整理您的安全数据：网络安全作为数据管理问题.pdf

1、Wrangling Your Security Data:Cybersecurity As A Data Management ProblemJacolon WalkerCo-founder,CTO,MonadDatabricks2023Today,the average Fortune 500 enterprise manages 40+cybersecurity vendorsEach tool has its own format for logs,outputs,and databasesCommon DISPARATE DATA FORMATS-Examples of column

2、headers that are formatted different ways by different data sources-WIZ /TENABLE-IP Addresses-Domain names-Vulnerability typeThe sheer volume and complexity of security data prevents enterprises from meaningfully understanding their security postureCybersecurity is a data management problemThe singl

3、e highest-leverage improvement to enterprise security efficiency and speed:Make disparate security data sources queryable with a standard schemaIP Address:Domain name:Vulnerability type:Wiz:ip_addressescloud_native_jsonName-(cve)AWS:instance_metadatainstance_metadataN/ATenable:ipv4fqdnscve/descripti

4、on/pluginWhich models are used today?Data modelRAW-JSON structureData Model-CustomBuilt-in(CSV models)1_DAIS_Title_SlideNow we join them!Phase 1:DiscoveryJoin vulnerability data with asset data:-See where vulnerabilities exist;are they actually exposed?Phase 2:ContextJoin above with threat intellige

5、nce data:-See which vulnerabilities are actively being targeted in the real worldPhase 3:Threat detection-Identify and prioritize assets with vulns that are being targetedHow do we identify which vulnerabilities are worth fixing?A mega-joinCombine data sources to create clarityPhase 1:DiscoveryJoin

6、vulnerability data with asset data:Phase 1:DiscoveryJoin vulnerability data with asset data:See which vulnerabilities are actively being targeted in the real worldPhase 2:ContextJoin vulns+assets with threat intelligence data:Identify and p