Gamania CloudForce SOC combined with AI joint defense can accelerate the interception of hacker attacks, turning the weapon against its owner, and countering AI attacks of enemies

When we look back at the past year (2017) with the raging Internet of Things (IoT) attacks and the ransomware virus, many business owners or IT administrators have become quite alarmed. When we look into 2018, experts expect the two previously mentioned threats to continue to cause chaos because whether it is the creating of IoT zombies or crypto-ransomware, there are temptations that are difficult to give up for hackers; but these are not the only troubles that enterprises face.

The director of the information technology department at Gamania CloudForce, Wei-chiang Huang thinks that there is another major potential threat in 2018 where attackers started to combine artificial intelligence (AI) and machine learning (ML) technologies with existing hacking tools, and are now able to uncover vulnerabilities automatically, generate attack scripts and malicious program codes automatically, and launch surprise attacks to the targets. The defender is like fighting against a machine and has almost no chance of winning. Being in an era with many information security problems, having enterprises import third-party SOC (Security Operations Center) monitoring services at the right time is undoubtedly the best solution.

Gamania CloudForce, which is formally the IDC, information security and IT business departments of a certain famous large online game company, has experiences in the attacks and defenses of information security; it understands the attack patterns and techniques of hackers, has the ability to develop and operate SIEM (Security Information and Event Management) platforms, and knows how to write the most effective association rules. Therefore, even though it only started to transform from in-house to external services in 2014, it is still a high-profile SOC pioneer. Last year, it was awarded Class A Evaluation by the National Center for Cyber Security Technology.

Gamania CloudForce is not complacent with its SOC service energy, and has officially started cooperating with CYCARRIER Technology to import AI defense tools, hoping to turn the weapon against its owner and countering the AI attacks of the enemies, using the fastest speed to learn the attack techniques and routes of hackers and the information they want to steal, helping enterprises turn crisis into safety in real-time.

Having the background of party A and have rich hacker attack and defense experiences

Wei-chiang Huang stated that the attack techniques of hackers are evolving every day, forcing enterprises to keep deploying multiple defense equipment, but at the same time they also lack corresponding diversified talents who can perform optimal configurations and adjustments for these equipment, resulting in enterprises unable to achieve the goals of real-time discovery and complete protection. Sadly, there is a shortage of information security talents in Taiwan, and it is difficult for enterprises to recruit professional talents; they can only depend on the strength of SOC services to help monitor enemy trails and quickly build perfect information security deployments.

He went on and said in past services from online game companies, they have always did everything themselves; not only did they build their own IDCs and maintained thousands of servers, they also developed their own log analysis platform that can fully and accurately manage the large amounts of equipment logs in order to detect suspicious signs and stop hackers from stealing on time. But now, the role of Gamania CloudForce has changed from “party A” to “party B,” and third-party SIEM products (Micro Focus ArcSight) was imported to satisfy the needs of the many customers properly; even through the SOC core platform has transformed, but the attack and defense experiences accumulated from the past party A position are still very useful, and assisted in the development of many peripheral auxiliary software that allowed SIEM to demonstrate more rigorous monitoring strength, uncovering abnormal signs from unremarkable and subtle appearances time after time, eliminating information security disasters that may have been caused.

Imported AI defense tools and vastly reduced the processes for event processing

However, the skills of hackers are becoming more and more sophisticated; traditional SOC that only focused on the log analysis mode of gateway terminals or information security equipment terminals clearly fell behind. All it can actually do is post-mortem audit and it is unable to play the role of a guard that can discover intrusions in real-time.

Gamania CloudForce set AI as the next stage of development focus last year because it thinks that only by working on the intelligent analysis of endpoints can the insufficiencies of traditional SOC mechanisms be made up, detect hidden malicious programs and learn their propagation effectively. This business philosophy was in-line with Cycarrier that focused on developing new generation information security automation technologies and AI analysis platforms. Therefore, both parties established a cooperation consensus last year and placed efforts and energy into one another to actively promote technical exchange, and successfully reinforced the insufficiencies of traditional SOC. It was then converted into an external service item and now POC demands were received from SOC users.

Wei-chiang Huang further explained that SOC not only bears the heavy responsibility of information security monitoring, it also has another critical mission, and that is “event processing.” When monitoring systems detect suspected intrusion, SOC must clarify key information such as which viruses or backdoor programs did hackers send, the infection path and the information they are attempting to steal etc. within the shortest time, and use this information to capture the hacker and fix loopholes, reducing the damages to a minimum. Traditionally, SOC operators had to mobilize a lot of manpower and spend a lot of time to see the clue from the complicated logs, and the operation speed was not ideal. But now with the help of AI systems, the experiences of forensic personnel can now be converted into operating rules of machines and use human-machine collaborative analysis to vastly reduce event investigation schedule and find out the truth sooner.

When we talk about the advantages of Gamania CloudForce over SOC allies, first of all it has party A experiences that rarely any other peers have, so its delicateness or focus on interpreting information security events will be quite unique. Secondly, it provides a complete penetration test (PT), vulnerability assessment and social engineering drill services, especially on the PT aspect. The Gamania CloudForce team has always been good at simulating hacker thinking to provide outstanding PT service and help users find vulnerabilities that hackers might use for intrusion; but now the destructive force of hackers has increased exponentially, and they have more diversified methods to intrude into enterprises; this is why Gamania CloudForce proposed the “post-PT” concept, assuming that hackers have already intruded the intranet of enterprises and analyzing which servers they might want to take over and what information they might want to steal, to help enterprises strengthen crisis control.

In other words, Gamania CloudForce can provide enterprises with two stages of penetration tests; first use PT to simulate how thieves can break into the house to steal something, and then use post-PT to deduce what level of losses might be caused after the thief has entered the house, allowing enterprises to combine and use the test results of the two stages to uncover defense weaknesses that they never knew about and further reinforcing them.

Also, Gamania CloudForce is formed by three major teams: IDC, information security and IT. Not only does it have information security strengths, it can also respond to other information management items that users do not know enough about and provide reinforcement suggestions when needed. Finally, Gamania CloudForce holds information security community seminars regularly; not for marketing products, but to invite customers, clubs or students to participate for free, and guide them to listen to the insights that information security experts share and to converse and exchange with these experts, hoping to creating a good learning environment to help cultivate information security talents in Taiwan.