5 Ways to Better Use Data in Security
Use these five tips to get your security shop thinking more strategically about data.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt832c9530fe6e157b/64f0d6bb47a6e30811e342dd/CoverArtSlide1.jpg?width=700&auto=webp&quality=80&disable=upscale)
The current silo-style organization of threat researchers reviewing logs in one place, threat hunters in another, and the data scientists in yet another silo working on algorithms, just doesn't cut it anymore with today's security threats.
Security teams need to get smarter with how they use and manage all types of data. That's because the lines between pure infosec data (Web logs, threat intelligence) versus other business data have become increasingly blurred. A piece of Web log data, for example, could be just as easily used to identify attackers as it could to optimize the customer experience. The same holds true for business data as well.
They need data science tools to detect threats, and the data scientists coming up with the algorithms have to work much more closely with threat hunters and threat researchers, experts say.
"I think security pros are becoming more like data scientists," says John Omernik, distinguished technologist at MapR. "But we can't have data science for data science's sake: We have to apply these new algorithms to our everyday business problems. My hope is that infosec pros realize that to advance their careers and for the good of the industry they will have to learn more advanced data management and data science skills.
"I want to break down the walls that infosec pros put up and the onus is on the security practitioners to learn these new skills," he says.
Joshua Saxe, chief data scientist at Sophos, says many infosec pros are using Coursera to learn data science. Saxe says while infosec pros need to understand data science, it's unlikely that most of them will get to the point where they are actually data scientists.
"Becoming a data scientist does take a lot of foundation and it's hard to learn by yourself," Saxe says. "I think people in infosec need to think more like scientists versus hackers, and while people who are data scientists are more apt to come from top universities, there's always going to be a need for people who are not data scientists. Before you just had threat researchers; moving forward we'll have the data scientists working with the threat researchers."
Here are five ways experts say enterprise security teams can get smarter about how they use all types of data in their jobs.
Infosec professionals need to become more cross-functional where they are blending traditional log analysis with data analytics, data management, and data science. So whether that's quickly rolling out new models to stop imminent threats or quickly testing new controls against historical data to ensure minimal business impact, security practitioners need to get smarter about how they use data. Remember that customer data, trade secrets, and financial data are at risk if security teams cannot quickly analyze and address emerging threats.
If a security practitioner has a great idea to protect the organization, access to some data can often be a multi-step, week-long process. The loading of other data may have to go through an enterprise Extract, Transform and Load (ETL) process, which can take four- to six weeks. Infosec people need platforms that reduce that friction as much as possible so they can bring the best ideas to bear in protecting the enterprise. There has to be easy access with proper security controls. Data access should also be audited and the tools they use for analytics should be secure by default, built right into the platform.
Too often at large organizations, exorbitant licensing costs require management to tell security pros that they can only keep some data and that they must decide up front what they will need in the future. Moving forward, data access solutions should allow flexibility with both the cloud and on-prem to save costs. The licensing models that restrict data access don't take into account what could be valuable tomorrow. Store and retain as much data as possible and figure out ways for the licensing model to scale. It's important to ask the question: how easy or difficult it will be to add data tomorrow?
To build credibility with the data scientists, all tools and data should be secure by default. This includes strong authentication, access controls, and high availability/redundancy. When trying to master threats, if all those features can be built into a platform rather than something a practitioner has to deal with manually, it's a win for everyone because people can focus on managing threats as opposed to doing manual tasks or worrying that their data's unsafe.
Security pros aren't likely to tolerate slow internal processes that block bringing their threat solutions to the business. Modern DevOps practices that benefit data scientists, including containers and orchestration tools such as Kubernetes, in combination with easy access to well-audited data are a must. Having to wait days or weeks to deploy code because of slow internal processes puts an enterprise at real risk today.
Security pros aren't likely to tolerate slow internal processes that block bringing their threat solutions to the business. Modern DevOps practices that benefit data scientists, including containers and orchestration tools such as Kubernetes, in combination with easy access to well-audited data are a must. Having to wait days or weeks to deploy code because of slow internal processes puts an enterprise at real risk today.
The current silo-style organization of threat researchers reviewing logs in one place, threat hunters in another, and the data scientists in yet another silo working on algorithms, just doesn't cut it anymore with today's security threats.
Security teams need to get smarter with how they use and manage all types of data. That's because the lines between pure infosec data (Web logs, threat intelligence) versus other business data have become increasingly blurred. A piece of Web log data, for example, could be just as easily used to identify attackers as it could to optimize the customer experience. The same holds true for business data as well.
They need data science tools to detect threats, and the data scientists coming up with the algorithms have to work much more closely with threat hunters and threat researchers, experts say.
"I think security pros are becoming more like data scientists," says John Omernik, distinguished technologist at MapR. "But we can't have data science for data science's sake: We have to apply these new algorithms to our everyday business problems. My hope is that infosec pros realize that to advance their careers and for the good of the industry they will have to learn more advanced data management and data science skills.
"I want to break down the walls that infosec pros put up and the onus is on the security practitioners to learn these new skills," he says.
Joshua Saxe, chief data scientist at Sophos, says many infosec pros are using Coursera to learn data science. Saxe says while infosec pros need to understand data science, it's unlikely that most of them will get to the point where they are actually data scientists.
"Becoming a data scientist does take a lot of foundation and it's hard to learn by yourself," Saxe says. "I think people in infosec need to think more like scientists versus hackers, and while people who are data scientists are more apt to come from top universities, there's always going to be a need for people who are not data scientists. Before you just had threat researchers; moving forward we'll have the data scientists working with the threat researchers."
Here are five ways experts say enterprise security teams can get smarter about how they use all types of data in their jobs.
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024