Digitalization is rushing rapidly to occupy all aspects of life; the increased adoption of IT technology has resulted in an equal increase in cyberattacks. According to Cyber Security Ventures, the global costs of cybercrime is projected to reach 10.05 trillion by 2025 annually. The same study predicates a ransomware attack will hit a business every 11 seconds. That is, without counting the number of ransomware attacks against individuals. The big losses that occurred because of cyber incidents will undoubtedly transform our society in various ways.

Going further, cyberattacks on critical infrastructure such as power generation and distribution, transportation, and emergency services will intensify. Criminals already utilize advanced attack techniques and build customized attack tools and malware to infiltrate IT systems and networks. Hence, even well-protected organization still fall victim to cyberattacks.

This article sheds light on the concept of Adaptive Security – a innovative concept in cyber defense which, if implemented correctly, will aid organizations to respond efficiently to the increasing number of sophisticated cyberattacks they face daily.

Defining Adaptive Security

Adaptive security is a new cybersecurity model that continually monitors threat events observed in the network and notifies the security team accordingly. This allows the security team to develop defense strategies and techniques to overcome threats before they turn into concrete attacks.

Deploying classical security solutions such as firewalls, IDS/IPS, and anti-malware programs to stop today’s most advanced cyberattacks is inadequate. Today’s complex IT environment that integrates on-premises, multi-cloud and virtual systems exposes organizations to various sophisticated threats daily. Waiting to respond to security incidents after they have occurred becomes inefficient practice, resulting in losing revenue and damaging reputation.

The Adaptive Security approach surpasses the traditional security solutions by studying the events, behaviors, and characteristics of users, systems, and cybercriminals, then predicting cyberattacks and any abnormal activity based on predefined patterns collected from the acquired knowledge.

Under this definition, Adaptive Security is similar to Heuristic analysis employed by many antivirus programs to detect viruses based on their suspicious characteristics. The Heuristic analysis model allows for detecting unknown, modified versions and modern malware that do not have a known threat signature.

Adaptive Security utilizes the Heuristic analysis model by establishing a feedback loop that continually collects threat data and applies the necessary prevention techniques that become more consistent and efficient over time. Adaptive Security achieves its goals by implementing the following four strategies – also known as Adaptive Security Architecture.

Adaptive Security Architecture

According to Gartner, the Adaptive Security architecture is composed of the following four stages (see Figure 1):

1. Prevent: This is the first phase that all organizations begin with when creating their cybersecurity defenses. The organization will deploy various traditional security solutions (Firewalls, IPS/IDS) to counter cyber threats in this phase. Security policies, access controls, and work processes are also defined in this phase to create secure products/services that mitigate cyber threats. Implementing this phase will stop most of the cyberthreat. However, what about advanced threats – such as APT and zero-day exploits that cannot be stopped using traditional security technologies?
2. Detect: The detective phase captures threats that are not caught by the first layer. The detective layer involves dynamic code analysis and security professionals analyzing potentially malicious code to prevent it from becoming a real threat.
3. Respond: In this phase, the Adaptive Security system decides what to do regarding risks not captured by the previous two layers. Each incident is investigated thoroughly and suggested countermeasures are advised, such as changing IT security policy, changing security solutions configurations settings, and alike. This phase allows an organization to mitigate similar future security incidents.   
4. Predict: This phase provides intelligence to predict future cyber threats and prepare a response in advance. For instance, Cyber Threat Intelligence (CTI) feeds are utilized to gather intelligence about external security events that can escalate and become a security risk. The provided threat information is used to foster the detection and prevention capabilities of the first two phases.      

What benefits adaptive security can bring to securing your business?

Adaptive Security provides numerous benefits for organizations. The following list summarizes the main ones:

1. Real-time security monitoring.
2. Reduce attack surface by closing many entry points utilized by cybercriminals to infiltrate networks and systems.   
3. Reduced   response time to cyberattacks, allowing to counter cyber threats more efficiently.  
4. Detect and stop ongoing security breaches.

How to implement Adaptive Security in your organization?

When implementing the Adaptive Security model, the implementation strategy should be integrated within the overall security defense strategy of the organization. Similarly, it should be integrated into the existing system, security design, and risk management strategy, and quality assurance to ensure that all security components comply with the existing IT security policy. When designing Adaptive Security for your organization, consider following these main steps:

1. Identify potential threats that your organization could be subject to. These potential threats could be composed of well-known threats or suspicious behaviors.   
2. Define the expected behavior of systems and other components that should not be mistaken and handled as a threat.
3. Define your triggers to initiate an automatic response when a threat is detected. The response action should be balanced and not lead to stopping systems or running processes.
4. Consider not having trusted entities or components within your system. It would be best to consider any element as a potential entry point to your system.
5. Define recovery procedures to recover from possible incidents.
6. Have feedback at the end, so you can measure your response to security incidents and update your security policies and other processes accordingly.

Prior to implementing the steps mentioned above, the organization must implement the following four critical elements before designing an Adaptive Security Architecture model.

• Consider changing your organizational culture from “Incidence Response” to “Continual Detection and Monitoring.”
• Direct your security budget to spend on monitoring, threat intelligence, and other prediction capabilities rather than prevention techniques only. 
• Invest in establishing a Security Operations Center (SOC) that fosters threat intelligence capabilities and promotes continual monitoring and real-time response.  

Summary

Cyberattacks are increasing at a rapid pace that exceeds any organization ability to counter them efficiently. Adaptive Security Architecture allows organizations to have a flexible and proactive security model that responds to security threats early before reaching an enterprise’s gates. The Adaptive Security model can dramatically change how organizations detect and respond to threats and is expected to become widely used in the near future.