Knowledge From Security Vulnerabilities

• Data Sources – The first level of the pyramid (bottom) necessitates the collection and integration of data from a variety of primary and secondary sources of varying origin and type. The sources are primarily data from cybersecurity operational systems, but they may also include structured or unstructured organizational data, as well as data from third-party providers. The data from these data sources is loaded and stored in a database (data warehouse) designed to support Vulnerabilities Intelligence analyses, and it is used to feed mathematical models and analysis methodologies that aid decision-makers.
• Data Exploration (transform data into information) – At the second level of the pyramid, there are the tools used to conduct a passive Vulnerability Intelligence analysis, including query and reporting systems and statistical methods. These are called passive methodologies because decision-makers are asked to generate prior hypotheses or define data extraction criteria before using analysis tools to find answers and confirm their original insight. As a result, they may wish to test their hypothesis using extraction and visualization tools, followed by a statistical test to ensure that data adequately support their conclusions.
• Data Mining and Optimization (transform information into knowledge) – The third level of the pyramid contains active Vulnerability Intelligence methodologies for extracting knowledge from information, as well as optimization models for selecting the best solution from a set of alternative actions. These include mathematical models for pattern recognition, machine learning, and data mining techniques. Active models, unlike the tools described at the data exploration level, do not require decision-makers to develop any prior hypotheses to be validated later. Instead, they want to expand the decision-makers’ knowledge.
• Decisions – Finally, the top of the pyramid represents the choice and actual adoption of a specific decision, and thus the natural conclusion of the decision-making process. Even when Vulnerability Intelligence methodologies are available and successfully implemented, decision-making is left to the decision-makers, who may also use informal and unstructured data to adapt and modify the recommendations and conclusions reached through mathematical models.

Vulnerability Intelligence provides increasingly sophisticated active support tools from the bottom to the top of the pyramid. Roles and competencies shift as a result. The required competencies are primarily provided by the organization’s information systems specialists, who are located at the bottom of the pyramid (e.g., cybersecurity experts). Analysts and experts in mathematical and statistical models supervise the intermediate phases. Finally, the activities of decision-makers in charge of the application domain are dominant at the top.