How Can Analytics Transform Cybersecurity?

TL;DR

Cybersecurity can advance by applying analytics at scale to the vast data generated by connected devices. Examples from fertility tracking and protein-folding games show that codified, shared data can address deeply human and technically complex problems, suggesting that security teams should pursue radical innovation instead of limiting themselves to incremental improvements or merely documenting IoT weaknesses.

Transcript

Good afternoon. Good afternoon, everybody. Welcome, welcome. Welcome to RSA Conference 2017. How's everybody doing? Has it been a good conference so far? Yeah. Wow, excellent. Wow, some people still have the wristbands from, uh, from earlier. That's terrific. Well, thanks so much for taking the time to be here at this session. I, I, I wanna take a ... Read More

Key Insights

• Cybersecurity is a young discipline that has been forced to mature quickly, so its future depends on learning from other dynamic fields and embedding innovation into everyday work rather than relying only on gradual improvements.
• Digital transformation is producing a massive network of connected devices across homes, offices, and governments. This network generates, enriches, and codifies data at rates described as unfathomable, creating both security risks and major opportunities for analytics.
• Analytics is capable of producing deeply human outcomes, even though it is often discussed as cold, sterile mathematics. Glow illustrates this potential by combining personal information from many users and analyzing it to provide fertility-related advice to couples.
• The quantified-self movement is based on using inexpensive sensors to measure personal characteristics such as walking, breathing, athletic performance, blood sugar, and heart rate. Many practices that initially appeared fringe later became mainstream through continuously recording wearable devices.
• Glow claims that 400,000 babies had been conceived by its users. The example connects large-scale data analysis with the emotionally difficult experience of wanting a child and being unable to conceive, demonstrating why mission-focused analytics can matter beyond technical performance.
• Foldit works by translating the biological rules of protein folding into the rules of an addictive online game. Players gain points while contributing effort to complex medical problems, even when they do not possess formal knowledge of biology.
• Aggregated participation can produce results greater than isolated work. Foldit combines the time, creativity, and energy of many individual players, and the resulting collective work has supported journal publications and progress in medical areas including efforts to fight Ebola.
• IoT security discussions are largely focused on exposing weaknesses, including hacked cars, toasters, cameras, botnets, and distributed denial-of-service attacks. A more ambitious future would apply analytics at scale and communicate device properties through standardized, label-like security information.

Questions & Answers

Q: How can analytics transform cybersecurity?

Analytics can transform cybersecurity by processing the enormous quantities of data generated, enriched, and codified by connected devices. The talk argues that the industry should pursue radical innovation and learn from fields that already combine large datasets effectively. Instead of concentrating mainly on exposing hacked devices and attacks, security professionals could develop scalable systems that characterize devices and clearly communicate their properties.

Q: Why does cybersecurity need radical innovation?

Cybersecurity needs radical innovation because it is a young discipline that has been forced to mature quickly while digital transformation changes work, daily life, and society. Incremental improvements may not set a sufficiently ambitious standard. The proposed approach is to study how other fields apply analytics to large datasets, reconsider what the security industry could become, and raise expectations for its future capabilities.

Q: What does the quantified-self movement demonstrate about data?

The quantified-self movement demonstrates that inexpensive sensors can codify detailed information about individuals, including how they walk, breathe, exercise, and perform under different conditions. Participants can analyze their own measurements and share data with others. Although many early practices seemed fringe, continuous personal recording later became mainstream through products such as Apple Watch and Fitbit, according to the talk.

Q: How does Glow use shared data and analytics?

Glow is described as a fertility application through which couples can enter details about themselves, their habits, and their eating patterns. The service combines this information with data supplied by many other users, applies analytics, and offers advice. Glow claims that 400,000 babies had been conceived by its users, connecting data analysis with the deeply emotional challenge of trying to have a child.

Q: What cybersecurity lesson comes from the Glow fertility app?

The Glow example shows that analytics should be evaluated by the human outcomes it can support, not only by its mathematical techniques. Although analytics is often described in cold or sterile terms, its application to fertility can address an intensely personal problem. For cybersecurity, the lesson is to define an ambitious, mission-focused outcome and then use shared data and analysis in service of that goal.

Q: How does Foldit turn individual activity into useful research?

Foldit turns protein folding into an online game whose rules correspond to biological rules. Players focus on earning points and solving game challenges, while their activity contributes to difficult medical problems. Many participants do not know biology, but their time, creativity, and energy can be aggregated. The talk says this collective work has supported prestigious journal articles and progress in areas such as fighting Ebola.

Q: What can cybersecurity learn from Foldit's crowdsourcing model?

Cybersecurity can learn that people working separately may create a powerful collective result when their efforts are structured and aggregated effectively. Foldit does not require every participant to be a biology expert, because the game translates a scientific problem into accessible activity. A comparable security model could combine distributed contributions, device information, or analytical work so the whole becomes more valuable than isolated efforts.

Q: What is the proposed security-label concept for IoT devices?

The proposed concept is a standardized description resembling the food label on a box of Cheerios. Every IoT device could provide it physically or transmit it as part of a handshake. The label could communicate properties of the device, including immutable properties mentioned in the talk. The broader goal is to move IoT security beyond publicizing hacks toward systematic, analytics-supported understanding of connected devices.

Summary & Key Takeaways

• Cybersecurity is a young discipline operating amid rapid digital transformation and the proliferation of connected devices. Those devices form a massive network that generates, enriches, and codifies data at extraordinary rates. The central opportunity is to apply analytics at scale, drawing lessons from fields that have already used large datasets successfully.

• The quantified-self movement demonstrated how inexpensive sensors could measure personal behavior, health, and performance. Practices once considered fringe later became mainstream through devices such as Apple Watch and Fitbit. The movement also produced applications such as Glow, which combines voluntarily supplied personal data and analytics to offer fertility-related guidance to its users.

• Foldit shows another model for innovation by turning protein folding into an online game governed by biological rules. Participants can contribute time and creativity without understanding biology, while their combined efforts address complex medical problems. Cybersecurity could similarly aggregate distributed activity and data to create outcomes greater than isolated individual contributions.

• The cybersecurity industry should raise its ambitions beyond exposing weaknesses in hacked cars, appliances, cameras, and IoT botnets. A more advanced model would analyze devices at scale and communicate their security characteristics clearly, potentially through standardized information resembling a food label that is attached physically or transmitted during a handshake.