Swarm-based network attacks are still likely a couple years away, according to Derek Manky, chief of security insights and global threat alliances at FortiGuard Labs. But, especially as they start deploying 5G networks, enterprises should prepare for these types of attacks now.

FortiGuard Labs is the global threat intelligence and research team at Fortinet. In a conversation at the recent RSA Conference, Manky explained the strategy behind swarm attacks — one of the scarier emerging threats that he’s been following for a few years. “And I do think this is on the horizon,” he said.

Using swarm technology, intelligent swarms of bots can share information and learn from each other in real time. They could target a network, attacking multiple systems at the same time, and overwhelming the network because of the sheer number of attacks and speed at which they occur.

“This is a way they could weaponize it, particularly with 5G being rolled out, which means a lot of devices can communicate really quickly together and that’s when you have a swarm,” Manky said. “You have connected devices that communicate, and if you hook up an AI system to that, those devices can launch an attack on their own. It looks quite scary.”

On the bright side, organizations can still get ahead of these types of attacks, Manky said. This starts with basic cybersecurity hygiene, which, unfortunately is something many companies still struggle with. “You need a proper security architecture, segmentation,” which reduces a company’s attack surface by essentially sealing off workloads from the rest of the network, thus preventing hackers from gaining access to the wider system.

“And really, the playbook angle is something that organizations need to start looking at,” he added. “Instead of building a security architecture, or fortress, against an invisible army, it’s better to understand what threats are actually relevant to you, where are your security gaps, and then building security around it.”

To help with this, FortiGuard Labs has published four threat playbooks to date. These guides, based on FortiGuard’s threat intelligence, provide detailed information about destructive malware and threat actors including vulnerabilities they exploit and their typical targets. Companies can then use this information to create defensive playbooks, Manky said. In addition to making this threat information actionable, businesses should also look for ways to increase their response to attacks.

“So security orchestration is still valid for sure, SOAR [security orchestration, automation, and response] technologies are very good,” he said. “But also start looking at these new AI solutions that can actually take action on their own. We’ve already implemented some of this in in our security fabric.” He’s referring to the new artificial intelligence-based FortiAI product that also integrates with Fortinet’s existing security fabric. “Again, it’s not a silver bullet, but it’s a very powerful tool. It allows organizations to reduce opex so they don’t have to go and hire 10 [additional employees] when you can have AI take care of a lot of the mundane, day-to-day tasks” within a security operations center.

Collaboration and deception are two other tools that Manky says should play a prominent role in companies’ security arsenals. By collaboration he means working with groups like Cyber Threat Alliance, an organization of top security vendors including Fortinet that share threat information on a daily basis, as well as global law enforcement and government agencies like the U.S. Computer Emergency Readiness Team (CERT). “Good guys banding together to share info,” he said. “We’ve had great success off of that.”

Collaboration is part one, Manky said. “Part two is the war of deception.” This includes deploying decoys across the network that look like a companies’ existing IT and OT infrastructure to trick the attackers into revealing themselves because they can’t tell which assets are real or fake. The vendor’s FortiDeceptor automatically creates these decoys.

“Basically counterintelligence,” he said. “We’re investing a lot into threat intelligence, and we’re really starting to expose things the attackers don’t like. Not just the things they can change, like IP addresses, and URLs, but really lifting the hood of the face, finding out who they are, doing attribution, and bringing them to justice.”