Automating the Security Follow-Up
Security monitoring produces a steady stream of alerts, and a large share of them turn out to be benign. Engineers running sudo -i or nmap are common sources of false positives. But ignoring those alerts altogether sets a dangerous precedent. The challenge is that each alert involving a person requires a member of the security team to manually reach out and verify the activity, which can quickly become overwhelming.
A year ago, Slack tackled this problem by building an automated system to reach out to employees and send aggregated results back to the security team. Inspired by that approach, Dropbox set out to build a similar system of its own. The result is Securitybot, an automated, distributed alerting tool that has been in use at Dropbox and is now being released as an open source project.
Reducing Manual Work for Security Engineers
Manually confirming actions with employees was one of the most time-consuming parts of incident detection. Despite significant effort on reach-outs, some alerts still went without follow-up. The goal was to build a system that could reach more users while freeing up security engineers to focus on other work, such as building better detection tools and proactive threat hunting.
Securitybot slots into the alert detection chain. When an alert fires, the bot messages the employee who triggered it and asks them to confirm whether the action was intentional. The response is logged and later delivered to the security team along with alert rollups. If an employee says they did not perform the action, the security team is alerted immediately. This separate handling of confirmed false positives from genuine incidents is what focuses the security team's attention on what actually requires prompt follow-up.
A Modular Design
The core design keeps the key ideas from Slack's approach: Securitybot is connected to detection and alerting infrastructure as well as the company-wide Slack instance. When an alert is received, the bot contacts the employee who triggered it and logs the response. However, the implementation was designed to be modular and reusable—if Dropbox ever switches chat platforms or monitoring systems, the core code should not need a rewrite.
Securitybot operates through a set of core functions that interact with monitoring and communication systems via simple, composable plugins. The bot polls for new alerts, logs each one, and queues a message for the person who triggered it. When responses come back, they are returned to the monitoring system so they appear alongside the original alerts for review.
User interaction is designed to be quick and straightforward. For each alert, employees are asked only whether they triggered it and for a brief explanation. Responses are protected with two-factor authentication, so even a compromised Slack account could not fool the bot.
The bot also includes a "snooze" feature to avoid pestering employees. If someone is flagged for running sudo, they are likely to run it again soon. Rather than sending a message every time, Securitybot holds off for a period of time, on the assumption that repeated commands in the same context are coming from the same person.
Some effort also went into making the interaction pleasant. A polite, cordial tone—rather than a blunt, robotic one—kept the bot from feeling like a nag, and Dropbox found that giving the bot a bit of personality shifted it from annoying to endearing.
Results
Securitybot has delivered two clear benefits at Dropbox. False positives are resolved without manual outreach, and possible incidents are escalated immediately. That has let security engineers spend less time pinging colleagues and more time on foundation-level security work.
The bot also benefits employees beyond the security team. Responding to a chat bot is less burdensome than replying to a security engineer, and it lets Dropbox watch for anomalous activity on more than just production systems—the bot can flag unusual events in employee email, Dropbox accounts, and laptops.
Open Sourcing Securitybot
Dropbox has made the Securitybot code openly available on GitHub. It is, to the company's knowledge, the only open source project to automatically confirm and aggregate suspicious behavior with employees at distributed scale. The hope is that other teams can use the implementation to improve their own internal detection and get distributed security running more quickly, and that the security community will contribute improvements to the code. Although Securitybot is used for internal monitoring at Dropbox, the same system could conceivably be adapted for user-facing detection as well. At minimum, it gives other teams a starting point for building similar tools.
