Data–Driven Security

Introduction xvChapter 1 • The Journey to Data–Driven Security 1
A Brief History of Learning from Data  2
Nineteenth Century Data Analysis  2
Twentieth Century Data Analysis  3
Twenty–First Century Data Analysis 4
Gathering Data Analysis Skills 5
Domain Expertise 6
Programming Skills 8
Data Management  10
Statistics  12
Visualization (aka Communication) 14
Combining the Skills  15
Centering on a Question 16
Creating a Good Research Question  17
Exploratory Data Analysis 18
Summary   18
Recommended Reading 19
Chapter 2 • Building Your Analytics Toolbox: A Primer on Using R and Python for Security Analysis  21
Why Python? Why R? And Why Both?  22
Why Python?  23
Why R?  23
Why Both? 24
Jumpstarting Your Python Analytics with Canopy   24
Understanding the Python Data Analysis and Visualization Ecosystem 25
Setting Up Your R Environment 29
Introducing Data Frames 33
Organizing Analyses 36
Summary   37
Recommended Reading 38
Chapter 3 • Learning the “Hello World” of Security Data Analysis 39
Solving a Problem  40
Getting Data41
Reading In Data 43
Exploring Data  47
Homing In on a Question 58
Summary   70
Recommended Reading 70
Chapter 4 • Performing Exploratory Security Data Analysis  71
Dissecting the IP Address73
Representing IP Addresses 73
Segmenting and Grouping IP Addresses  75
Locating IP Addresses  77
Augmenting IP Address Data80
Association/Correlation, Causation, and Security Operations Center Analysts Gone Rogue  86
Mapping Outside the Continents90
Visualizing the ZeuS Botnet  92
Visualizing Your Firewall Data 98
Summary 100
Recommended Reading101
Chapter 5 • From Maps to Regression  103
Simplifying Maps  105
How Many ZeroAccess Infections per Country?  108
Changing the Scope of Your Data 111
The Potwin Effect  113
Is This Weird?  117
Counting in Counties 120
Moving Down to Counties 122
Introducing Linear Regression  125
Understanding Common Pitfalls in Regression Analysis 130
Regression on ZeroAccess Infections  131
Summary 136
Recommended Reading   136
Chapter 6 • Visualizing Security Data 137
Why Visualize?  138
Unraveling Visual Perception 139
Understanding the Components of Visual Communications 144
Avoiding the Third Dimension 144
Using Color 146
Putting It All Together 148
Communicating Distributions 154
Visualizing Time Series 156
Experiment on Your Own 157
Turning Your Data into a Movie Star  158
Summary  159
Recommended Reading   160
Chapter 7 • Learning from Security Breaches  161
Setting Up the Research   162
Considerations in a Data Collection Framework 164
Aiming for Objective Answers  164
Limiting Possible Answers  164
Allowing “Other,” and “Unknown” Options  164
Avoiding Conflation and Merging the Minutiae  165
An Introduction to VERIS 166
Incident Tracking  168
Threat Actor 168
Threat Actions 169
Information Assets 173
Attributes  173
Discovery/Response 176
Impact  176
Victim 177
Indicators  179
Extending VERIS with Plus 179
Seeing VERIS in Action  179
Working with VCDB Data 181
Getting the Most Out of VERIS Data 185
Summary 189
Recommended Reading   189
Chapter 8 • Breaking Up with Your Relational Database  191
Realizing the Container Has Constraints   195
Constrained by Schema  196
Constrained by Storage  198
Constrained by RAM  199
Constrained by Data  200
Exploring Alternative Data Stores   200
BerkeleyDB  201
Redis 203
Hive 207
MongoDB  210
Special Purpose Databases 214
Summary  215
Recommended Reading 216
Chapter 9 • Demystifying Machine Learning 217
Detecting Malware 218
Developing a Machine Learning Algorithm  220
Validating the Algorithm 221
Implementing the Algorithm  222
Benefiting from Machine Learning  226
Answering Questions with Machine Learning  226
Measuring Good Performance 227
Selecting Features  228
Validating Your Model  230
Specific Learning Methods 230
Supervised  231
Unsupervised 234
Hands On: Clustering Breach Data  236
Multidimensional Scaling on Victim Industries  238
Hierarchical Clustering on Victim Industries 240
Summary 242
Recommended Reading   243
Chapter 10 • Designing Effective Security Dashboards 245
What Is a Dashboard, Anyway? 246
A Dashboard Is Not an Automobile  246
A Dashboard Is Not a Report  248
A Dashboard Is Not a Moving Van  251
A Dashboard Is Not an Art Show 253
Communicating and Managing “Security” through Dashboards 258
Lending a Hand to Handlers 258
Raising Dashboard Awareness  260
The Devil (and Incident Response Delays) Is in the Details 262
Projecting “Security” 263
Summary 267
Recommended Reading   267
Chapter 11 • Building Interactive Security Visualizations  269
Moving from Static to Interactive270
Interaction for Augmentation  271
Interaction for Exploration  274
Interaction for Illumination  276
Developing Interactive Visualizations 281
Building Interactive Dashboards with Tableau  281
Building Browser–Based Visualizations with D3 284
Summary 294
Recommended Reading   295
Chapter 12 • Moving Toward Data–Driven Security 297
Moving Yourself toward Data–Driven Security 298
The Hacker  299
The Statistician  302
The Security Domain Expert 302
The Danger Zone  303
Moving Your Organization toward Data–Driven Security   303
Ask Questions That Have Objective Answers  304
Find and Collect Relevant Data 304
Learn through Iteration  305
Find Statistics 306
Summary 308
Recommended Reading   308
Appendix A • Resources and Tools  309
Appendix B • References  313
Index •  321