Data-Driven Security

Jay Jacobs is the coauthor of Verizon Data Breach Investigation Reports and the cofounder of the Society of Information Risk Analysts, where he currently sits on the board of directors.Bob Rudis is the Director of Enterprise Information Security & IT Risk Management at Liberty Mutual Insurance and was named one of the Top 25 Influencers in Information Security by Tripwire.

• Introduction xvChapter 1 The Journey to Data-Driven Security 1A Brief History of Learning from Data 2Nineteenth Century Data Analysis 2Twentieth Century Data Analysis 3Twenty-First Century Data Analysis 4Gathering Data Analysis Skills 5Domain Expertise 6Programming Skills 8Data Management 10Statistics 12Visualization (aka Communication) 14Combining the Skills 15Centering on a Question 16Creating a Good Research Question 17Exploratory Data Analysis 18Summary 18Recommended Reading 19Chapter 2 Building Your Analytics Toolbox: A Primer on Using R and Python for Security Analysis 21Why Python? Why R? And Why Both? 22Why Python? 23Why R? 23Why Both? 24Jumpstarting Your Python Analytics with Canopy 24Understanding the Python Data Analysis and Visualization Ecosystem 25Setting Up Your R Environment 29Introducing Data Frames 33Organizing Analyses 36Summary 37Recommended Reading 38Chapter 3 Learning the "Hello World" of Security Data Analysis 39Solving a Problem 40Getting Data41Reading In Data 43Exploring Data 47Homing In on a Question 58Summary 70Recommended Reading 70Chapter 4 Performing Exploratory Security Data Analysis 71Dissecting the IP Address73Representing IP Addresses 73Segmenting and Grouping IP Addresses 75Locating IP Addresses 77Augmenting IP Address Data80Association/Correlation, Causation, and Security Operations Center Analysts Gone Rogue 86Mapping Outside the Continents90Visualizing the ZeuS Botnet 92Visualizing Your Firewall Data 98Summary 100Recommended Reading101Chapter 5 From Maps to Regression 103Simplifying Maps 105How Many ZeroAccess Infections per Country? 108Changing the Scope of Your Data 111The Potwin Effect 113Is This Weird? 117Counting in Counties 120Moving Down to Counties 122Introducing Linear Regression 125Understanding Common Pitfalls in Regression Analysis 130Regression on ZeroAccess Infections 131Summary 136Recommended Reading 136Chapter 6 Visualizing Security Data 137Why Visualize? 138Unraveling Visual Perception 139Understanding the Components of Visual Communications 144Avoiding the Third Dimension 144Using Color 146Putting It All Together 148Communicating Distributions 154Visualizing Time Series 156Experiment on Your Own 157Turning Your Data into a Movie Star 158Summary 159Recommended Reading 160Chapter 7 Learning from Security Breaches 161Setting Up the Research 162Considerations in a Data Collection Framework 164Aiming for Objective Answers 164Limiting Possible Answers 164Allowing "Other," and "Unknown" Options 164Avoiding Conflation and Merging the Minutiae 165An Introduction to VERIS 166Incident Tracking 168Threat Actor 168Threat Actions 169Information Assets 173Attributes 173Discovery/Response 176Impact 176Victim 177Indicators 179Extending VERIS with Plus 179Seeing VERIS in Action 179Working with VCDB Data 181Getting the Most Out of VERIS Data 185Summary 189Recommended Reading 189Chapter 8 Breaking Up with Your Relational Database 191Realizing the Container Has Constraints 195Constrained by Schema 196Constrained by Storage 198Constrained by RAM 199Constrained by Data 200Exploring Alternative Data Stores 200BerkeleyDB 201Redis 203Hive 207MongoDB 210Special Purpose Databases 214Summary 215Recommended Reading 216Chapter 9 Demystifying Machine Learning 217Detecting Malware 218Developing a Machine Learning Algorithm 220Validating the Algorithm 221Implementing the Algorithm 222Benefiting from Machine Learning 226Answering Questions with Machine Learning 226Measuring Good Performance 227Selecting Features 228Validating Your Model 230Specific Learning Methods 230Supervised 231Unsupervised 234Hands On: Clustering Breach Data 236Multidimensional Scaling on Victim Industries 238Hierarchical Clustering on Victim Industries 240Summary 242Recommended Reading 243Chapter 10 Designing Effective Security Dashboards 245What Is a Dashboard, Anyway? 246A Dashboard Is Not an Automobile 246A Dashboard Is Not a Report 248A Dashboard Is Not a Moving Van 251A Dashboard Is Not an Art Show 253Communicating and Managing "Security" through Dashboards 258Lending a Hand to Handlers 258Raising Dashboard Awareness 260The Devil (and Incident Response Delays) Is in the Details 262Projecting "Security" 263Summary 267Recommended Reading 267Chapter 11 Building Interactive Security Visualizations 269Moving from Static to Interactive270Interaction for Augmentation 271Interaction for Exploration 274Interaction for Illumination 276Developing Interactive Visualizations 281Building Interactive Dashboards with Tableau 281Building Browser-Based Visualizations with D3 284Summary 294Recommended Reading 295Chapter 12 Moving Toward Data-Driven Security 297Moving Yourself toward Data-Driven Security 298The Hacker 299The Statistician 302The Security Domain Expert 302The Danger Zone 303Moving Your Organization toward Data-Driven Security 303Ask Questions That Have Objective Answers 304Find and Collect Relevant Data 304Learn through Iteration 305Find Statistics 306Summary 308Recommended Reading 308Appendix A Resources and Tools 309Appendix B References 313Index 321