Cyber threats continue unabated. Enterprise cyber security teams struggle against the relentless onslaught of ever-evolving attacks. The reason is cyber security falling behind the advances threat actors have attained.

Traditional network security is static. It focuses on protecting the network perimeter. It deploys firewalls and antivirus that match network traffic with static malware signatures.

Such an approach has become vulnerable to today’s sophisticated attacks. Attackers now use AI to generate new malware variants that bypass signature-based detection. These approaches have anyway become obsolete to protect today’s complex and spread-out IT environments.

Of late, adaptive threat protection (ATP) has started to find favour as an effective approach to thwart cyber threats.

What is Adaptive Threat Protection (ATP)?

Adaptive Threat Protection is a new flexible, scalable, and resilient approach to security. It deploys appropriate strategies to detect, pre-empt and respond to evolving threats, fast. 

ATP shifts the security approach from being event-centric to risk-centric. It makes the enterprise network security more robust and potent through:

• Dynamic risk assessment and threat detection. ATP co-opts AI for real-time risk assessment and threat detection across the network.
• Robust integrations and controls. ATP integrates the security infrastructure to enable consistent policies and approaches. The integrated approach also makes the security approaches scalable and flexible. Accommodating new users, devices, and technologies becomes easy and risk-free. Compliance also improves.
• Automated threat detection and response. Automated policies adjust security measures according to the threat landscape. Machine learning algorithms initiate immediate and accurate responses.

Dynamic Risk Assessment and Threat Detection

ATP enables dynamic risk assessments and threat detection. It deploys AI-powered network monitoring and behavioural analytics for the purpose.

Traditional network security tries to keep threats out of the network. Adaptive security works under the premise that malicious activity takes place in the system.  AI-powered continuous network monitoring and behaviour analysis identifies potential threats. These tools also nip such issues in the bud before they escalate and cause significant damage.

The Role of Machine Learning Algorithms

Adaptive threat analytics use machine learning to establish normal, legitimate communication patterns.  The algorithms analyse network traffic, user behaviour, and system logs to detect anomalies. It creates user profiles, considering normal login and file access patterns and other footprints.

Analysing historical data makes it easy to identify deviations from normal patterns. Deviations from normal patterns or user profiles trigger alerts. For instance, Consider a scenario where a user starts accessing files they usually do not need or use. The algorithms check if there is any change in the profile or other circumstances for the user to access such files. If not, it triggers potential malicious activity. Likewise, unusual network connections or email attachments raise red flags.

Advanced analytics detect security breaches that would not be obvious by monitoring the system alone.

The Role of Threat Intelligence Feeds

Threat intelligence feeds expand the threat detection capabilities of ATP tools.

Threat intelligence feeds make explicit the latest security-related trends and attacker tactics. Up-to-date threat intelligence information enables ATP tools to:

• Prioritise dealing with the most deadly and live threats first.
• Identify compromised systems and devices.
• Revamp system architecture to block loopholes.

Threat intelligence also enables risk and reputation analysis.  Risk and reputation analysis tools use threat intelligence to assess the motives and risks posed by any network entity. These tools assess their historical behaviour and previous activities and draw risk profiles. For instance, it evaluates the risk associated with specific websites or IP addresses. The tool creates risk scores depending on factors such as the likelihood of an attack and the potential impact.

ProofPoint’s threat intelligence feeds offer an illustration of how comprehensive threat intelligence can make a difference to security. These verified threat intelligence feeds include proof of conviction, historical data on 40+ threat categories, and related samples.

Robust Integrations and Controls

ATP is not a single system or process.

Rather, it mandates a flexible, integrated architecture comprising various tools and technologies. ATP interconnect devices and security deployments, to enable coordinated threat management, at scale.

The key components of the integrated approach mandated by ATP include:

• Flexible deployments: Flexible deployments allow near-infinite adaptability to changing threats and network conditions. For instance, low-cost firewalls, deployed as sensors throughout the network, share intelligence. Such inputs pave the way for real-time policy enforcement.
• Fine-tuning security policies as per the environment: ATP systems evolve. It adapts to the business needs and the specific threats in the network environment. Network admins can adjust data security policies based on the risk, to maintain optimal network performance.
• Access controls. The identity and access control layer regulates access to network resources. Robust authentication and authorization limit access only to legitimate users.
• Encryption: Encrypting data in transit and at rest offers an extra layer of protection.
• Endpoint protection. At endpoints, anti-malware software and firewalls continue to thwart malicious traffic. These devices also prevent the lateral movement of malware. ATP feeds populate security policies in the event of an intrusion or a malware outbreak.

The flexibility of ATP systems to co-opt the latest technologies makes it future-proof. The platform remains relevant and effective by co-opting new tools and methods to counter new threats. 

Deploying Zero Trust along with ATP makes the network even more robust and secure. For instance, segmentation, the core component of Zero Trust,  shrinks the size of the attack surface and limits the damage.

Automated Threat Detection and Responses

ATP solutions automate threat detection and responses.

Automation eliminates manual touchpoints and delivers a frictionless implementation process, with reduced false-positives.

Security Information and event management (SIEM) tools aggregate and analyse security data. It triggers alerts on sensing security incidents, enabling swift responses.

The common responses include:

• Blocking malicious traffic. Most ATP tools can immediately contain, block, or clean specific files, depending on threat reputation and risk.
• Quarantining infected systems.   ATP tools use sandboxing to isolate suspicious files. These files then undergo analysis in a controlled environment.

Automation tools perform routine security tasks, such as network audits and policy enforcement. This leaves security teams with more free time to focus on higher-level tasks.  Automation also lowers operational costs.

The benefits of ATP go much beyond real-time threat assessment and remediation though. ATP allows cyber defences to neutralise even the most advanced and sophisticated threats. Network security becomes faster, more accurate, and more efficient.

But these benefits come only when the tools deployed are up to the task.

The effectiveness of AI-powered ATP tools depends on the training received by the models. The trick is to use large datasets of normal and malicious activities. Training models using such data make the tools capable of identifying malicious traffic with high accuracy. AI’s self-learning capabilities mean the live data from every engagement betters the prediction. Feedback loops further improve the accuracy of models over time.

The Proofpoint platform, trained in 22 trillion potential payloads, protects the network against all threats, every time, regardless of the environment. Proofpoint’s Nexus AI illustrates the use of AI in delivering ATP. The AI-powered Proofpoint platform co-opts semantic understanding, computer vision, sandboxing, click-time protection, and more.