{"id":4076,"date":"2018-10-01T10:00:14","date_gmt":"2018-10-01T09:00:14","guid":{"rendered":"https:\/\/citysecuritymagazine.com\/?p=4076"},"modified":"2022-05-05T16:28:59","modified_gmt":"2022-05-05T15:28:59","slug":"big-data-analytics-in-security","status":"publish","type":"post","link":"https:\/\/citysecuritymagazine.com\/security-technology\/big-data-analytics-in-security\/","title":{"rendered":"The benefits of big data analytics in security"},"content":{"rendered":"

Big data analytics in security – helping proactivity and value creation<\/strong><\/h1>\n

Using the principles of big data analytics and security intelligence can create a number of benefits and value for security departments and their organisations. This article outlines how the wealth of data captured by security departments through their various activities or systems is being used in novel ways to identify and resolve risks.<\/em><\/p>\n

Identify risks<\/h4>\n

The wealth of data which security departments capture through their various activities or systems is being used in novel ways to identify and resolve risks (exceptions) which otherwise would go unnoticed until they manifest into issues. The principles of these novel approaches are sometimes classified into \u2018Security Intelligence\u2019 and \u2018Behavioural Analytics\u2019.<\/p>\n

To share a few examples:<\/p>\n

A global bank: \u00a0<\/strong>employing \u00a0more than 1<\/strong>50,000 people with over 100 sites across the world was keen to identify instances where their people were \u2018remote\u2019 logging into their IT systems despite being (physically) inside their premises. Such exceptions relate to possible duplication of an identity record, which is a serious threat. As the bank discovered, the \u2018best\u2019 (cheap, quick and replicable) way for them to approach this was to apply simple principles of data integration and visualisation across their logical and physical access control systems. By doing so, the security team was notified of any such exceptions in real time. This allowed for an instant investigation and helped the bank mitigate their risk significantly.<\/p>\n

A Fortune 500 organisation<\/strong> had multiple reported cases of expensive equipment stolen from different buildings around the main campus area. They suspected the thefts were occurring after hours but analysis of access records from their physical access control systems alone wasn\u2019t very helpful. They had hundreds of people working late at that site on a regular basis so they were unable to identify a manageable number of suspects. But, by applying analytical intelligence to an integrated set of time and attendance data; and physical access data, they were able to resolve this. They first defined a \u2018usual\u2019 behaviour of an individual and groups of individuals, i.e. which areas they access the most and at what times. Then they looked for exceptions, i.e. if certain individuals or groups accessed certain areas at times which fell outside their \u2018usual\u2019 behaviour.<\/p>\n

By doing this analysis, a single employee stood out and his access pattern also coincided with the thefts. The next time the employee entered a new area after his normal hours, the Security Operations team was notified following which a guard was sent to inspect the building. The thief was caught red-handed. This approach not only helped them resolve a mystery but also provided them with a strategy to prevent similar activities in the future.<\/p>\n

A highly secure Research and Development organisation<\/strong> spent enormously each year to perform background checks for every person accessing their campus. Reduction of their security budget led them to change their policy such that they decided to perform \u2018risk assessments\u2019 on each individual and they re-ran checks only on those who represented the highest risk. However, this simply led to a cut in the frequency of checks and raised their risk significantly. So it was critical they re-defined the way in which they derived their \u2018risk assessments\u2019.<\/p>\n

They started by factoring each individual\u2019s level of access, the time they had been with the organisation and the time since they last went through a background check. This information was coupled with their known \u2018behaviour\u2019 (which areas they access frequently and at what times) to compute a \u2018Risk Score\u2019. Background checks were mandated for individuals with a high Risk Score and those who showed a sudden increase in their overall Risk Score. This helped a great deal in maintaining their high security levels (no issues reported since) whilst reducing their operational cost by approximately 85%.<\/p>\n

Benefits of Big Data Analytics in Security<\/h4>\n

There are several other use cases, which highlight the benefits and values which security departments are creating using the principles of \u2018Security Intelligence\u2019 and \u2018Big Data Analytics\u2019.<\/p>\n

To outline a few:<\/p>\n