The Knowledge Pyramid

The marketing treadmill around security intelligence and big data the last few years really annoys me. More often we see organizations talk about their big tools and how they’ll solve all your problems, or at least tell you more about your problems so you can solve them yourself. All you have to do is buy their other product for $19.99! That may be an exaggeration, but the promises made around big data are mostly hollow and rely on you misunderstanding the difference between big data, ‘security intelligence’ and real intelligence.

Let’s start with understanding the structural difference between data, information, intelligence (or knowledge) and wisdom.

Data is the basic building block, an atomic piece, for security often in the form of a log file or an alert. By itself, data is lacking in context. Data by itself, no matter how much you have, is of little or no value. Once we begin analysis of data it becomes information and has some value. How many log lines of a particular type were recorded? What type of alerts did we receive and when? It’s the analysis that takes the huge amounts of data that are collected in the enterprise from being a meaningless mess to being something useful.

The next step up the hierarchy is to take that information and turn it into intelligence, which requires context.

How does the number of log lines relate to our servers and what is the function of those servers? Why is the router alerting and what are the networks that are connected through its interfaces?

Knowledge and Intelligence are sometimes used interchangeably; both imply that you have a framework of understanding of the surrounding systems. These require that you understand how the information you’re looking at might affect the bigger picture of your network. Where information is analyzed data, intelligence is information that has been organized and synthesized with further understanding of the environment you’re working in. Distilling big data from huge vats of data that are meaningless to the few drops of intelligence is difficult and time consuming.

What’s Missing from ‘Security Intelligence’?

It’s the leap from information to intelligence that’s missing in most so-called ‘security intelligence’ products. We’ve had systems that would alert us to new vulnerabilities and predigest news stories for our enterprise at least since the late 90’s. Some would argue that the consulting and analysis firms have been doing it even longer, but having a product that would give you a newsfeed and tell you which patches you need to apply is nothing new. And many of the products that are being sold currently are nothing more than prettier versions of the same old thing. They provide you with plenty of information, but little or no real intelligence.

When we talk about information sharing, especially in the form of Information Sharing and Analysis Centers (ISACs) we’re at least being more honest with ourselves as an industry. What is being shared at the ISAC level is information about attacks and vulnerabilities on the Internet as a whole. What intelligence comes out of the discussions is when the different organizations involved in conversation start looking at how the information provided to them affects their organization in particular.

What’s still missing, whether it’s an ISAC or a security intelligence product, is how this information relates to my organization and my systems in particular. Telling me that a group of anonymous actors is talking about attacking the financial sector is information and important, but it’s not really intelligence. If you tell me a group of criminals is talking about attacking my organization looking for a particular document or set of customer records, then you’re getting into the realm of actual intelligence. It’s that level of applicability and specificity that take the communication from information to intelligence.

From Intelligence to Wisdom

Not all security intelligence products are created equal and there are some that are getting closer and closer to providing real intelligence. When combining vulnerability databases with system inventories and scans, you get intelligence about which of your systems are vulnerable to specific bugs and vulnerabilities. But that’s not much more than checking patch levels and running it against a vulnerability database, which is fairly easy for any company with a decent inventory and configuration process. What makes the big difference is having the analysis of how your unique set of systems are going to be affected, which takes much more than knowing configurations and inventory.

In the knowledge hierarchy, the pinnacle is called either ‘wisdom’ or ‘experience’. And experience is what’s required to do the analysis and bring in the understanding that makes information into intelligence. Which is the basis of the problem with any supposed ‘security intelligence’ product. Real intelligence requires experience and the ability to connect seemingly disconnected facts in a way that is particularly difficult for current technologies to mimic. The future might be a different story though.

Like so many things in security, ‘intelligence’ isn’t a product you can buy. It’s something you have to develop yourself, with an understanding of how your systems interact, what your business processes are and what the complex relationships are between them. External agencies can give you intelligence, but it will be created by humans using experience to understand the threats to your organization, not by a computer algorithm sifting through data. The algorithms are important, but they’re only a feed to a real person with real experience and real wisdom if you want real security intelligence.