EDGE 2015 is starting in

Find out more EDGE 2015
Menu
Applying Big Data approaches to information security a challenge

Applying Big Data approaches to information security a challenge

Data integration and correlation a hard thing to do, say security experts at RSA Conference

SAN FRANCISCO: Applying Big Data approaches to information security can help enterprises build better situational awareness capabilities, but implementation could prove to be a major challenge, security experts said at the RSA Conference 2013 being held here this week.

Companies such as RSA and Symantec are using the conference to spell out their strategies of using new data aggregation, correlation and analytics approaches to help enterprise sift through huge sets of structured and unstructured data for threat indicators. The idea is that such data aggregation and correlation will help companies spot trends and threats that conventional signature-based security tools are unable to detect.

Unlike conventional security approaches that are focused largely on blocking attacks, the new approaches emphasize breach detection and response almost as much as breach prevention. The goal is to help companies block the threats they can while helping them detect and respond to the one they miss.

In an inaugural keynote address, RSA chief Art Coviello said that the need for big data approaches was being driven by the increasing number of targeted and persistent attacks against U.S. businesses and government organizations. The sheer volume and variety of data being collected and mined by enterprises these days also is driving the need for new approaches to protect that data from adversaries, he said.

Instead of deploying point products and perimeter defenses, companies need to adopt a security model that is based on actual threats and threat intelligence, Coviello said.

U.S. organizations are caught up in an increasingly asymmetric war against cyber enemies that are better armed, better prepared and better organized than they are, said Francis deSouza, president of products and services at Symantec.

"Attackers have to be right just once, we have to be right every time," deSouza said in a keynote address at the conference. So rather than focusing purely on blocking all threats, companies should be using big data analytics approaches to detect intrusions and mitigate them, he said.

In theory at least, the idea of bolstering security by looking at and analyzing vast data sets is a good one, said several IT managers and security experts at the RSA show.

But getting there could take some doing, said Christopher Pierson, chief security and compliance officer at LSQ Holdings, a financial services company. "I think that the problem of having insight into log files and all your appliances has been pervasive," Pierson said.

Currently available security incident and event management (SIEM) tools already allow companies to aggregate huge amounts of log data from multiple security devices and bring it all to one system, he said. But the real problem with SIEMS is the ability to analyze the data and correlate that data so that precursor hacking evidence or actual intrusions can be detected," and acted upon.

It's one thing to aggregate data. It's another thing entirely to make sense of it, he said. In the end the key to situational awareness are the correlation rules and processes that a company has in place for analyzing the data and acting upon it in an efficient manner.

"The big data challenge is to derive actionable information," said Andrew Wild, chief security officer at Qualys. The issue that many enterprises face is not so much a lack of data but rather how to use it in a manner that is useful from a security perspective, he said.

"The network is highly aware, the routers are aware the switches are aware. They know the packets that are flowing through the network." The problem is that all the data exists in different repositories that are not integrated at all, he said.

The tools individually are unable to provide much information, so the Big Data challenge is to find a way to aggregate the data and extract useful information from it. "Big Data is a big challenge when it comes to security," Jerry Sto. Tomas, director of global information security at Allergan, said in a panel discussion at the conference.

A lot of the log data that companies collect exist in silos, he said. And often the data that is college is "garbage data" from a security standpoint, Tomas said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com.

Read more about big data in Computerworld's Big Data Topic Center.

EDGE 2015:: For all the latest on EDGE 2015 including the keynote speakers visit the EDGE mini-site now

2015 ARN ICT Industry Awards: Nominations for the 2015 ARN ICT Industry Awards close on June 26. NOMINATE NOW!!!

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Tags applicationssymantecsecuritycyberwarfaredata miningsoftwarebig data

Upcoming

Slideshows

IN PICTURES: OKI Data Australia partner event (+10 photos)
Business Products

IN PICTURES: OKI Data Australia partner event (+10 photos)

OKI recently hosted its ChannelOne dealer forum for its executive series channel partners to get together and learn about the company's new high-performance ES8400 A3 multifunction series printers. After a welcome and business overview from OKI Data Australia managing director, Dennie Kawahara, delegates were given a comprehensive overview of the new product, as well as an update on the latest marketing initiatives and software solutions, before being treated to live demos and a product showcase. Partners were also given a preview of OKI’s upcoming A3 digital LED white toner printer. With more than 60 delegates attending from all over the country, the day concluded with dinner at Casa Ristorante Italiano in Sydney and several delegates also participated in a friendly game of golf the following morning.

IN PICTURES: OKI Data Australia partner event (+10 photos)
Email 101: 11 tips to manage your email

Email 101: 11 tips to manage your email

If you’re a college graduate entering the workforce, you may quickly find you aren’t prepared for the volume of email that awaits you in the corporate world. These 11 tips will help you master forwards, filtering and more.

Email 101: 11 tips to manage your email

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments