Protect against phishing emails using watsonx Assistant and the IBM threat intelligence platform

In today's evolving cyberthreat landscape, phishing emails pose a formidable risk. When your employee receives and clicks on a phishing email, your entire organization can potentially be put at risk of a scam or serious malicious activity. As organizations look to enhance their cybersecurity defences, the integration of advanced technologies becomes ever more crucial.

Imagine a scenario where your personnel can take charge of validating the attributes of their received emails. By integrating IBM watsonx Assistant and technologies from IBM's threat intelligence platform, you can establish an AI Shield, a chat interface that enables your employees to check email elements such as URLs and domains. The system then verifies the safety of these elements, enabling users to assess whether the email is secure or needs to be reported to the security operations center (SOC).

Component technologies

To build your implementation of AI Shield, you'll use the following technologies:

watsonx Assistant

IBM watsonx Assistant is a market-leading, conversational artificial intelligence platform designed to help you overcome the friction of traditional support and deliver exceptional experiences to prospects, customers, and employees.

Powered by large language models (LLMs) you can trust, and an intuitive user interface, watsonx Assistant empowers your teams to build AI-powered voice agents and chatbots that deliver automated self-service support across all channels and touch-points with seamless integration to the tools that power your business.

OpenAPI

The OpenAPI Iniative establishes an open standard for describing and documenting REST APIs. An OpenAPI document defines the resources and operations that are supported by an API, including request parameters and response data, along with details such as server URLs and authentication methods.

An OpenAPI document describes a REST API in terms of paths and operations. A path identifies a particular resource that can be accessed by using the API (for example, a hotel reservation or a customer record). An operation defines a particular action that can be performed on that resource (such as creating, retrieving, updating, or deleting it).

OpenAPI specifies all of the details for each operation, including the HTTP method that is used, request parameters, the data included in the request body, and the structure of the response body.

Threat intelligence platform

IBM X-Force Exchange is a cloud-based threat intelligence platform that allows you to consume, share, and act on threat intelligence. It enables you to rapidly research the latest global security threats, aggregate actionable intelligence, consult with experts, and collaborate with peers.

AI Shield uses the IBM X-Force Exchange RESTful API, a JSON-based API that enables clients to automate queries and integrate with their systems. The API supports multiple formats, including JSON and STIX/TAXII.

Phishing tactics

Phishing emails pose a challenge to organizations because they can imitate emails from trusted sources and then cause significant damage to a company's systems and reputation. Malicious actors can try to exploit:

• Deceptive content: Phishing emails often employ deceptive tactics, mimicking legitimate communication from trusted entities such as banks, government agencies, or popular online services.
• Urgency and fear: Many phishing emails create a sense of urgency or fear to prompt immediate action.
• Social engineering: Phishing attacks often leverage social engineering techniques, exploiting human psychology to manipulate individuals into divulging sensitive information.
• Mimicking trustworthy links: Phishing emails may contain links that, at first glance, appear to lead to legitimate websites.
• Lack of security awareness: Users can unwittingly fall for phishing scams because they are not familiar with common red flags.

AI Shield workflow

Following is the series of steps that is triggered when an employee receives a suspicious email.

1. User suspicion: An employee receives a suspicious email from a sender they don't recognize or which contains a message that is prompting them to act quickly or is otherwise out of the ordinary. The employee opens the AI Shield chat window.
2. Assistant prompt: The AI Shield initiates the conversation by asking the employee which elements in the email they would like to validate, guiding them through the process.
3. User input: The employee enters the details of the email elements they want to validate, such as URLs or domains, into the chat window.
4. Custom OpenAPI extension: AI Shield, equipped with a custom extension in the OpenAPI format, translates the employee's input into actionable commands. This extension facilitates communication with the threat intelligence platform.
5. Threat intelligence validation: The AI Shield, utilizing the custom extension, validates the entered URL or domain in IBM's threat intelligence platform, including a real-time analysis to check for any potential threats or malicious indicators.
6. Result display and guidance: Following the validation process, AI Shield displays the results in the chat window. If the email is deemed safe, the employee can proceed with confidence. If there are potential threats, AI Shield advises the employee to report the email to their SOC team for further investigation.

watsonx Assistant action editor example

The following screen shows the watsonx Assistant action editor, which enables you to quickly build your own AI Shield chatbot. (For details, see Building a basic action from scratch.)

Figure: watsonx Assistant action editor

AI Shield demo

The following video demonstrates the AI Shield interface and shows how to build a custom extension that you then integrate with watsonx Assistant.

Video will open in new tab or window

Summary

AI Shield empowers users to actively engage in the email validation process. It takes advantage of the integration capabilities of watsonx Assistant and IBM's threat intelligence platform, enhancing cybersecurity by involving all employees in the security process.

With AI Shield, you are implementing an early warning system, detecting potential threats before they can do damage, and promptly alerting the SOC team to take any additional required action. The SOC team can enhance their own threat-hunting efforts by analyzing Indicators of Compromise associated with phishing attempts, further fortifying your organization's overall defense against evolving cyberthreats.

Next steps

To learn more about the technologies used to create AI Shield, see the following resources:

• IBM watsonx Assistant
• IBM X-Force