Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
The Promise and Reality of Cloud SecurityCloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises.
The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
User Rank: Author
9/29/2014 | 4:58:39 PM
creating the core, shared data model as ive described above (and storing data in it, analyzing it) is just the beginning. it isnt even necesary to look outside for a formal framework. in fact, just adding key fields and relationships to related data sets can be even more effective in an in-house solution that, for example, groups types of malware with simple, high-level incident reponse and triage procedures to serve as first-pass recipe system for moving out quickly when new malware beomes active malware.
we have seen big successes where organizations begin to track types of as-yet-unseen malware in and aorund them be able to react more quicky with mitigation by also tracking (simply, of course) what has been done in the past for similar problems. we use a simple "Polarity" metric attached to all our Actor-Target-Effect-Practice tuples, if you will, that map positive, negative or neutral to things like "security research" or "security solution" (as seen here).
this allows for quick sorting and filtering data to isolate things that may be not be active yet or may be the solution side of a problem you didnt yet know you have. what's more, it makes it easy to matrix these items into exploit knowledge bases or in-house incident respone recipes too. it's also great for surfacing to management in a way that tells them what may be out there too and show quantitatively what portion of your strategy these kinds of things occupy. simple data models can be very powerful when extended the right way and when data is collected diligently. not always a need to look outside for a solution either.