book

Data-Driven Cybersecurity

Name: Data-Driven Cybersecurity
Author: Mariano Mattei
ISBN: 9781633436107

by Mariano Mattei

July 2025

Beginner to intermediate

352 pages

11h 11m

English

Manning Publications

Read now

Unlock full access

Data-Driven Cybersecurity
copyright
contents
dedication
foreword
preface
acknowledgments
about this book
about the author
about the cover illustration

Part 1 Building the foundation
1 Introducing cybersecurity metrics
1.1 Understanding metrics1.2 Significance of metrics in cybersecurity1.3 Traditional vs. innovative metrics1.4 The changing landscape of cybersecurity1.5 The importance of frameworks in cybersecurity1.5.1 HITRUST framework1.5.2 Center for Internet Security CIS Top 18 framework1.5.3 NIST Cybersecurity Framework v2.01.6 AI and predictive cybersecurity metrics1.7 Defending against AI
2 Cybersecurity analytics toolkit
2.1 Tool selection2.1.1 Key tool selection factors2.2 Dashboard development2.2.1 Choosing the right metrics2.2.2 Knowledge points2.2.3 Dashboard example2.3 Statistical analysis2.3.1 Trend analysis2.3.2 Correlation analysis2.3.3 Probability distribution2.4 Integrated security analytics environment2.4.1 Integrated security analytics environment exercise2.5 Continuous improvement and iteration2.5.1 Iteration techniques2.5.2 Continuous improvement cycle
3 Implementing a security metrics program
3.1 Introducing metrics program design3.1.1 Key components of a security metrics program3.2 METRICS methodology3.2.1 Measure3.2.2 Evaluate3.2.3 Threshold3.2.4 Report3.2.5 Improve3.2.6 Communicate3.2.7 Sustain3.3 Using the METRICS methodology example3.3.1 Step 1: Measure3.3.2 Step 2: Evaluate3.3.3 Step 3: Threshold setup3.3.4 Step 4: Report3.3.5 Step 5: Improve3.3.6 Step 6: Communicate3.3.7 Step 7: Sustain3.3.8 Exercise summary3.4 Building a metrics dashboard3.4.1 Different dashboards for different stakeholders3.4.2 Security dashboard example3.5 Tools and technologies for metrics collection3.5.1 Open source tools for metrics collection3.5.2 Commercial tools for metrics collection3.5.3 Automation and integration3.5.4 Scripting for metrics collection3.6 Common pitfalls in metrics programs3.6.1 Pitfall 1: Overreliance on quantitative metrics3.6.2 Pitfall 2: Misalignment with business goals3.6.3 Pitfall 3: Stagnation and complacency
4 Integrating metrics into business strategy
4.1 Business alignment4.1.1 Business-aligned security metrics example4.1.2 Mapping metrics to business performance4.1.3 Supporting innovation with metrics4.2 Security metrics alignment with business strategy exercise4.2.1 Step 1: Understanding MediHealth’s business objectives4.2.2 Step 2: Selecting key metrics4.2.3 Step 3: Mapping metrics to business goals4.2.4 Step 4: Measuring metrics4.2.5 Step 5: Communicating the Metrics4.3 Security metric reporting4.3.1 Presenting metrics in executive reports4.3.2 Demonstrating return on investment4.3.3 Communication strategies4.3.4 Metrics communication exercise
Part 2 The metrics that matter
5 Establishing the foundation
5.1 Governance5.2 Organizational context5.2.1 Understanding the differences between mission, vision, and values5.2.2 Strategic objectives5.2.3 Organizational metrics5.2.4 Organizational metrics exercise5.3 Risk management strategy5.3.1 Risk mitigation5.3.2 Risk management metrics5.3.3 Risk management metrics exercise5.4 Roles, responsibilities, and authorities5.4.1 Roles, responsibilities, and authorities metrics5.4.2 Roles and responsibilities metrics exercise5.5 Policy, processes, and procedures5.5.1 Policy, processes, and procedures metrics5.5.2 Policy, processes, and procedures metrics exercise5.6 Oversight5.6.1 Governance structure5.6.2 Simulated governance structure5.6.3 Governance exercise5.6.4 Oversight metrics5.6.5 Oversight metrics exercise5.7 Cybersecurity supply chain risk management5.7.1 Supply chain risk management practices5.7.2 Cybersecurity supply chain risk management metrics5.7.3 Supply chain risk management metrics exercise5.8 Governance metrics5.9 Answer to exercise 5.6.3
6 Foundations of cyber risk
6.1 Identify6.2 Asset management6.2.1 Asset management metrics6.2.2 Asset management metrics exercise6.3 Risk assessments6.3.1 NIST 800-30: Guide for conducting risk assessments6.3.2 Risk assessment metrics6.3.3 Risk assessment metrics exercise6.4 Continuous improvement6.4.1 Continuous improvement metrics6.5 Identity metrics exercise
7 Protecting your assets
7.1 Identity management, authentication, and access control7.1.1 Authentication7.1.2 Access control7.1.3 Identity and credential management7.1.4 Context-based identity proofing and credential binding7.1.5 User, service, and hardware authentication7.1.6 Identity assertion, protection, conveyance, and verification7.1.7 Access permissions management7.1.8 Physical access controls7.1.9 Types of security controls7.1.10 Identity management, authentication, and access control metrics7.1.11 Identity and access management dashboard exercise7.2 Awareness and training7.2.1 Awareness and training metrics7.2.2 Awareness and training metrics exercise7.3 Data security7.3.1 Data at rest7.3.2 Data in transit7.3.3 Data in use7.3.4 Data backup and recovery7.3.5 Data security metrics7.3.6 Data security metrics exercise7.4 Configuration management7.4.1 Software maintenance7.4.2 Hardware maintenance7.4.3 Log maintenance7.4.4 Unauthorized software prevention7.4.5 Secure software development7.4.6 Platform metrics7.4.7 Platform security metrics exercise7.5 SDLC testing exercise7.6 Technology infrastructure resilience7.6.1 Networks7.6.2 Environmental threats7.6.3 Resilience mechanisms7.6.4 Resource capacity7.7 Protection metrics7.8 Answer to exercise from section 7.5
8 Continuous threat detection
8.1 Implementing continuous threat monitoring systems8.1.1 Defining strategy8.1.2 Establishing architecture, implementing data collection, and analysis8.1.3 Responding to findings8.2 Open source alternative to continuous threat detection8.3 Continuous monitoring metrics8.3.1 Continuous monitoring metrics exercise8.4 Understanding ATLAS8.4.1 ATLAS methodology8.4.2 Review and update8.4.3 ATLAS benefits8.5 Determining valid threat detections8.5.1 False rejection rate8.5.2 False acceptance rate8.5.3 Equal error rate8.5.4 FRR, FAR, and EER metrics8.5.5 FRR, FAR, and ERR exercise8.6 Adverse event analysis8.6.1 Adverse event analysis metrics8.6.2 Adverse event analysis metrics exercise8.7 Alternatives to ATLAS and Wazuh
9 Incident management and recovery
9.1 Incident management9.2 Planning and preparation9.3 Testing an IRP9.3.1 Tabletop exercise example9.3.2 Tabletop exercise metrics9.3.3 Table for tabletop exercise evaluation sample9.4 Detection and documentation9.4.1 Three-tier severity model9.4.2 Five-tier severity model9.4.3 Changing severity over time9.4.4 Practical example of incident documentation9.4.5 Chain of custody9.4.6 Incident management metrics9.4.7 Incident management metrics exercise9.5 Incident triage and analysis9.5.1 Case study: Financial institution data breach9.5.2 Incident metrics9.5.3 Incident metrics exercise9.5.4 Incident metrics table9.6 Notification and communication9.7 Containing validated incidents9.8 Evidence gathering and forensic analysis9.9 Eradication of incidents9.9.1 Incident response metrics9.10 Recovering to operational status9.11 Post-incident and lessons learned9.11.1 Incident reporting and communication metrics9.11.2 Incident reporting and communication metrics exercise
Part 3 Beyond the basics: Advanced analytics, machine learning, and AI
10 Advanced cybersecurity metrics
10.1 Risk exposure and predictive analysis10.2 Risk exposure and predictive metrics10.2.1 Risk exposure index10.2.2 Predictive threat index10.2.3 Risk exposure and predictive metrics exercise10.2.4 Using open source tools to calculate REI and PTI10.2.5 How cybersecurity teams work together with open source solutions10.3 Advanced threat detection10.3.1 Anomaly detection10.3.2 Time to predict10.3.3 Dynamic risk scoring10.3.4 Advanced threat detection metric exercise10.4 Effectiveness of AI in cybersecurity10.4.1 False-positive suppression rate10.4.2 AI-based decision accuracy rate10.4.3 Effectiveness of AI in cybersecurity exercise10.5 Cloud and network threat management10.5.1 Cloud threat detection10.5.2 Cloud threat detection accuracy10.5.3 Attack surface index10.5.4 Cloud and network threat management metric exercise10.6 Incident management10.6.1 Threat hunting10.6.2 Incident impact estimation10.6.3 Incident management metric exercise10.7 Continuous improvement10.7.1 Risk mitigation10.7.2 Time to predict10.7.3 Continuous improvement metric exercise
11 Advanced statistical analysis
11.1 Continuous improvement with statistical metrics11.1.1 Key concepts for continuous improvement11.1.2 Free resources for statistical analysis11.2 Using statistical metrics for continuous improvement11.3 Implementing a feedback loop11.4 Finding hidden relationships in data11.5 Using moving averages to track trends11.5.1 Moving averages example11.5.2 Detailed description of the plots11.6 Grouping similar events for better insights11.7 Forecasting cybersecurity trends11.7.1 ARIMA in action11.8 Bayesian inference11.8.1 Interpreting the results11.9 Statistical models for vulnerability management11.9.1 Interpreting the results
12 Advanced machine learning analysis
12.1 Code requirements12.1.1 What is AI12.2 DBSCAN for threat detection12.2.1 DBSCAN example12.3 Random forest and SVM for threat detection12.3.1 Random forest and SVM exercise12.3.2 Isolation forest and autoencoders exercise12.4 Natural language processing12.4.1 NLP exercise12.5 Deep learning12.5.1 Deep learning exercise12.6 Reinforcement learning12.6.1 Reinforcement learning example in Python code
13 Generative AI in cybersecurity metrics
13.1 Understanding generative AI13.2 Open source generative AI alternatives13.2.1 LM Studio13.2.2 Ollama13.2.3 LM Studio vs. Ollama13.2.4 Why we chose LM Studio for this chapter13.3 A note on LLMs13.4 Prompt engineering13.4.1 Why prompt engineering matters13.5 Prompt engineering in cybersecurity13.5.1 Basics of prompt engineering13.5.2 Open source vs. cloud API integration13.6 Generating and analyzing cybersecurity data13.6.1 Generating synthetic cybersecurity data13.6.2 Analyzing the output13.7 Enhancing reporting and visualization13.7.1 Failed login reasons reporting13.8 Automating incident response and trend analysis13.8.1 Setting the context13.9 Exploring generative AI13.9.1 Learning resources13.9.2 Inspiration to experiment13.9.3 Your next steps13.10 Limitations and ethical considerations

Content preview from Data-Driven Cybersecurity

2 Cybersecurity analytics toolkit

This chapter covers

Key components of a cybersecurity toolkit
How to choose the right tools
Designing insightful dashboards
Statistical analysis for threat detection
How to integrate AI in security analytics

A cybersecurity analytics toolkit consists of multiple integrated tools that work together to support various stages of security analytics. The main components for any specific scope include data collection, processing, visualization, and automation. Each of these tools enhances the efficiency and effectiveness of security teams. Figure 2.1 demonstrates the composition of each toolkit, highlighting how various parts operate within the defined scope.

Figure 2.1 Cybersecurity toolkit consisting of ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Data-Driven Cybersecurity, Video Edition

Publisher Resources

ISBN: 9781633436107Publisher Support Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Data-Driven Cybersecurity

by Mariano Mattei