Data-Driven Security: Analysis, Visualization and Dashboards

Cover
Title Page
Copyright
Contents
Introduction
	Overview of the Book and Technologies
	How This Book Is Organized
	Who Should Read This Book
	Tools You Will Need
	What’s on the Website
	The Journey Begins!
Chapter 1 The Journey to Data-Driven Security
	A Brief History of Learning from Data
		Nineteenth Century Data Analysis
		Twentieth Century Data Analysis
		Twenty-First Century Data Analysis
	Gathering Data Analysis Skills
		Domain Expertise
		Programming Skills
		Data Management
		Statistics
		Visualization (a.k.a. Communication)
		Combining the Skills
	Centering on a Question
		Creating a Good Research Question
		Exploratory Data Analysis
	Summary
	Recommended Reading
Chapter 2 Building Your Analytics Toolbox: A Primer on Using R and Python for Security Analysis
	Why Python? Why R? And Why Both?
		Why Python?
		Why R?
		Why Both?
	Jumpstarting Your Python Analytics with Canopy
		Understanding the Python Data Analysis and Visualization Ecosystem
		Setting Up Your R Environment
	Introducing Data Frames
	Organizing Analyses
	Summary
	Recommended Reading
Chapter 3 Learning the “Hello World” of Security Data Analysis
	Solving a Problem
	Getting Data
	Reading In Data
	Exploring Data
	Homing In on a Question
	Summary
	Recommended Reading
Chapter 4 Performing Exploratory Security Data Analysis
	Dissecting the IP Address
		Representing IP Addresses
		Segmenting and Grouping IP Addresses
		Locating IP Addresses
	Augmenting IP Address Data
		Association/Correlation, Causation, and Security Operations Center Analysts Gone Rogue
	Mapping Outside the Continents
		Visualizing the ZeuS Botnet
		Visualizing Your Firewall Data
	Summary
	Recommended Reading
Chapter 5 From Maps to Regression
	Simplifying Maps
		How Many ZeroAccess Infections per Country?
		Changing the Scope of Your Data
		The Potwin Effect
		Is This Weird?
		Counting in Counties
		Moving Down to Counties
	Introducing Linear Regression
		Understanding Common Pitfalls in Regression Analysis
		Regression on ZeroAccess Infections
	Summary
	Recommended Reading
Chapter 6 Visualizing Security Data
	Why Visualize?
		Unraveling Visual Perception
	Understanding the Components of Visual Communications
		Avoiding the Third Dimension
		Using Color
		Putting It All Together
		Communicating Distributions
		Visualizing Time Series
		Experiment on Your Own
	Turning Your Data into a Movie Star
	Summary
	Recommended Reading
Chapter 7 Learning from Security Breaches
	Setting Up the Research
	Considerations in a Data Collection Framework
		Aiming for Objective Answers
		Limiting Possible Answers
		Allowing “Other,” and “Unknown” Options
		Avoiding Conflation and Merging the Minutiae
	An Introduction to VERIS
		Incident Tracking
		Threat Actor
		Threat Actions
		Information Assets
		Attributes
		Discovery/Response
		Impact
		Victim
		Indicators
		Extending VERIS with Plus
	Seeing VERIS in Action
	Working with VCDB Data
		Getting the Most Out of VERIS Data
	Summary
	Recommended Reading
Chapter 8 Breaking Up with Your Relational Database
	Realizing the Container Has Constraints
		Constrained by Schema
		Constrained by Storage
		Constrained by RAM
		Constrained by Data
	Exploring Alternative Data Stores
		BerkeleyDB
		Redis
		Hive
		MongoDB
		Special Purpose Databases
	Summary
	Recommended Reading
Chapter 9 Demystifying Machine Learning
	Detecting Malware
		Developing a Machine Learning Algorithm
		Validating the Algorithm
		Implementing the Algorithm
	Benefiting from Machine Learning
		Answering Questions with Machine Learning
		Measuring Good Performance
		Selecting Features
		Validating Your Model
	Specific Learning Methods
		Supervised
		Unsupervised
	Hands On: Clustering Breach Data
		Multidimensional Scaling on Victim Industries
		Hierarchical Clustering on Victim Industries
	Summary
	Recommended Reading
Chapter 10 Designing Effective Security Dashboards
	What Is a Dashboard, Anyway?
		A Dashboard Is Not an Automobile
		A Dashboard Is Not a Report
		A Dashboard Is Not a Moving Van
		A Dashboard Is Not an Art Show
	Communicating and Managing “Security” through Dashboards
		Lending a Hand to Handlers
		Raising Dashboard Awareness
		The Devil (and Incident Response Delays) Is in the Details
		Projecting “Security”
	Summary
	Recommended Reading
Chapter 11 Building Interactive Security Visualizations
	Moving from Static to Interactive
		Interaction for Augmentation
		Interaction for Exploration
		Interaction for Illumination
	Developing Interactive Visualizations
		Building Interactive Dashboards with Tableau
		Building Browser-Based Visualizations with D3
	Summary
	Recommended Reading
Chapter 12 Moving Toward Data-Driven Security
	Moving Yourself toward Data-Driven Security
		The Hacker
		The Statistician
		The Security Domain Expert
		The Danger Zone
	Moving Your Organization toward Data-Driven Security
		Ask Questions That Have Objective Answers
		Find and Collect Relevant Data
		Learn through Iteration
		Find Statistics
	Summary
	Recommended Reading
Appendix A Resources and Tools
Appendix B References
Index