Forensics

4 reasons forensics will remain a pillar of cybersecurity

Artificial intelligence (AI), security orchestration and the Internet of Things (IoT) are disrupting our industry. Some bombastic pundits are even predicting a Jetsons-like world where computers and IoT devices replace workers with machines. Yet most futurists believe computing will only evolve to the level of a digital assistant. Tasks, they say, will be split between artificial and biologic intelligence. Forensics is a prime example of a human compliment to both AI and security automation.

Here are some reasons Digital Forensics and Incident Response (DFIR) will stay relevant in this world of intelligent devices and software that “thinks.”

1. Alerts produced by AI may actually increase incident response workload

Artificial intelligence is making threat detection better. Yet AI has two downsides which will keep responders busy. The first is higher rates of false positives in detecting malware.

At the risk of oversimplifying, many AI approaches are closer to human intelligence because they think statistically. So far, AI trained with the prejudices ingrained in the data they're modeled against, have produced high false positives. I’ve heard chief data scientists at major vendors admit misfiring at rates of 20%. Filters and traditional signature detection are often mixed in to alleviate the burden on the user. Yet excessively sensitive detection is why many AV 2.0 vendors include investigative capabilities allowing humans to vet their conclusions.