Could audio warnings augment your ability to fight off cyber attacks?

The security of your environment shouldn’t depend on whether you’re looking in the right place at the right time. While active visual means such as dashboards, emails, tickets, and chat messages are a vital part of security event monitoring, they might not get your attention if your eyes are elsewhere.

Even when you’re focused on the right screen, important events can easily get buried in an overload of information, delaying their processing, or allowing them to be overlooked entirely. Your website/web app needs a way to “speak up” when it’s under attack.

Now, imagine if potential website attacks or blocked requests announced themselves as clearly and recognizably as your phone’s custom text-tone for your best friend. As you go about your busy day, you’re always aware of the events you care about as they happen. Even if your attention was momentarily diverted from your screen, you’d get alerted in real time and could still respond quickly, saving valuable time.

To be clear, this passive, auditory type of event monitoring is currently only a theoretical capability, and will not replace active, visual means any time soon. Rather, auditory delivery of security events will evolve to become a valuable complement to the tools most security teams already rely on, adding a real-time, eyes-free dimension to the rich information and workflows currently in use, and targeting specific events so that only the most urgent or important ones trigger a sound.

When your SOC can hear hackers coming

Once proven, auditory monitoring promises valuable benefits for security teams. To begin with, new events and changes in event patterns will be identified more quickly. On an organizational level, auditory monitoring will help companies deal with the chronic talent shortage facing most security organizations. Passive alerts also make it possible to scale event monitoring coverage among analysts, while ensuring that nothing falls through the cracks.

In addition, auditory monitoring has the potential to expand cybersecurity careers for people with visual impairments. Finally, non-analysts such as senior security personnel, who don’t ordinarily participate in monitoring, will be able to keep their ears open to the most critical events. In fact, passive monitoring may even be delegated beyond the confines of the security operations center and its teams, enabling operations teams, developers, and management to play an “if you hear something, say something”-type role in security.

What would this approach look like—or sound like—in practice? Here are a few examples of how companies could leverage audible alerts for their web apps:

• SOC analysts sifting through system logs in Splunk could be alerted with a buzz if there’s an increase of injection attack activity, such as XSS, SQLi, code injection, and so on.
• Managers tied up in meetings throughout the day could hear a chime from their laptop if a new round of credential stuffing attacks begins.
• DevOps teams concerned about new deployments running smoothly could hear a chirp if application errors occur.

In some scenarios, the sound alone might be all the information they need; for others, the nearest screen could fill in additional details. For added certainty, alerts could be configured to repeat periodically at intervals that correspond to their urgency, until cleared manually. However you implement it, auditory monitoring can bring an entirely new sensory realm into play that could help cut through the overload of visual information found in many IT settings.

A handful of open source projects are already experimenting with audible monitoring. Specific to cybersecurity, one project uses sound to identify network traffic patterns such as ICMP pings and UDP/TCP port scans, and another uses sounds to identify specific events from web application firewall event logs.

Beyond the screen

Computing has centered on visual displays for so long that screens can seem like the definitive way to present monitoring information, but this is far from true. Voice assistants and other non-visual media are transforming the way consumers interact with their apps and devices, and it’s easy to imagine a future where sound-based interaction is the norm for many use cases.

There will always be a need for the kind of detail, drill-down interactivity, and at-a-glance historical depth that only a display can provide, but as technologists increasingly think beyond the pixel, there’s tremendous potential for new ways to deliver timely information in auditory form. The simplest, briefest sound can be highly effective for capturing attention in situations where every minute counts, even in the hectic setting of a SOC.

If not applied appropriately, though, the auditory approach could become ineffective. Just as analysts can be overloaded with standard alerts, they could be overloaded with audible alerts. Perhaps not just overloaded, but even irritated to the point of disabling alerts altogether. To avoid the possible irritation overload, audible alerting should be targeted for meaningful or high valued events. In addition, ensure the sounds you select are not obnoxious to your office neighbors.

For now, auditory security event monitoring remains an experimental concept to be explored, but it’s worth paying close attention to the projects and pilots it spawns. As the speed and intensity of attacks continue to grow, the ability to hear your web app’s “cries for help” could make all the difference.