On Big Data for Security and Analytics Technologies

I found an interesting report, by Enterprise Strategy Group, called “The Evolution of Big Data Security Analytics Technology” providing an overview of the market landscape.  In my view, two key areas are open to research and innovation:

 

·         Real-time big data security analytics

·         Asymmetric big data security analytics

From a security perspective, whilst an increasing number of new tools, solutions and frameworks are emerging in these areas, there are a few key challenges that need to be addressed.  They relate to the quality and effectiveness of big data analytics: how to make sense of big (security) data and provide meaningful insights in order to identify new threats and security issues; how to capture this knowledge into repeatable and simplified capabilities that can be used by a wide range of stakeholders.

 

These are going to be key R&D aspects to be addressed in the future, in addition to the well-known big data issues i.e. dealing with velocity, volume and variety of data.

 

In particular HP and HP Labs are in a unique position to make progress here, also thanks to opportunity to leverage key HP assets in the space of security and big data management i.e. HP ArcSight, HP Vertica and HP Autonomy.  

 

 

 

--- Posted by Marco Casassa Mont (here and here)  ---

--- NOTE:  use this mirror blog if you prefer posting on an external blog site  ---

--- NOTE:  my original HP blog can be found here  ---

 

 

HP Labs: Innovation and Delivery in the areas of Dynamic Consent and Privacy Management

During the last 6 months, HP Labs provided key contributions involving the overall coordination of the UK collaborative EnCoRe project, the release of public architectural documents and the development of fully working R&D solutions in the areas of dynamic consent and privacy management.

Specifically this includes:

1. The Third EnCoRe Technical Architecture (D2.3) document;
2. The final HP Labs’ EnCoRe Service Framework: a General, Reference Implementation for Dynamic Consent and Privacy Management;
3. The HP Labs Demonstrator for Cabinet Office/Identity Assurance;
4. HP Labs papers on EnCoRe, dynamic consent and privacy management.
My previous blog posts provide the details.



--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---

Next Generation Situational Awareness and Information Sharing

I am particularly interested in innovating in the space of Situational Awareness and Information Sharing.

These areas are getting more and more relevant within organisations, beyond the traditional military and government contexts.

Situational Awareness is usually related to the process of collecting and processing large amount of information to understand risks, threats and issues and enable decision support.

I believe there are great innovation opportunities in this space, including:

· Leveraging longer-term risk assessment, what-if analysis and decision support capabilities, such as the ones provided by Security Analytics

· Leveraging Cloud computing and related services for the provisioning and management of situational awareness capabilities

· Innovation in the information flow management, involved in situational awareness scenarios, by using advance policy and context based techniques

· Leveraging assets such as HP ArcSight, HP TippingPoint and Autonomy in this space

· Designing SOC 2.0, the next generation of Security Operations Centers for Incident Management and Remediation to adapt to new emerging scenarios and technologies

· Intelligent detections of threats and risks and reactions (e.g. via dynamic playbooks)

More to come.


--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---

On Incident Management, Security Analytics and the Cloud

In previous posts of mine I discussed the fact that HP Labs have developed an approach and capabilities to assess the risks associated to organisations’ Incident Management and Remediation processes. These capabilities, centred on HP Security Analytics, enable decision makers not only to assess the performance and security risks associated to current processes but also to explore potential what-if scenarios (e.g. changes of SLAs, changes of processes/resources, changes of threat environments) and identify suitable investments.

These capabilities are now offered as a service by HP Security Business (HP ESS).

I am interested in exploring the implications of doing this in emerging scenarios involving organisations that increasingly rely on outsourcing, supply-chains and the Cloud. What are the implications in terms of Incident Management and Response? How to effectively enable Information Sharing? How to enable accountability among the involved parties?

There is an opportunity in designing and building the next generation of Security Analytics and Risk Management services that can scale and cope with these emerging scenarios. More to come.

In the meanwhile, I am looking for additional requirements and use cases in the above space. Please contact me if you are interested in engaging in this area.


--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---