Three steps to improve data fidelity in enterprises

Dependency modeling

Dependency modeling is used to define the desired outcome and how to achieve it. For example, in order for a legitimate alert to occur, a sensor must recognize an environmental perturbation.

For the sake of argument, we will avoid the signature versus anomaly detection discussion at this point in time. The main point here is that when an alert occurs, a process runs differently than when normal non-alerts occur.

Data processing takes a different path, and all of this is dependent upon such items as memory, processing cycles and bandwidth. Dependency modeling covers the gathering, ordering and quantities associated with data contextualization.

When examining network traffic, dependency models show the flow of traffic from client to server and back to include traffic values associated with router data, domain name system, web server and other server session data that is required for the communication to occur. These sessions have characteristics that are consistent and measureable and can be quantified for predictive purposes.

Resilience

Resilience processing deals with the fact that the mission goals may be under attack and that successful planning requires robustness, redundancy, resourcefulness and rapidity. Here, again, we find the need to understand what components are critical to successful planning, including environmental variables.

Additionally, organizations should consider prioritizing and determining which functions require redundancies and under which conditions. Finally, resiliency introduces a temporal component into the model. The temporal component becomes another variable that helps to bind the solution and increase accuracy in predictions.

Reliability

Thirdly, the reliability component recognizes not only the temporal component, but also the environmental component -- hence the requirement that the environment be defined when attempting to model reliability.

However, environments are not always static. In fact, the environment in the cybersecurity world is rather dynamic. For this reason, processing states should be defined. Processing states can be generally defined within the terms of the operational profile, a numerical model of operations in the environment.

The measurements taken to obtain the operational profiles in the various meta-states of processing -- startup, idle, normal, busy, stressed, failing and dead -- will in some cases support variance -- normal, busy, stressed and failing.

In other cases, variance suggests behavior that may coincide with a compromise -- startup and idle. The most important part is that the states be defined and included in the planned operating environment. Many of the variables associated with the required metrics used in network operational profiles are the same variables that can be obtained from quality of service data.

How this differs from traditional anomaly detection

It's important to note how this processing differs from traditional anomaly detection processing. The differences occur in two main areas: first, the session-oriented nature of the work, and second, the binding of environmental variables to the data objects being observed and providing the basis for security operations.

Simply put, alerts can be manipulated; however, when a true alert occurs, other areas of the network that have not been historically monitored can reveal traces of the event. These environmental traces can be thought of as the waves that appear when water is disturbed.

If we envision the virtual environment as the water that surrounds a rock in a lake, when the rock is disturbed, we can examine the ripple pattern in addition to the rock. Similarly, when the data in a virtual environment is disturbed, the environment that surrounds that data is also disturbed, and you can see the ripples if you choose to look for them. The three disciplines of dependency modeling, resilience and reliability can assist you to make the task manageable and ensure data fidelity.