Statistics is not a bad word, when it comes to Cyber Security

Statistics are what football fans are obsessing over right now.  Statistics don’t lie. But if you don’t know how to read them, then they won’t help you or your business, either. When used correctly though, they can help you see some of the clarity that otherwise would be a murky situation.

Many of you might be looking at logs each day.  The number of logs you receive can be very important.  Keeping track of the number of attacks each day allows you to see trends that can help you spot the needle in the haystack.  Sometimes these trends are hard to see, given all the noise of everyday work. For example, let’s say you normally get 100 attacks against your firewall each day, but one day you get 200.  So, you have a 100% increase in the number of attacks.  That is statistically important, and you want to pay attention to that.  But if you normally get 1000 attacks in a day and one day you get 1100, then a 10% increase really isn’t something to be as concerned about.

When my daughter was first born, she didn’t sleep through the night for 6 months.  Our doctor recommended we keep a diary.  At first, she didn’t seem to be getting any better.  She would do well for a night or two, but then regress for a week.  But if you looked at the number of good nights vs bad nights, overall there was a trend.  We couldn’t see it in our sleep-deprived minds, but when looking at it on paper it gave us hope.

If you are not using statistics in your everyday work, you should be.  Statistics will help you find that outlier that points you in the correct direction to protect your systems.  For example, if you get an alert off of lockouts, you might be missing the password spraying attack (this is an attack in which one password is tried on each user, therefore not causing lockouts) which has proven to be fairly effective.  You need to look at what you are protecting against and then try to think like an attacker.  What can an attacker use to get into your network? Focus on those areas, document and review how often you see something abnormal show up.  Once you have a baseline, it is much easier to see the outlier.

To learn more contact Thrive today to speak to one of our experts.