April 21, 2015, RSA Conference, San Francisco—Chris Young from Intel talked about changing the game. Admittedly, change is hard and it is easier to maintain the status quo, but the current trust crisis precludes inaction.
Malware is getting headlines and also the attention of the C-level executives all the way up to the President. In response, the security industry is growing, with over 1200 new companies and $7 B in investments for those companies. Wall Street is giving record valuations to those companies and a new exchange traded fund " HACK" is up 14 percent this year. The industry is spending overt $100 B a year on security.
To highlight the extent of change, look at the '02 Oakland A's. Their problem was that they had one of the lowest payrolls in Major League Baseball and a losing record. Then they brought in Billy Bean who started using data analytics and created moneyball. He challenged the assumptions about players and baseball, both of which wre based on historical structures rather than data.
Now, the security industry is in a similar situation. Security has to look at all of the data they have been collecting and change the underlying metrics to find statistics that matter. The new insights will lead to different skill sets and other forms of data to change the underlying operating model. These changes will change the security game.
Data analytics are important in leading to better tools and more business for the providers. The user community has to share more information and check more threats to provide the whole industry with samples of malware. The biggest question is what are the right questions we need to be asking of each other. Given some level of user industry cooperation and collaboration will lead to focused campaigns against the hackers.
When we change the way we look at data, and look at our existing data in different ways, we can find those attack vectors that really matter to our specific business needs. This new view will allow us to focus on relevant attacks and enable us to concentrate our resources for appropriate reactions. When we understand the attacker and can make a value judgment of our response, we can determine the probability of an attack and the ROI of types of response.
Therefore, we have to focus on the quality of our data. The underlying data will not change much, it remains fairly similar over time for a particular type of attack. Once we have some stack rank, we can assess the probability of an affect on our company and go on offense against the attackers.
The A's changes the way they did business, from trades, to drafts, and even who to field on any game. Billy Bean is here to answer some of our questions about changing the landscape. First, how do you challenge entrenched thinking?
Bean admitted to being part of the legacy thinking, but he hired an economist and other non-sports people to review the issues. These new people had different biases, but the lack of experience and emotion to baseball, which affect responses, helped to check assumptions.
When you take out the emotion with data you get different results. In a data rich environment, data analytics can enable banking on public information and give a different approach. The results made a change in the game and have flowed to other sports. Now everyone has access to more data, but one needs to identify the relevance to your desired outcomes.
Changing the looks at the data require a constant evaluation to check on the process and results. Now all sports are increasing their use of intelligence and hiring more "geeks". The process requires a continuous testing to confirm that the data-driven functions are working. You have to quantify everything possible and evaluate the results. With a good data analytics approach, you get different insights, but you have to constantly challenge assumptions and check results.
The change to a data-driven approach to players made them lose good people, but also game them more room in the salary budget to get other players. Over time, they got new people and used a rational process to find and acquire key players which other teams overlooked. I had no doubts about the process or decisions because it was like a math equation, the results of the calculations gave on other viable options.
The team management changed and put themselves at risk and put themselves on the line to go in this direction. I didn’t fear failure, because the existing system was already broken. The only constraint was the budget. Staying on the same path was a guarantee for failure. Instead, getting the right work and answers that matter made the difference. It was challenging to hire PhDs in statistics and economics into a baseball club, since the players were not used to the major use of analytics at that time.
My advice is to plan on making mistakes at first, but to constantly challenge assumptions and legacy processes. Verify your platforms or get new ones and fix any issues in the company culture. get used to not being right all of the time.
Young observed that Billy and the A's made a difference and changed baseball. They had the courage to see things through, trusted their insights, and used analytics to challenge fundamental assumptions.
The security industry has to develop greater precision on visibility, are we getting better insights or just more data. We have to stop chasing after all alerts and trust out automation to do its job. Only about 2 percent of attacks actually matter to our data and company.
We have to change the vendor-customer relationship to become a partnership. We can get better results with our new insights which can offer references and actionable information. Getting the right tools, processes, metric, and people skills are what matter. The current threat landscape offers new opportunities to make more money and improve functions for people. The challenge is to find the courage to make the necessary changes.