Tag Archive for: Analytics

Driving Blindfolded

/by

I recently wrote about the necessity of getting the right data for security analytics.  But I’m continuously reminded how typical organizations lack an even roughly complete understanding of their network, or even a map of it.  I can understand why this happens – entropy is just as inevitable for organizations as it is in Physics.  Records don’t just keep themselves – networks change, and ideally it’s all planned and well controlled, but in practice, emergencies happen, corners get rounded off, triage goes on, and perfect record keeping is lost.  I know organizations who aim to have very strong processes, control, and accountability, and while I commend them for it, I find that if I look at their data, I still find enough gaps and unknowns to be a worry.  Sure, the mature organizations do better – they don’t tend to have records in the moral equivalent of a shoe-box under the bed (but I see enough of those). But the records still don’t add up.

driving_blindfoldedI think what worries me more are the organizations who know they have information gaps, but don’t treat them as a priority.  I see this as driving a car while blindfolded.  How is security possibly going to be effective if you can’t map out the infrastructure – the whole infrastructure, warts, labs, virtualization and all – and just look at it, let alone ask decent, proactive questions about how to defend yourself?  Imagine physical security – for example, badge reader installation – without having a map of the building, or even a vague idea of the number of doors that need to be secured.

Of course, I’m preaching to the choir – anyone reading this blog probably already understands that this is important.  I sometimes wonder if the real challenges are political, not technical or intellectual.  When a security team can’t get the blueprints to the network, what exactly is going on?  Is it overload?  Is it lack of people to go hunt down what’s missing?  Or is it the classic challenge of “nagging for a living”?  Many security teams I meet don’t have direct access to the network assets that are critical to defensive posture.  This means they have to ask, or beg, or cajole the NetOps team into providing data.  The strength of that team-to-team relationship seems to be a really important issue.  I’ve seen organizations vary hugely in speed and success with data analytics, depending on whether someone in Team Security has a buddy in Team Networking or not.  Perhaps the worst cases I’ve seen involve outsourced IT and networking – then it can get to levels nothing short of passive-aggressive.

Got war stories?  Advice?  Rotten fruit?  Comments welcome …

Data, Data Everywhere, nor Any Time to Think

/by

I remember when I first started trying to solve network security problems, using fancy network analytics.  I applied the classic suspension of disbelief that’s necessary to work on any emerging technology – first, you assume all the hard problems will be easy, and second, you assume the impossible ones will just go away.  Happily, much of this is true – it’s funny how well it works.  Only later do you learn which problems are the truly hard ones.

What’s hard about network security analytics?  Well, not the security, and not the analytics – we’ve found we can do plenty on both of those that pays off really well, given the data.  The pesky data, now that’s a different kettle of enchiladas.

data-everywhereAt first, I didn’t want to talk about data gaps – that sounded like a challenge to good analytics.  I was half right.  Eventually, enough CISO’s got it through my skull that uncovering data gaps may be pointing to reasons why analytics will be held back, but it’s also major value, in and of itself.  I was being dense – if we try to analyze security data, and we find it’s got holes in it, well, this means the security team didn’t know what was going on to start with!  Turning up these gaps is one of those inconvenient truths.  These days we’ve gotten pretty good at it.

But then what?  Typical security organizations are drowning in data, so how can I complain about needing more?  Well, facts are just facts; useful information, or better yet, actionable intelligence is something else altogether.  We stockpile data from sensors, but we struggle to find useful signal in there.  We deploy automated signal reduction engines, but they just turn mountains of alerts into hills of alerts, and we still don’t have time or people enough to climb those.  And along come these network security analytics people saying “what you need is more data”.  Hmmm.

Of course, what we need is the RIGHT data, processed the right way, at the right time.