Gartner：ChatGPT如何改進(jìn)安全操作（英文版）

TechnicalInsights:How

ChatGPTCanImproveSecurityOperations

DennisXu

?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Thispublicationmaynotbereproducedordistributedinanyform

withoutGartner'spriorwrittenpermission.ItconsistsoftheopinionsofGartner'sresearchorganization,whichshouldnotbeconstruedasstatementsoffact.Whiletheinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable,Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformation.AlthoughGartnerresearchmayaddresslegalandfinancialissues,Gartnerdoesnotprovidelegalorinvestmentadviceanditsresearchshouldnotbeconstruedorusedassuch.YouraccessanduseofthispublicationaregovernedbyGartner’sUsagePolicy.Gartnerpridesitselfonitsreputationforindependenceandobjectivity.Itsresearchisproducedindependentlybyitsresearchorganizationwithoutinputor

influencefromanythirdparty.Forfurtherinformation,see"GuidingPrinciplesonIndependenceandObjectivity."

2023

Incand/oritsaffiliates

reservedGartnerisaregisteredtrademarkofGartner,anditsaffiliates

Agenda

1WhatIsGenerativeAI?

2WhatIsChatGPT?

3ChatGPTRisks

4UnderstandingWhereItFitsinSecOps

5SampleSecOpsUseCases

6PlanningforChatGPTUsageinSecOps

7TheFutureofChatGPTandSecOps

QuickIntroduction

toChatGPT

4?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

GPTmodelsaretransformer-based

deeplearningneural

networkarchitectures.

5?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhatIsGenerativeAI?

ChatGPT

AnOpenAIservicethatincorporatesaconversationalchatbotwithLLMtocreatecontent.Itwastrainedonafoundational

modelofbillionsofwordsfrommultiplesourcesandwasthenfine-tunedbyreinforcementlearningfromhumanfeedback.

LargeLanguageModels(LLM)

FoundationModels

GenerativeAI(GAI)

AIthatistrainedonvastamountsoftexttointerpretandgeneratehuman-liketextualoutput.

Largemachinelearningmodels.Theyaretrainedonabroadsetofunlabeleddata,adaptedtoawiderangeofapplicationswithfine-tuning.

AItechniquesthatlearnfromarepresentationofartifacts

fromdataandmodelswhichitusestogeneratenewartifacts.

Source:Gartner

6?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhatIsChatGPT?

ChatGPT

GPT-3

Prompt

Whatsecurityoperation

centertaskscanChatGPThelpwith?

7?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhatIsChatGPT?(Continued)

Textinput/output

Inputfilteringandprompt

preparation

(andconversation)

Outputacceptabilityfilteringandconversationpreparation

Sessioncontext

ClosedGPT-3model

Reinforcementlearningandhumanfeedbacktraining

RLHF

ClosedversionofGPT-3trainingdataandprocess

8?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

ChatGPTRisks

Note:ExamplesinthispresentationweregeneratedusingOpenAI’sGPT-3.5andareforillustrativepurposes

only.GPT-4isavailableforChatGPTbutisonlyavailablewithaChatGPTPlussubscriptioncurrently.

9?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhereChatGPTFits

WithSecOpsand

SampleUseCases

10?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

?

HowDoesChatGPTFitIntoSecOps?

?DetectionEngineering

?IncidentResponse

?VulnerabilityManagement

?AttackSurfaceManagement

凸

?Training

?OperationalizinganSOC

?MeasuringanSOC

SOC=SecurityOperationCenter

11?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleUseCases:

DetectionEngineering

Analyzethislogmessage:

May116:17:43owl

sshd[9024]:Acceptedpublickeyforroot

from

01

port37384ssh2

12?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.andits

SampleUseCases:

DetectionEngineering

Createregular

expressionstoparsethislogmessage.

Validation:Useatoollike

/

toshowthatregexsuggestionswillparsethelog.

13?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleUseCases:

DetectionEngineering

Createasigmarulethatwilldetect

bruteforceloginattempts

onWindows.

Validation:UseUncoder.IOtoValidateSigmaRules

14?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

Turnthis

sigma

ruleintoaSplunkquery.

Validation:Thiscanbemoredifficulttovalidate,butitispossiblewith

simulatingloginfailures.

15?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.Gartner

SampleSecOpsUseCases—IncidentResponse

?ScriptUnderstanding

?Examples:

?Analyzethefollowingscript:<code>

?Doesthefollowingcodehaveanyvulnerabilities:<code>

?Validation:PeopleandProcess

?ResponsePlaybookCreation

?Examples:

?Createastep-by-stepplaybookonhowtoinvestigateransomwareonWindows

?Createastep-by-stepplaybook,withtoolsandcommandstorun,onhowtoinvestigateransomwareonWindows

?Validation:PeopleandProcess

16?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleSecOpsUseCases—IncidentResponse

?IncidentInvestigationAdvice

?Examples:

?Givenanincidentwith<incident_title>,andincidentdescriptionof<incident_description>,howwouldyousuggestgoingaboutinvestigatingthissituation?

?Validation:PeopleandProcess

17?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleSecOpsUseCases—Training

?TabletopScenarioGeneration

?Examples:

?Createatabletopcybersecurityexercisethatincludesanationstatetryingtohackintoafinancialinstitution

?Validation:People

?NewSecurityAnalysisGuidance

?Examples:

?Helpmeunderstandhowtoanalyzelogdataforsignsofintrusion

?Validation:PeopleandProcess

18?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

Planningfor

ChatGPTUsage

19?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsageinSecOps—

ResetExpectations

?CanMakeUpThings,“Hallucinations”

?NoSilverBullet

?ItCan’tConnecttotheInternet

?Security,PrivacyandGovernanceAreImportant

?DeterminingAccuracyIsNotEasy

–RequiresExperiencedAnalysisofResults

?GeneratesaStartingPoint

20?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsagein

SecOps—Governance

?EstablishProperUsageRules

–GiveUsersTraining

–OnlySeniorStaffCanUseIt

–JuniorStaffCanUseItUnderSupervision

21?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsageinSecOps—

Governance(Cont’d)

?DefineDataSanitizationStandards–PII

–PHI

–IPAddresses

–Usernames

–Geolocations

PII=PersonallyIdentifiableInformationPHI=ProtectedHealthInformation

22?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsage

—PickUseCases(UCs)

?IdentifyyourcommonSecOpsUCs—donotpicktime-sensitiveones

?IdentifyUCsnotdependentonsensitiveorcorporatedata

–UseOpenAI’sChatGPTforexperimentation

?RefineUCs,possiblyusingpromptengineering

AllrightsreservedGartnerisa

trademarkofGartner,Incanditsaffiliates

PlanningforChatGPTUsageinSecOps—

EstablishOversight/Monitoring

?MentorandMonitorJuniorStaff

–ReviewWorkLogs,Reports,etc.

?TrackAccuracy

–CreateKnowledgeBaseof

ChatGPTPromptsandResponsesWithAccuracyAssessment

–RefineUseCasesasNeeded,PromptEngineering

24?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsagein

SecOps—ValidateResults

?EstablishaValidationMindset

?IdentifyToolstoAidinValidation

–People

–Process

–Technology

?ContinuallyValidateResults,EarlyandOften

25?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsageinSecOps—Putting

ItAllTogether

IdentifyYourSecOpsUCs

Noncorporate-SpecificUCs

RefineUCs

EstablishProperUsageRules

EstablishDataSanitizationStandards

Establish

ValidationMindset

IdentifyToolstoAidinValidation

Continually

ValidateResults

MentorJuniorStaff

MonitorJuniorStaff

TrackAccuracy,RefineUCs

EstablishOversight/Monitoring

EstablishSomeGovernance

Reset

Expectations

PickUseCases(UC)

ValidateResults

NoSilverBullet

ItCan’tConnecttotheInternet

CanMakeUp

Things,

“Hallucinations”

Determining

AccuracyIsNot

Easy

GeneratesaStartingPoint

26?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

FutureofChatGPT

andSecOps,andCommonPitfalls

27?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

TheFutureofChatGPTandSecOps

?ItWillGetBetterOverTime

?WatchforGenerativeAIFromExistingProviders

?MoveAwayFromChatGPTInterfaceandTowardNativeVendorIntegration,e.g.,

MicrosoftSecurityCopilot,andSoOn

?DemocratizationofSecOps

?HelpReduceMTTR,PossiblyMTTD

?GenerateThreat-HuntingHypotheses

MTTR=MeanTimetoRecoverMTTD=MeanTimetoDetect

Pitfalls

?ExposingPrivate/SensitiveDatainChatGPTInterface

?JumpinginRatherThanExecutingaPhasedApproach

?NotValidatingResults

?UsingTime-SensitiveorReal-TimeUseCases

29?2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

Recommendations

oEstablishagovernanceandoversightprocessforthe