OPEN ACCESS
Organizations collect huge amounts of security intelligence and yet analysts fail to anticipate many attacks leading to data breaches, denials of service, identity theft, fraudulent use of systems and data, and other nefarious activities. Analysts mostly learn of incidents from third parties, such as law enforcement and payment-card processing companies. Could it be that they do not have available the right level and mix of data? We describe how one might optimize the collection and analysis of security information and event management data, particularly as they apply to securing computer applications. It is argued that this optimization can be achieved by combining big, midsize, and small data and running them through appropriate analytical methods.
attacks, big data, cloud computing, exploits, midsize data, preventative measures, security intelligence, small data, surveys, threats, vulnerabilities.
[1] Verizon Enterprise, 2015 Data Breach Investigations Report, Verizon, 2015, available at http:// www.verizonenterprise.com/DBIR/2015/
[2] Metz, C., Dell. EMC. HP. Cisco. These tech giants are the walking dead, Wired Magazine, October 2015, available at http://www.wired.com/2015/10/meet-walking-dead-hp-cisco-d ellemc -ibm-oracle/
[3] Duvall, P.M., Matyas, S. & Glover, A., Continuous Integration: Improving Software Quality and Reducing Risk, Addison-Wesley, 2007.
[4] Humble, J. & Farley, D., Continuous Delivery: Reliable Software Releases through Build, Test and Deployment Automation, Addison-Wesley, 2010.
[5] Hoff, J. & Chapple, M., Securing the SDLC for Dummies, John Wiley, 2014.
[6] Kandeck, W., Vulnerability Management for Dummies, 2nd edn., John Wiley, 2015.
[7] Kim, G., Behr, K. & Spafford, G., DevOps Guide—Selected Resources to Start Your Journey, IT Revolution Press, 2015, available at http://www.delphix.com/wp-content/uploads/2015/09/ delphix-ar-itrev-devops-guide.pdf
[8] Peysakhovich, A. & Stevens-Davidowitz, S., How not to drown in numbers, Sunday Review, The New York Times, May 2, 2015.
[9] Watson, C., Groves, D. & Melton, J., AppSensor Guide: Application-Specific Real Time Attack Detection & Response, Version 2.0, OWASP (Open Web Application Security Project), July 2015.
[10] Murthy, P., Bharadwaj, A., Subrahmanyam, P.A., Roy, A. & Rajan, S., Big Data Working Group: Big Data Taxonomy, Cloud Security Alliance, September 2014.
[11] Axelrod, C.W., Actionable security intelligence from big, midsize and small data. ISACA Journal, 1, pp. 44–50, 2016.
[12] Watson, C., Coates, M., Melton, J. & Groves, D., Creating attack-aware software applications with real-time defences. CrossTalk, 24(5), pp. 14–18, 2011.
[13] Watson, C., Chan, J., Hall, M. & Ven der stock, A., OWASP Automated Threat Handbook—Web Applications, Version 1.01, OWASP, October 2015.
[14] DTCC (Depository Trust Clearing Corporation), Soltra Edge, the First Industry-Driven Threat Intelligence Sharing Platform Now Generally Available, Easy-to-Use and Free to License, DTCC Press Release, December 3, 2014.
[15] Axelrod, C.W., Creating data from applications for detecting stealth attacks, CrossTalk, 24(2), pp. 17–21, March/April 2011.
[16] Axelrod, C.W., The need for functional security testing, CrossTalk, 24(5), pp. 19–24, September/October 2011.
[17] Axelrod, C.W., Accounting for value and uncertainty in security metrics. ISACA Journal, 6, 2008.
[18] Pratt, M.K., Five things you need to know: prescriptive analytics, CIO Magazine, p. 20, December 2014/January 2015.