Another caveat for AI-based workflows is that they can be vulnerable to cyber-attacks. One of the most important threats to AI systems is the potential for their training data to be poisoned. Someone with bad intentions could for example access the AI training data and inject information that will cause the AI model to act in a way that the developers wouldn’t expect. The concern with automation is that it can be predictable, which makes the hacker’s job much easier. That’s why it’s still critical to include a human operator in the workflow, whose interventions can reduce predictability.
One AI-based system will typically focus on one task or threat. The added value of the human operator is that they can bring all the information from different systems together and get a bigger picture of the situation. A key element in making this possible is offering the NOC and SOC analyst an ergonomic workspace that can visualize all critical sources in a single pixel space.
The good news may be that, with more automation and AI added to the operator workflow, more resources can be freed up, so that operators can focus on less mundane, less repetitive tasks, and more on strategic tasks that require creativity and critical thinking.
Trend #3: From a reactive to a proactive approach
Closely related to the previous trend, is that NOCs and SOCs are increasingly shifting from a reactive to a proactive approach. By regularly and proactively sweeping so-called Indicators of Compromise (IoC), NOCs and SOCs can weed out the false positives and act on the alerts that form a real threat. To analyze these large amounts of information, NOCs and SOCs are increasingly relying on AI tools for the identification of data and events that are relevant to the organization’s cyber security.
"Due to the constant flood of cyber threats, many organizations are required to continuously react in real time to protect their networks and keep them up and running," adds Bert Vandenberghe, Sales Engineer at Trend Micro, a global cybersecurity leader. "An alternative approach is to proactively perform regular risk assessments to determine the appropriate remediations ahead of the threat, and to prevent future security vulnerabilities." One AI-based system will typically focus on one task or threat. The added value of the human operator is that they can bring all the information from different systems together and get a bigger picture of the situation. A key element in making this possible is offering the NOC and SOC analyst an ergonomic workspace that can visualize all critical sources in a single pixel space.
The good news may be that, with more automation and AI added to the operator workflow, more resources can be freed up, so that operators can focus on less mundane, less repetitive tasks, and more on strategic tasks that require creativity and critical thinking.
Trend #4: Collaboration is critical in crisis handling
The past couple of years have been an enormous stress test for our communications networks. During the pandemic, the growing number of remote workers made it more challenging for IT teams to offer reliable connectivity and to enable continuity in the day-to-day operations out of the workplace. The pandemic also accelerated a corporate move to the cloud, putting an even greater stress on the network.
More corporations are therefore outsourcing their NOC and SOC operations in some form. Many larger businesses opt for a hybrid model, in which parts of the NOC/SOC operations are still taken care of internally, while other parts are outsourced to specialist companies. Smaller enterprises are often taking advantage of attractive pricing models of Managed Service Providers (MSP) to outsource their entire NOC and SOC operations.
