liveBookmanning.com

What you will learn in Data-Driven Cybersecurity

Reducing risk with proven metrics

by Mariano Mattei
Foreword by Joseph Steinberg

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• metricA quantitative measure derived or interpreted using statistical methods to assess performance, conditions, or change under uncertainty.
• dashboardA dashboard is an interactive or static visual interface that presents consolidated metrics and data for monitoring and decision-making.
• security postureCybersecurity posture is the overall state of an organization's security controls, practices, capabilities, readiness, and exposure to cyber risk.
• mean time to detectTime to detect is the elapsed time between a security incident or breach and its identification.
• incident responseThe incident response life cycle is the sequence of activities through which a cybersecurity incident is detected, analyzed, contained, resolved, and recovered from.
• threat detectionAdvanced threat detection is the proactive identification and mitigation of potential cybersecurity threats using monitoring, anomaly detection, predictive analytics, or AI-driven models.
• anomaly detectionAn anomaly is an observation or activity that deviates significantly from an expected pattern or reference value.
• risk assessmentRisk assessment is the process of identifying, analyzing, and evaluating risks to determine their significance and acceptability.
• information security continuous monitoringContinuous monitoring, including Information Security Continuous Monitoring (ISCM), is the ongoing observation and analysis of systems, networks, and activity to maintain visibility into security conditions and identify relevant changes or events.
• complianceCybersecurity compliance is conformity with applicable security requirements, standards, regulations, or framework controls.
• derived metricA derived metric is a metric calculated from a combination of other metrics or data over time.
• business goalA strategic objective is a desired high-level organizational outcome that guides priorities, initiatives, and resource allocation.
• time to respondTime to respond is the elapsed time between detecting a security incident and taking a response or mitigation action.
• machine learningA machine learning algorithm enables a system to learn patterns from data and make predictions or decisions without explicitly programmed rules.
• optimizationAn iterative process of assessing, planning, implementing, testing, evaluating, and refining changes to tools and processes.
• CVSSA CVSS score is a numerical severity rating assigned to a software vulnerability using the Common Vulnerability Scoring System.
• insightAn actionable insight is an interpreted finding that can directly inform a decision or corrective action.
• governanceThe system of leadership, oversight, decision rights, policies, and accountability through which an organization directs and controls cybersecurity.
• mean time to resolutionThe average elapsed time required to resolve security incidents.
• artificial intelligenceArtificial intelligence is the field of computing concerned with building systems that perform tasks commonly associated with human intelligence, such as inference and generation.
• communication planA communication strategy is a planned approach for conveying information to defined audiences through appropriate messages, channels, and timing.
• statisticsStatistical analysis is the application of statistical methods to summarize data, evaluate relationships, and draw conclusions under uncertainty.
• security controlA safeguard, policy, procedure, or practice designed to prevent, detect, limit, or respond to cybersecurity risk and protect information systems.
• thresholdA threshold is a defined boundary for judging whether a measured security condition represents an acceptable level of risk or requires action.
• Exploit Prediction Scoring SystemAn EPSS score estimates the probability that a vulnerability will be exploited in the wild.
• risk managementThe process of identifying, assessing, prioritizing, and addressing risks to organizational information systems, assets, data, and capabilities.
• accuracyAccuracy is the proportion of evaluated instances that a classification model labels correctly.
• generative modelingGenerative AI is artificial intelligence that creates new content such as text, images, audio, or code from learned patterns.
• predictive analyticsPredictive modeling is the construction of statistical or computational models that estimate likely future or unknown outcomes from data.
• direct metricA direct metric is a metric collected and measured directly from the phenomenon it represents.
• containment timeThe average elapsed time required to contain a cybersecurity incident after it has been detected.
• language modelA neural model trained on extensive text data to predict and generate language.
• automationAutomation is the execution of tasks or responses by systems with minimal direct human intervention.
• uptimeThe degree or proportion of time that a system is operational and accessible when needed.
• proxy metricA metric drawn from other business measurements that provides cybersecurity insight when considered with direct or derived metrics.
• risk exposure scoreA quantitative score estimating an organization's overall security risk from factors such as vulnerability severity and recent incidents.
• security trainingAn educational program that develops users' knowledge and behaviors for recognizing, preventing, and responding appropriately to security threats.
• mitigationThe application of actions that reduce the likelihood or impact of an identified risk.
• data collectionData collection is the gathering of security-relevant data from sources such as logs, network traffic, endpoint activity, and cloud APIs.
• software supply chain securityThe process of identifying, assessing, monitoring, and mitigating cybersecurity risks arising from supply-chain partners, dependencies, and external providers.
• NIST CSFNIST Cybersecurity Framework v2.0 is the 2024 version of NIST's voluntary framework for managing and improving cybersecurity risk.
• correlationA correlation is a statistical measure describing the strength and direction of association between variables.
• soarA SOAR is a security technology that orchestrates and automates actions across multiple systems in response to security events.
• authorizationAuthorization is the process of determining and granting permitted access to resources or operations after an identity or entity has been established.
• ATLASATLAS is a structured methodology for establishing, monitoring, evaluating, and adapting security metric thresholds.
• completion rateA training completion rate is the percentage of designated participants who complete a specified training program.
• encryption useThe degree to which required encryption controls are consistently implemented across applicable data, systems, storage, transmission, and backups.
• multifactor authenticationAn authentication method requiring two or more independent factors to verify a user's identity.
• securityInformation security is the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
• data breachA cybersecurity incident in which data, systems, or networks are compromised through unauthorized access, theft, or another form of compromise.
• indicator of compromiseAn indicator of compromise is an observable artifact or behavior suggesting that a system or environment has been compromised.
• cause analysisA systematic technique for identifying the underlying reasons an adverse event occurred so that its problems can be addressed and recurrence prevented.
• WazuhWazuh is an open-source security platform for threat detection, file-integrity monitoring, vulnerability detection, and compliance analysis.
• residual riskResidual risk is the risk that remains after mitigation or other risk-treatment efforts have been applied.
• shared-responsibility modelShared responsibility is an operating pattern in which a cloud provider secures the underlying infrastructure while the customer secures its data and workloads.
• visualizationA chart or graph is a graphical representation of data or relationships used to communicate patterns, trends, comparisons, or changes.
• false rejectionA false rejection rate is the proportion of matching or authorized cases incorrectly rejected by a detection or classification process.
• operational efficiencyThe degree to which an organization produces intended operational outcomes with minimal wasted time, effort, or resources.
• patch managementThe process of identifying, prioritizing, testing, deploying, and tracking software updates that remediate defects or vulnerabilities.
• compliant document ratioThe proportion of assessed entities or activities that satisfy specified requirements.
• false acceptance rateA false acceptance rate is the proportion of nonmatching or unauthorized cases incorrectly accepted by a detection or classification process.
• predictive threat indexThe predictive threat index is a metric that estimates the probability of future cybersecurity incidents from historical attacks, threat intelligence, and real-time monitoring.
• postincident analysisIncident analysis is the systematic process of examining incident evidence to determine events, causes, scope, effects, and corrective actions.
• failed login attemptA failed login attempt is an unsuccessful effort to authenticate to an account or system.
• security information and event managementA SIEM is a security technology that collects, correlates, and analyzes event data to identify potential security problems and generate alerts.
• cybersecurity forensicsForensic analysis is the detailed examination of systems, data, and artifacts to reconstruct events and preserve findings for investigative or legal use.
• cybersecurity metrics programA structured organizational program for defining, collecting, analyzing, and reporting cybersecurity measurements to guide security decisions and improvements.
• secure codingA secure coding practice is a software development practice that prevents or reduces security weaknesses in source code.
• heat mapA heatmap is a matrix or spatial visualization that encodes values using color intensity.
• phishingA phishing attack deceives targets into disclosing information, executing actions, or providing access by impersonating a trusted source.
• false positiveA false positive is a security classification that incorrectly identifies legitimate behavior or activity as a threat.
• risk exposure indexThe risk exposure index is a composite metric that quantifies an organization’s overall risk from vulnerabilities, exploitation likelihood, and business impact.
• executive dashboardAn executive dashboard is a dashboard that summarizes high-level performance, risk, and strategic information for organizational leaders.
• likelihoodA measure of how probable a particular threat or attack vector is, based in this context on its observed frequency in threat intelligence feeds.
• return on investmentA measure of the gain or value produced relative to the resources invested.
• asset managementAsset management is the process of identifying, tracking, and governing an organization's hardware, software, and information assets.
• LM StudioLM Studio is a desktop application for downloading, running, and interacting with language models through a graphical interface.
• annualized loss expectancyAnnualized loss expectancy is the expected financial loss from a particular risk or threat over one year.
• annualized rate of occurrenceAnnual rate of occurrence is the estimated frequency or likelihood of a security incident or threat event within one year.
• business impact analysisBusiness impact analysis is a process for evaluating how disruptions, risks, or vulnerabilities could affect organizational operations and objectives.
• compensating controls assessmentA compensating controls assessment evaluates alternative safeguards that reduce the risk associated with a weakness or missing primary control.
• exposure factorAn exposure factor is the percentage of an asset's value expected to be lost if a specified security incident occurs.
• risk prioritizationRisk-based prioritization ranks remediation or security actions according to likelihood, potential impact, exploitability, and organizational context.
• single loss expectancySingle loss expectancy is the estimated monetary loss resulting from one security incident or threat event.
• trustA customer's confidence that an organization will act reliably, securely, and in the customer's interests.
• principle of least privilegeThe security principle and access-control practice of granting each subject only the minimum permissions required to perform authorized tasks.
• ransomwareRansomware is malicious software or an attack operation that denies access to data or systems, typically to extort payment.
• human-in-the-loopHuman oversight is the review, supervision, or intervention by people in an automated system's operation and decisions.
• resilienceAn organization’s ability to prepare for, withstand, adapt to, and recover from disruptive events such as cyberattacks.
• cost reductionA measurable reduction in expenditure or avoided cost resulting from an action, investment, improved efficiency, or avoided losses.
• recallRecall is the proportion of actual instances in a class that a classification model correctly identifies.
• threat modelThreat modeling is a structured analysis of possible threats, attack paths, vulnerabilities, and mitigations for a system or design.
• trend detectionTrend analysis is the examination of changes and patterns in data over time to identify direction, persistence, or emerging developments.
• security analyst dashboardA dashboard tailored to security analysts that presents operational data for detecting, investigating, and responding to security incidents.
• tabletop exerciseA tabletop exercise is a discussion-based exercise in which participants examine roles, decisions, and responses to a simulated incident or scenario.
• cybersecurity incident countThe total number of security incidents detected within a specified time period.
• patch complianceThe degree to which systems have received required software patches within specified requirements or timeframes.
• time to patch vulnerabilitiesTime to patch is the elapsed time between identifying a vulnerability and applying a corrective software or configuration patch.
• deep learningDeep learning is a machine-learning approach that uses neural networks with multiple learned layers to represent complex patterns.
• organizational contextThe mission, objectives, leadership expectations, structure, values, and operating conditions that shape an organization's cybersecurity direction.
• authenticationA system that verifies an entity's identity before granting access to a resource or service.
• AI-powered threat detection systemAn AI-powered threat detection system is a security system that applies artificial intelligence and machine learning to identify cybersecurity threats.
• classifierClassification is the task of assigning observations to one or more predefined classes based on their attributes.
• dynamic risk assessmentDynamic risk scoring is the continuous assignment and updating of risk scores for assets, users, or events as current security information changes.
• biasBias is a systematic distortion in an AI model or its outputs that produces consistently skewed assessments across cases or groups.
• security assessmentA security threat and risk assessment is a structured evaluation of threats, vulnerabilities, and potential consequences associated with a system or change.
• random forestA random forest is an ensemble machine-learning model that combines predictions from multiple decision trees.
• support vector machineA support vector machine is a supervised-learning model that separates classes or predicts values by constructing a boundary based on support vectors.
• social engineeringSocial engineering manipulates people into revealing information, granting access, or performing actions that compromise security.
• authentication success rateAuthentication success rate is the proportion of authentication attempts that successfully verify an authorized identity.
• clusteringClustering is a data-analysis technique that groups observations according to similarity without requiring predefined labels.
• continuous improvementA feedback loop is an iterative process in which outputs or observations inform subsequent adjustments to a system or process.
• key performance indicatorA key performance indicator is a metric selected to evaluate progress toward an important organizational objective or performance target.
• NIST SP 800-30A NIST Special Publication that provides guidance for conducting risk assessments of information systems and organizations.
• operational continuityThe ability to maintain essential organizational operations without interruption during or after disruptive events.
• local averagingA simple moving average is the arithmetic mean of observations within a fixed-length sliding window.
• identity and access managementThe administration of digital identities and the credentials, authentication, authorization, and access rights associated with them.
• cross-functional collaborationCoordinated work among people or teams with different functional responsibilities toward a shared outcome.
• risk-based approachA decision-making approach that prioritizes cybersecurity actions and resources according to assessed risk and potential impact.
• secure by designAn engineering approach that incorporates security considerations and controls throughout the design and development life cycle.
• vulnerabilityA vulnerability is a weakness in a system, application, or configuration that can be exploited to compromise security.
• anomalous behavior detection rateAnomalous behavior detection rate is the proportion of true anomalies detected among the abnormal behaviors identified by a detection system.
• accountabilityThe condition in which individuals or groups are responsible for assigned decisions, tasks, and outcomes.
• corrective actionA corrective action is a measure intended to address an identified cause of a problem and prevent its recurrence.
• crossover error rateAn equal error rate is the operating point at which false acceptance and false rejection rates are equal in a biometric system.
• recovery point objectiveA recovery point objective (RPO) is the maximum acceptable amount of data loss, expressed as the time between the latest recoverable copy and a disruption.
• recovery time objectiveA recovery time objective (RTO) is the maximum acceptable time needed to restore a system or service after disruption.
• cybersecurity budget ratioThe amount or proportion of an organization’s information-technology spending allocated to cybersecurity activities and resources.
• compliance statusA metric indicating the degree to which an organization satisfies the requirements of applicable compliance frameworks.
• risk exposureRisk exposure is a measure of the potential loss or harm an organization faces from identified risks.
• anomalyAn outlier is an observation that lies unusually far from the expected distribution or reference pattern.
• classification reportA classification report is a summary of evaluation metrics for the predicted classes of a classification model.
• confusion matrixA confusion matrix is a table that cross-classifies predicted classes against actual classes to show correct and incorrect classification outcomes.
• f-scoreThe F1-score is the harmonic mean of precision and recall for a classification class.
• precisionPrecision is the proportion of instances predicted as a class that actually belong to that class.
• time to predictTime to predict is the elapsed time from when a potentially threatening anomaly or relevant data becomes detectable until an AI system generates a sufficiently confident prediction to prompt action.
• file integrity monitoringFile integrity monitoring is the observation of files to detect unauthorized or unexpected modifications.
• phishing detection rateThe proportion of phishing attempts that a security defense successfully detects.
• data encryption coverageThe ratio of systems protected by encryption to systems that are not protected by encryption.
• time to reportMean time to report is the average elapsed time required to report a cybersecurity incident.
• natural language processingNatural language processing is the computational analysis and generation of human language.
• intrusion detection systemAn intrusion detection system monitors activity or traffic to identify suspected unauthorized access, attacks, or policy violations.
• security strategyA cybersecurity strategy is an organization's coordinated plan for protecting digital systems, networks, and data while managing cybersecurity risks.
• critical assetA vital application or software system that processes important data or supports essential business activities.
• biometricsAn authentication method that identifies a person using distinctive physiological or behavioral characteristics.
• threat feedA threat intelligence feed is a continuously supplied data stream containing information about cyber threats and indicators.
• gap analysisGap analysis is the systematic comparison of a current state with a desired state to identify deficiencies that require remediation.
• chief information security officerThe senior organizational leader responsible for directing information security strategy, governance, and risk management.
• traditional metricA cybersecurity measurement that quantifies the effectiveness of existing controls, typically through retrospective indicators such as incident reports or post-event analysis.
• supplierAn external supplier, service provider, or other organization that delivers products, services, or dependencies to an organization.
• Common Vulnerabilities and ExposuresCommon Vulnerabilities and Exposures is a standardized catalog and identifier system for publicly known cybersecurity vulnerabilities.
• impactImpact is the potential damage or adverse consequence resulting from a threat exploiting a vulnerability.
• riskThe potential for loss, harm, or adverse impact arising from a threat exploiting a vulnerability or hazardous condition.
• ELK stackThe ELK stack is a collection of Elasticsearch, Logstash, and Kibana components for collecting, searching, analyzing, and visualizing data.
• false-positive rateFalse positive rate is the proportion of analyzed events or classifications that incorrectly identify legitimate activity as a threat.
• incident response teamAn incident response team is a designated group responsible for coordinating the analysis, containment, response, and resolution of security incidents.
• OllamaOllama is a tool for running and interacting with large language models locally through command-line and API interfaces.
• risk ratingA risk score is a numerical or ordinal value representing the assessed severity or potential impact of a security risk.
• TLSTLS is a cryptographic protocol that provides secure communication over a network by protecting data confidentiality and integrity and authenticating endpoints.
• security programA cybersecurity program is an organized set of governance, processes, controls, and activities for managing an organization's cybersecurity.
• HIPAA audit success rateA metric measuring the percentage of HIPAA compliance audits passed without significant findings.
• HITRUSTA formal attestation that an organization has met the applicable HITRUST control and assessment requirements.
• implemented principleThe implemented principle is the control-rating dimension representing the actual execution of policies and procedures.
• managed principleThe managed principle is the control-rating dimension representing ongoing governance and improvement of cybersecurity practices based on measurements.
• measured principleThe measured principle is the control-rating dimension representing ongoing evaluation of the effectiveness of cybersecurity controls and practices.
• policy principleThe policy principle is the control-rating dimension representing high-level strategic direction, purpose, and scope.
• prescriptive frameworkA prescriptive framework is a framework that specifies detailed steps, controls, and measures for achieving and maintaining a defined security state.
• risk mitigation velocityRisk mitigation velocity is the elapsed time required to resolve an identified cybersecurity risk, with lower values indicating faster mitigation.
• validated assessmentA validated assessment is an authorized evaluation performed according to an approved method to determine adherence to specified requirements.
• bar chartA bar chart is a visualization that represents categorical values with rectangular bars to support comparison.
• METRICS methodologyA book-specific methodology for aligning cybersecurity measurement, evaluation, threshold setting, and reporting with organizational compliance and risk objectives.
• proactive measurement strategyA proactive measure is a preventive cybersecurity action that anticipates threats and reduces the likelihood of incidents.
• behavioral analysisBehavioral analysis is the examination of observed actions and activity patterns to identify deviations, threats, or other meaningful behavior.
• penetration testingAn authorized simulated attack used to identify exploitable weaknesses in systems, applications, or networks.
• secure configurationA secure configuration is a hardened system or service configuration that minimizes unnecessary exposure and unsafe settings.
• decision treeA predictive model that recursively partitions data through feature-based decision rules arranged in a tree structure.
• alert fatigueAlert fatigue is the reduced attention to or disregard of security alerts caused by an excessive volume of alarms, especially false alarms.
• reinforcement learningReinforcement learning is a machine-learning approach in which an agent learns decisions by interacting with an environment and optimizing cumulative feedback.
• data at restData at rest is data stored on a persistent medium rather than actively moving across a network or being processed.
• network segmentationNetwork segmentation is the division of a network into isolated or separately controlled segments to limit traffic and restrict the spread or reach of attacks.
• security awareness and training metricA quantitative measure of the scope, participation, effectiveness, or outcomes of a cybersecurity education program.
• business contextThe organizational purpose, operational significance, and surrounding circumstances that determine how an asset supports business activities.
• detection and responseDetection and response is a cybersecurity strategy for identifying security threats and responding to them to minimize damage.
• baselineA baseline is a reference characterization of expected system or user behavior against which deviations are evaluated.
• transferred bytesBytes transferred is a measure of the volume of data transmitted from or to a system during a specified interval.
• endpoint detection and responseEndpoint detection and response is a security technology that continuously monitors endpoint activity, detects suspicious behavior, and supports or performs automated response actions.
• potential breach assessmentA potential breach assessment evaluates security gaps or misconfigurations that could enable unauthorized access or data compromise without an incident having occurred.
• reactive measureA reactive measure is a cybersecurity action taken after an incident to limit damage and restore normal operations.
• risk acceptanceRisk acceptance is a risk response strategy in which an organization acknowledges a risk and chooses not to take additional treatment action.
• risk avoidanceRisk avoidance is a risk response strategy that removes a risk by discontinuing or changing the activity, system, process, strategy, or technology that creates it.
• risk transferA risk response strategy that shifts responsibility or financial consequences for a risk to another entity.
• mean time to predictMean time to predict is the lead time with which a predictive cybersecurity system forecasts a potential threat before it occurs or requires response.
• total hardware assetA physical computing, networking, or medical-device component owned or managed by an organization.
• total software assetA software application, service, or program owned or managed by an organization.
• datasetA structured collection of data observations and attributes prepared for analysis or computational use.
• detection rateThe proportion or frequency with which a detection system correctly identifies relevant security events or threats.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.