97 Things Every Information Security Professional Should Know

Chapter 86. Know Your Data

Steve Taylor

There are known knowns, things we know that we know; and there are known unknowns, things that we know we don’t know. But there are also unknown unknowns, things we do not know we don’t know.

― Donald Rumsfeld

While sounding deeply philosophical and being fun to say out loud, the former Secretary’s quote is quite true when it comes to information security. Whether it is logs, alerts, vulnerability scans, threat intelligence, or asset inventory, data is the life blood of a security professional. To be good at information security, you need to understand your data—both what it tells you and what it does not tell you.

Known Knowns

On the surface, your security data is usually straightforward:

• The firewall logs can tell you what source tried to connect to what destination on what port, and if a rule allowed or denied the connection.

• Reports from your vulnerability assessment tool can tell you which endpoints are missing what patches.

• Windows security log events can tell you which account logged on to a machine and the logon type used.

Fully understanding the details of what each data source can provide is key to seeing where your data overlaps. Knowing this, you can pivot across your entire data estate to make interesting deductions. Consider the case of a lateral movement risk:

• An inventory of local groups can tell you that Alice is an ...