{"id":4893,"date":"2023-07-14T16:58:32","date_gmt":"2023-07-14T20:58:32","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=4893"},"modified":"2023-07-19T17:13:54","modified_gmt":"2023-07-19T21:13:54","slug":"the-key-to-enhanced-security-fixing-data-upstream","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/","title":{"rendered":"The Key to Enhanced Security? Fixing Data Upstream"},"content":{"rendered":"

\"data\"<\/p>\n

Solutions Review\u2019s <\/strong><\/i>Contributed Content Series<\/u><\/strong><\/i><\/a> is a collection of contributed articles written by thought leaders in enterprise software categories. <\/strong><\/i><\/span>Nicole Bucala of Comcast Technology Solutions<\/a> examines how fixing your data lake upstream is the key to enhanced security.<\/b><\/em><\/p>\n

Security organizations today are grappling with growing volumes of data but don\u2019t have a cohesive global strategy to store, analyze, and manage it all cost-effectively. In addition, risk and detection analytics layered on current security datasets often yield false positives, so their end result cannot be trusted.<\/p>\n

Over the past few years, organizations have deployed security orchestration, automation, and response (SOAR) solutions or AI\/ML on top of their data to try to develop answers and respond to key security or compliance questions faster. Still, the responses that are put out by AI\/ML algorithms or SOAR playbooks are only as good as the underlying data sets. So, what happens when the upstream data isn\u2019t holistic, correct, or formatted in a way that can be properly interpreted by SOAR or AI\/ML? It means that organizations can\u2019t get a proper picture of what\u2019s actually going on, and confusion ensues.<\/p>\n

That\u2019s leaving them behind in terms of cybersecurity readiness.<\/p>\n
Widget not in any sidebars
\n

Fixing the Data Lake Upstream<\/strong><\/h2>\n
\n

Six Steps to Improving Your Data<\/strong><\/h3>\n

The good news? You can do several things to improve the quality of your organization\u2019s underlying data set and develop a better strategy for managing security data at scale.<\/p>\n

    \n
  1. Move to a security data lake architecture.<\/strong> Data lakes are increasingly used for all manners of enterprise data. Essentially, they are centralized repositories for storing, processing, and securing massive volumes of data in any form. This same approach can be applied to security. With a security data lake, be sure to select one with compression built in to keep costs down, and you\u2019ll be able to store petabytes of data for as long as your organization recommends. The end result: your security data can be stored and used at a much-reduced cost compared to a security information and event management (SIEM) solution.<\/li>\n
  2. Develop an analytics strategy that includes partners.<\/strong> A security data lake doesn\u2019t replace a SIEM; rather, it lives in harmony with a SIEM. You\u2019ll want to develop an analytics strategy to determine where and how data flows to your security data lake or SIEM, and you\u2019ll want to supplement this data with feeds from a threat intelligence partner to ensure your security data is always enriched with the latest intel. You can send long-term forensics copies of many data sets to your data lake while sending only specific data sources and fields needed for more accurate SIEM detections to the SIEM. You can also send to your data lake large quantities of data sources that aren\u2019t cost-effective to process in a SIEM at all.<\/li>\n
  3. Use an ETL process to optimize your security data.<\/strong> To effectively use a data lake, you must first get the security data into a usable state. Most security data is not normalized at the source and requires transformation to be used effectively. Many security data utilize context that requires correlation to uncover actual incidents or anomalies. You\u2019ll want to purchase or develop an extract, transform, and load (ETL) process and ensure that it includes automatic parsing, normalization, enrichment, and correlation logic.<\/li>\n
  4. Identify business value context that you\u2019ve always wanted to combine with security insights but have been unable to.<\/strong> Maybe it\u2019s in the form of organization chart data, business revenue, or some other business data (i.e., non-security data source) that can make your security insights more meaningful. Determining the types of business context most important to your organization\u2019s desired outcomes can help guide you on the right path and ensure you get the most impact out of your efforts. It also helps to provide a one-stop shop of data for multiple business units, granted the right governance processes are in place to limit sensitive data to those who are necessary.<\/li>\n
  5. Align on a common schema in which your data will reside in that data lake.<\/strong> It is useful to use a common schema and explore more modern ones. Some experts predict that older schemas like elastic common schema and MITRE Cyber Analytics Repository (MITRE CAR) are expected to be eclipsed by the Open Cybersecurity Schema Framework (OCSF), which naturally contains logic to deliver user and entity relationships to make the data inherently more usable to a security analyst.<\/li>\n
  6. Develop a governance program around your security data lake.<\/strong> You\u2019ll want the buy-in of data source owners because it is essential that each data source owner feels their data is being rendered accurately in the dataset living in the data lake; in fact, it\u2019s vital that owners still have control over their data and the teams who utilize it. You\u2019ll want to develop a process so each data source owner can verify their data is accessible, integrated, and transparent.<\/li>\n<\/ol>\n

    Making Security Data Management More Feasible for the Future<\/strong><\/h3>\n

    By following the six steps above, you\u2019ll likely find more cohesion across all the data. Your data should be cleaner, so you\u2019ll have fewer false positives. Your AI\/ML algorithms should work better, yielding results you have more confidence in. Data silos will be reduced, and team collaboration will be more fluid because analysis will be done on the same dataset. Importantly, you\u2019ll find that as you switch to a security data lake architecture, you can de-duplicate storage across other toolsets and have a single source of truth. That said, truly bringing this to fruition requires a team of data scientists. That\u2019s a major reason why we\u2019ve traditionally seen only the most sophisticated of companies be able to develop approaches along these lines.<\/p>\n

    The good news is that innovation is springing up in pockets, and platforms and tools are being developed to tackle these tasks automatically, with less manual intervention. The ultimate goal of these forthcoming technologies is to make data more accessible and usable by analysts who do not have advanced data science skillsets. Of course, change isn\u2019t going to happen overnight, but the key is to understand that a new approach with the potential to enable a better way to manage all the data is imminent.<\/p>\n
    Widget not in any sidebars
    \n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Solutions Review\u2019s Contributed Content Series is a collection of contributed articles written by thought leaders in enterprise software categories. Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security. Security organizations today are grappling with growing volumes of data but don\u2019t have a cohesive global strategy […]<\/p>\n","protected":false},"author":774,"featured_media":4894,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[],"acf":[],"yoast_head":"\nThe Key to Enhanced Security? Fixing Data Upstream<\/title>\n<meta name=\"description\" content=\"Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Key to Enhanced Security? Fixing Data Upstream\" \/>\n<meta property=\"og:description\" content=\"Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-14T20:58:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-19T21:13:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Nicole Bucala\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nicole Bucala\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/\",\"name\":\"The Key to Enhanced Security? Fixing Data Upstream\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg\",\"datePublished\":\"2023-07-14T20:58:32+00:00\",\"dateModified\":\"2023-07-19T21:13:54+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f91c9b3dcbef990f428955509a673f78\"},\"description\":\"Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg\",\"width\":800,\"height\":400,\"caption\":\"data\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Key to Enhanced Security? Fixing Data Upstream\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f91c9b3dcbef990f428955509a673f78\",\"name\":\"Nicole Bucala\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8ad0d77191cfbf017e8500cacd40aadc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8ad0d77191cfbf017e8500cacd40aadc?s=96&d=mm&r=g\",\"caption\":\"Nicole Bucala\"},\"description\":\"Nicole Bucala is the Cybersecurity Vice President and General Manager at Comcast Technology Solutions, where she is in charge of the overall development and commercialization of Comcast's security data fabric platform. She has held strategy and operations, strategic alliances, and business development leadership positions at VC-backed startups as well as larger public and private-equity-backed global cybersecurity vendors, demonstrating a unique ability to bring order to chaos, and agility to process. Prior to Comcast, she held senior leadership or executive roles at Zscaler, Illusive Networks, and RSA Security. Before entering commercial cybersecurity, she founded and served as CEO of MIFCOR, an early-stage biotechnology startup, and began her career serving her country by conducting counterterrorism operations for the U.S. government. Bucala holds a Bachelor\u2019s of science from MIT, a Master\u2019s of Science from Georgetown Medical School, and an MBA from Harvard Business School.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/nbucala\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Key to Enhanced Security? Fixing Data Upstream","description":"Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/","og_locale":"en_US","og_type":"article","og_title":"The Key to Enhanced Security? Fixing Data Upstream","og_description":"Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2023-07-14T20:58:32+00:00","article_modified_time":"2023-07-19T21:13:54+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg","type":"image\/jpeg"}],"author":"Nicole Bucala","twitter_misc":{"Written by":"Nicole Bucala","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/","name":"The Key to Enhanced Security? Fixing Data Upstream","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg","datePublished":"2023-07-14T20:58:32+00:00","dateModified":"2023-07-19T21:13:54+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f91c9b3dcbef990f428955509a673f78"},"description":"Nicole Bucala of Comcast Technology Solutions examines how fixing your data lake upstream is the key to enhanced security.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/07\/The-Key-to-Enhanced-Security-Fixing-Data-Upstream.jpg","width":800,"height":400,"caption":"data"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/the-key-to-enhanced-security-fixing-data-upstream\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"The Key to Enhanced Security? Fixing Data Upstream"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/f91c9b3dcbef990f428955509a673f78","name":"Nicole Bucala","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8ad0d77191cfbf017e8500cacd40aadc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8ad0d77191cfbf017e8500cacd40aadc?s=96&d=mm&r=g","caption":"Nicole Bucala"},"description":"Nicole Bucala is the Cybersecurity Vice President and General Manager at Comcast Technology Solutions, where she is in charge of the overall development and commercialization of Comcast's security data fabric platform. She has held strategy and operations, strategic alliances, and business development leadership positions at VC-backed startups as well as larger public and private-equity-backed global cybersecurity vendors, demonstrating a unique ability to bring order to chaos, and agility to process. Prior to Comcast, she held senior leadership or executive roles at Zscaler, Illusive Networks, and RSA Security. Before entering commercial cybersecurity, she founded and served as CEO of MIFCOR, an early-stage biotechnology startup, and began her career serving her country by conducting counterterrorism operations for the U.S. government. Bucala holds a Bachelor\u2019s of science from MIT, a Master\u2019s of Science from Georgetown Medical School, and an MBA from Harvard Business School.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/nbucala\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4893"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/774"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=4893"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4893\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/4894"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=4893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=4893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=4893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}