Gartner：ChatGPT如何改进安全操作（英文版）

TechnicalInsights:How

ChatGPTCanImproveSecurityOperations

DennisXu

©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.Thispublicationmaynotbereproducedordistributedinanyform

withoutGartner'spriorwrittenpermission.ItconsistsoftheopinionsofGartner'sresearchorganization,whichshouldnotbeconstruedasstatementsoffact.Whiletheinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable,Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformation.AlthoughGartnerresearchmayaddresslegalandfinancialissues,Gartnerdoesnotprovidelegalorinvestmentadviceanditsresearchshouldnotbeconstruedorusedassuch.YouraccessanduseofthispublicationaregovernedbyGartner’sUsagePolicy.Gartnerpridesitselfonitsreputationforindependenceandobjectivity.Itsresearchisproducedindependentlybyitsresearchorganizationwithoutinputor

influencefromanythirdparty.Forfurtherinformation,see"GuidingPrinciplesonIndependenceandObjectivity."

2023

Incand/oritsaffiliates

reservedGartnerisaregisteredtrademarkofGartner,anditsaffiliates

Agenda

1WhatIsGenerativeAI?

2WhatIsChatGPT?

3ChatGPTRisks

4UnderstandingWhereItFitsinSecOps

5SampleSecOpsUseCases

6PlanningforChatGPTUsageinSecOps

7TheFutureofChatGPTandSecOps

QuickIntroduction

toChatGPT

4©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

GPTmodelsaretransformer-based

deeplearningneural

networkarchitectures.

5©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhatIsGenerativeAI?

ChatGPT

AnOpenAIservicethatincorporatesaconversationalchatbotwithLLMtocreatecontent.Itwastrainedonafoundational

modelofbillionsofwordsfrommultiplesourcesandwasthenfine-tunedbyreinforcementlearningfromhumanfeedback.

LargeLanguageModels(LLM)

FoundationModels

GenerativeAI(GAI)

AIthatistrainedonvastamountsoftexttointerpretandgeneratehuman-liketextualoutput.

Largemachinelearningmodels.Theyaretrainedonabroadsetofunlabeleddata,adaptedtoawiderangeofapplicationswithfine-tuning.

AItechniquesthatlearnfromarepresentationofartifacts

fromdataandmodelswhichitusestogeneratenewartifacts.

Source:Gartner

6©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhatIsChatGPT?

ChatGPT

GPT-3

Prompt

Whatsecurityoperation

centertaskscanChatGPThelpwith?

7©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhatIsChatGPT?(Continued)

Textinput/output

Inputfilteringandprompt

preparation

(andconversation)

Outputacceptabilityfilteringandconversationpreparation

Sessioncontext

ClosedGPT-3model

Reinforcementlearningandhumanfeedbacktraining

RLHF

ClosedversionofGPT-3trainingdataandprocess

8©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

ChatGPTRisks

Note:ExamplesinthispresentationweregeneratedusingOpenAI’sGPT-3.5andareforillustrativepurposes

only.GPT-4isavailableforChatGPTbutisonlyavailablewithaChatGPTPlussubscriptioncurrently.

9©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

WhereChatGPTFits

WithSecOpsand

SampleUseCases

10©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

?

HowDoesChatGPTFitIntoSecOps?

•DetectionEngineering

•IncidentResponse

•VulnerabilityManagement

•AttackSurfaceManagement

凸

•Training

•OperationalizinganSOC

•MeasuringanSOC

SOC=SecurityOperationCenter

11©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleUseCases:

DetectionEngineering

Analyzethislogmessage:

May116:17:43owl

sshd[9024]:Acceptedpublickeyforroot

from

01

port37384ssh2

12©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.andits

SampleUseCases:

DetectionEngineering

Createregular

expressionstoparsethislogmessage.

Validation:Useatoollike

/

toshowthatregexsuggestionswillparsethelog.

13©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleUseCases:

DetectionEngineering

Createasigmarulethatwilldetect

bruteforceloginattempts

onWindows.

Validation:UseUncoder.IOtoValidateSigmaRules

14©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

Turnthis

sigma

ruleintoaSplunkquery.

Validation:Thiscanbemoredifficulttovalidate,butitispossiblewith

simulatingloginfailures.

15©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.Gartner

SampleSecOpsUseCases—IncidentResponse

•ScriptUnderstanding

•Examples:

•Analyzethefollowingscript:<code>

•Doesthefollowingcodehaveanyvulnerabilities:<code>

•Validation:PeopleandProcess

•ResponsePlaybookCreation

•Examples:

•Createastep-by-stepplaybookonhowtoinvestigateransomwareonWindows

•Createastep-by-stepplaybook,withtoolsandcommandstorun,onhowtoinvestigateransomwareonWindows

•Validation:PeopleandProcess

16©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleSecOpsUseCases—IncidentResponse

•IncidentInvestigationAdvice

•Examples:

•Givenanincidentwith<incident_title>,andincidentdescriptionof<incident_description>,howwouldyousuggestgoingaboutinvestigatingthissituation?

•Validation:PeopleandProcess

17©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

SampleSecOpsUseCases—Training

•TabletopScenarioGeneration

•Examples:

•Createatabletopcybersecurityexercisethatincludesanationstatetryingtohackintoafinancialinstitution

•Validation:People

•NewSecurityAnalysisGuidance

•Examples:

•Helpmeunderstandhowtoanalyzelogdataforsignsofintrusion

•Validation:PeopleandProcess

18©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

Planningfor

ChatGPTUsage

19©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsageinSecOps—

ResetExpectations

•CanMakeUpThings,“Hallucinations”

•NoSilverBullet

•ItCan’tConnecttotheInternet

•Security,PrivacyandGovernanceAreImportant

•DeterminingAccuracyIsNotEasy

–RequiresExperiencedAnalysisofResults

•GeneratesaStartingPoint

20©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsagein

SecOps—Governance

•EstablishProperUsageRules

–GiveUsersTraining

–OnlySeniorStaffCanUseIt

–JuniorStaffCanUseItUnderSupervision

21©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsageinSecOps—

Governance(Cont’d)

•DefineDataSanitizationStandards–PII

–PHI

–IPAddresses

–Usernames

–Geolocations

PII=PersonallyIdentifiableInformationPHI=ProtectedHealthInformation

22©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsage

—PickUseCases(UCs)

•IdentifyyourcommonSecOpsUCs—donotpicktime-sensitiveones

•IdentifyUCsnotdependentonsensitiveorcorporatedata

–UseOpenAI’sChatGPTforexperimentation

•RefineUCs,possiblyusingpromptengineering

AllrightsreservedGartnerisa

trademarkofGartner,Incanditsaffiliates

PlanningforChatGPTUsageinSecOps—

EstablishOversight/Monitoring

•MentorandMonitorJuniorStaff

–ReviewWorkLogs,Reports,etc.

•TrackAccuracy

–CreateKnowledgeBaseof

ChatGPTPromptsandResponsesWithAccuracyAssessment

–RefineUseCasesasNeeded,PromptEngineering

24©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsagein

SecOps—ValidateResults

•EstablishaValidationMindset

•IdentifyToolstoAidinValidation

–People

–Process

–Technology

•ContinuallyValidateResults,EarlyandOften

25©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

PlanningforChatGPTUsageinSecOps—Putting

ItAllTogether

IdentifyYourSecOpsUCs

Noncorporate-SpecificUCs

RefineUCs

EstablishProperUsageRules

EstablishDataSanitizationStandards

Establish

ValidationMindset

IdentifyToolstoAidinValidation

Continually

ValidateResults

MentorJuniorStaff

MonitorJuniorStaff

TrackAccuracy,RefineUCs

EstablishOversight/Monitoring

EstablishSomeGovernance

Reset

Expectations

PickUseCases(UC)

ValidateResults

NoSilverBullet

ItCan’tConnecttotheInternet

CanMakeUp

Things,

“Hallucinations”

Determining

AccuracyIsNot

Easy

GeneratesaStartingPoint

26©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

FutureofChatGPT

andSecOps,andCommonPitfalls

27©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

TheFutureofChatGPTandSecOps

•ItWillGetBetterOverTime

•WatchforGenerativeAIFromExistingProviders

•MoveAwayFromChatGPTInterfaceandTowardNativeVendorIntegration,e.g.,

MicrosoftSecurityCopilot,andSoOn

•DemocratizationofSecOps

•HelpReduceMTTR,PossiblyMTTD

•GenerateThreat-HuntingHypotheses

MTTR=MeanTimetoRecoverMTTD=MeanTimetoDetect

Pitfalls

•ExposingPrivate/SensitiveDatainChatGPTInterface

•JumpinginRatherThanExecutingaPhasedApproach

•NotValidatingResults

•UsingTime-SensitiveorReal-TimeUseCases

29©2023Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.anditsaffiliates.

Recommendations

oEstablishagovernanceandoversightprocessforthe