《整理您的安全数据:网络安全作为数据管理问题.pdf》由会员分享,可在线阅读,更多相关《整理您的安全数据:网络安全作为数据管理问题.pdf(19页珍藏版)》请在三个皮匠报告上搜索。
1、Wrangling Your Security Data:Cybersecurity As A Data Management ProblemJacolon WalkerCo-founder,CTO,MonadDatabricks2023Today,the average Fortune 500 enterprise manages 40+cybersecurity vendorsEach tool has its own format for logs,outputs,and databasesCommon DISPARATE DATA FORMATS-Examples of column
2、headers that are formatted different ways by different data sources-WIZ /TENABLE-IP Addresses-Domain names-Vulnerability typeThe sheer volume and complexity of security data prevents enterprises from meaningfully understanding their security postureCybersecurity is a data management problemThe singl
3、e highest-leverage improvement to enterprise security efficiency and speed:Make disparate security data sources queryable with a standard schemaIP Address:Domain name:Vulnerability type:Wiz:ip_addressescloud_native_jsonName-(cve)AWS:instance_metadatainstance_metadataN/ATenable:ipv4fqdnscve/descripti
4、on/pluginWhich models are used today?Data modelRAW-JSON structureData Model-CustomBuilt-in(CSV models)1_DAIS_Title_SlideNow we join them!Phase 1:DiscoveryJoin vulnerability data with asset data:-See where vulnerabilities exist;are they actually exposed?Phase 2:ContextJoin above with threat intellige
5、nce data:-See which vulnerabilities are actively being targeted in the real worldPhase 3:Threat detection-Identify and prioritize assets with vulns that are being targetedHow do we identify which vulnerabilities are worth fixing?A mega-joinCombine data sources to create clarityPhase 1:DiscoveryJoin
6、vulnerability data with asset data:Phase 1:DiscoveryJoin vulnerability data with asset data:See which vulnerabilities are actively being targeted in the real worldPhase 2:ContextJoin vulns+assets with threat intelligence data:Identify and prioritize assets with vulns that are being targetedPhase 3:Threat detection1_DAIS_Title_SlideTry it for yourself!Go to Solution Accelerator to see our raw data and cleaned data.Import it into Databricks to play with itSCREENSHOTSTry it in your own environmentThank you!Get in touch: