Organizations are recognizing that data scientists can play a valuable role in enterprise IT security. However, effective security requires a collaborative effort between data scientists and security professionals within an enterprise. While data scientists have a pivotal role to play, they cannot and should not operate in a vacuum.
Leveraging Data Science to Mitigate Security Risk
Data science is a field of research that involves analyzing massive data sets to extract useful information. In the context of security, data scientists analyze raw data received from IT infrastructure in order to identify trends, uncover patterns, and predict behaviour. The conclusions that data scientists reach about raw data can help security teams stay one step ahead of potential threats to their IT systems. However, the integration of data science with security is about more than just analytics. It is about breaking down siloed approaches to enterprise security, and creating an environment where data scientists and security professionals work together to achieve their common goals.
Knowing is Half the Battle
Data scientists cannot maximize their contribution to enterprise IT security without knowing the domain within which they operate. That is, data scientists cannot know how to enhance a security system without first knowing the details of what it is that they are tasked with enhancing. Security professionals are domain experts, and therefore they carry specialized knowledge of their space – they know the usefulness of certain data, the security objectives of the enterprise, the problems that need to be solved, and the questions that need to be asked. If this domain knowledge is not communicated to data scientists, security analytics might not produce the results that the particular enterprise wants or needs. It can be argued that the success of data science in security is not only influenced by the domain expertise of security teams, rather it is fundamentally dependent on it. Effective enterprise IT security requires an approach that combines the detailed technical skillset of data scientists with the big picture outlook of domain experts.
Furthermore, since security professionals are ultimately the ones who will make use of data scientists’ conclusions, the way these conclusions are communicated is particularly important. The sophistication of data scientists’ conclusions mean nothing if those conclusions cannot be clearly communicated to security professionals and business strategists in a way that they can comprehend.
Contributors – Lisa Douglas, Randeep Nijjar, and Catherine Chen.
