{"id":21123,"date":"2022-11-16T12:43:35","date_gmt":"2022-11-16T12:43:35","guid":{"rendered":"https:\/\/www.intelligentcio.com\/apac\/?p=21123"},"modified":"2026-07-23T17:02:11","modified_gmt":"2026-07-23T16:02:11","slug":"automation-isnt-the-answer-to-the-cybersecurity-skills-shortage","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/apac\/2022\/11\/16\/automation-isnt-the-answer-to-the-cybersecurity-skills-shortage\/","title":{"rendered":"Automation isn’t the answer to the cybersecurity skills shortage"},"content":{"rendered":"\n

Vaughan Shanks,\u00a0Cydarm\u00a0CEO, says the\u00a0resourcing challenges of security operations teams are nuanced and unlikely to be substantially solved using automation alone.\u00a0<\/em><\/p>\n\n\n

\n
\"\"
Vaughan Shanks, CEO, Cydarm<\/strong><\/figcaption><\/figure><\/div>\n\n\n

We know there\u2019s a security skills shortage. We\u2019re constantly reminded of it \u2013 the gap between supply and demand isn\u2019t closing and a high number of data breaches and ransomware incidents are occurring as a result.<\/p>\n\n\n\n

Automation is commonly marketed as a panacea for the skills shortage to lift the technical burden placed on cybersecurity operations analysts and free up their time to focus on higher-order tasks or remove the need for analysts altogether. <\/p>\n\n\n\n

That looks immensely attractive to organizations looking for quick ways to do the proverbial \u2018more with the same (or less)\u2019. <\/p>\n\n\n\n

But anyone who\u2019s spent any time in cybersecurity knows automation is a more complex challenge than it seems and can have unintended consequences. The whole reason security operations teams exist is because the existing controls on our perimeters, endpoints and servers have been unable to block intrusions.<\/p>\n\n\n\n

While automation is useful in some limited contexts, security teams cannot abrogate their risk management responsibilities by delegating decision-making to a machine. Nor can automation provide an account of what is happening to a senior decision-maker, supply chain partner or regulator.<\/p>\n\n\n\n

In addition, the skills required to configure and maintain automation often requires hiring security engineers, and these are harder to come by than SOC analysts.<\/p>\n\n\n\n

A capability maturity model (CMM) for security operations can assist in determining what is best handled by humans or computers.<\/p>\n\n\n\n

A base level of human agency will always be required for threat identification,\u00a0triage\u00a0and response. But automation can be of utility where processes are well-defined and the effect of automating them is well understood.\u00a0A CMM can be used to create the right mix and balance to constantly evolve and continuously improve the mix as operational requirements change.<\/p>\n\n\n\n

Down the wrong path<\/strong><\/p>\n\n\n\n

Several risks arise when organizations use automation to try to stretch the existing resourcing of security operations. For organizations that have already started down this path, some or all of these may already be familiar.<\/p>\n\n\n\n

The first tell-tale sign automation has been pursued too early is that processes are not well-defined, leading to unexpected complexity or outcomes. Automation that results in delegating decision-making around mission-critical issues to an algorithm is inadvisable and will come unstuck the minute the computer makes a \u2018wrong\u2019 decision, for example locking down an executive\u2019s workstation at a critical time due to false detection of malicious activity. It\u2019s not just that a human needs to remain in the loop for decision-making \u2013 it\u2019s that people need to be making these critical calls, not algorithms.<\/p>\n\n\n\n

A second sign is cost and complexity hurdles. If you want to automate anything you need to have systems that interoperate. If the systems in the security operations environment use different ontologies and data formats, that poses a huge integration challenge. Also, the setup of automation itself isn\u2019t automated. Organizations need to find skilled people to work with internal domain experts to configure automated systems. Labour costs may rise with an automation program of work.<\/p>\n\n\n\n

Thirdly,\u00a0if the automation creates as many,\u00a0or more,\u00a0risks than it solves. Automation inevitably requires a high level\u00a0of authorization\u00a0so it can take administrative-level action. That action needs to be tailored; if attackers suspect predictable machine-generated responses to what they’re doing, they could find a way to exploit the automation. For example,\u00a0spoofing malicious data to cause resources to be blocked or locked as a denial of service. Automated systems with high levels\u00a0of authorization, enabled by stored credentials, are risks themselves. If they\u2019re ever compromised, an attacker will use\u00a0the authorization\u00a0against the\u00a0organization\u00a0to effect lateral movement or actions on\u00a0the\u00a0objective.<\/p>\n\n\n\n

Capability maturity, case management and collaboration<\/strong><\/p>\n\n\n\n

The use of a CMM can help organizations avoid premature use of automation, and can be used to underpin decision-making as to which parts of operations require a higher degree of human agency or involvement<\/p>\n\n\n\n

All CMMs have five distinct levels: initial, repeatable, defined, managed and optimizing. <\/p>\n\n\n\n

At the initial stage, processes may be new, undocumented and single-person dependent resulting in ad hoc execution. The immediate step is to document at least parts of the process so that they look repeatable, so they won\u2019t be performed differently each time.<\/p>\n\n\n\n

Security teams that automate prematurely often move from repeatable (level two) to optimizing (level five), skipping two important middle steps. They end up automating processes that are not yet standardized and that haven\u2019t been proven capable from repeated use over time.<\/p>\n\n\n\n

By following a CMM, teams can better define and test a process before attempting to automate it. Performing the interim steps may also lead teams in a different direction, which is likely to lead to a more judicious overall use of automation.<\/p>\n\n\n\n

A collaboration and case management solution has a part to play in this, ensuring that the more people-driven aspects of security operations are well-supported and that the workflow of human-machine elements is mapped out and understood. In these solutions, teams set up repeatable workflows and playbooks for dealing with different types of alerts or incidents.<\/p>\n\n\n\n

Detailed workflow mapping means everyone understands their contribution and the different skills of the team can be used effectively. The cognitive burden on senior responders is reduced by not having to remember everything, and less experienced team members can be more productive and independent. These process improvements lead to better, faster and more consistent security operations.<\/p>\n","protected":false},"excerpt":{"rendered":"

Vaughan Shanks,\u00a0Cydarm\u00a0CEO, says the\u00a0resourcing challenges of security operations teams are nuanced and unlikely to be substantially solved using automation alone.\u00a0 We know there\u2019s a security skills shortage. We\u2019re constantly reminded of it \u2013 the gap between supply and demand isn\u2019t closing and a high number of data breaches and ransomware incidents are occurring as a result. Automation is commonly marketed as […]<\/p>\n","protected":false},"author":50,"featured_media":21124,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3559,18],"tags":[404,3991,174,3679,264,3680],"class_list":["post-21123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-enterprise-security","tag-automation","tag-capability-maturity-model","tag-cybersecurity","tag-cydarm","tag-security-2","tag-vaughan-shanks"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/21123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/comments?post=21123"}],"version-history":[{"count":9,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/21123\/revisions"}],"predecessor-version":[{"id":21135,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/21123\/revisions\/21135"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media\/21124"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media?parent=21123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/categories?post=21123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/tags?post=21123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}