operate in various environments and infrastructures, and the functionality of applying cyber threat analytics (cyber intelligence). The Low-Code / No-Code Security Vision platform itself unites various products and modules into a single ecosystem. Security Vision is the first Russian company to offer the NG SOAR (Next Generation SOAR) solution to the market, which includes a combination of Security Vision AM, SIEM, SOAR, GosSOPKA, and FinCERT products. Security Vision's product portfolio also includes other Next - Gen information security solutions: NG SGRC, NG TIP, NG VM, NG SOC, NG EDR, NG SIEM, NG UEBA. In ecosystem solutions, in addition to Security Vision SOAR , include Also Security Vision SIEM , Security Vision TIP , Security Vision UEBA , Security Vision VS / VM , Security Vision EDR , Security Vision SPC , Security Vision CM , Security Vision SA , Security Vision BCM , Security Vision RM , Security Vision ASOC products And row others products.