Security has been articulated conventionally with the three key concepts of ‘confidentiality’, ‘integrity’ and ‘availability’. However, eventually more concepts such as ‘protect’, ‘defend’ and ‘deter’ have been added to articulate the meaning of security. The discussion of security has conventionally been around these words, giving emphasis to prevention and deterrence. However, this has been changing due to the revelation of many new age attacks, increasing exposures, highly visible compromises, relatively large scale disruptions observed and surprising examples of exploitations. There are numerous ways in which these attacks, compromises and exploitation can happen. Any system built for only protection and deterrence is bound to fall short of the challenges. Hence, the focus of security deliberation is now shifting from ‘protection’ and ‘deterrence’, to detect and ‘response’. ‘Detection’, ‘Monitoring’, ‘Responding’, ‘Investigating’ and ‘Recovering’ are becoming key concepts for contemporary security deliberations.

Due to rapid digital transformation of businesses, underlying infrastructure is becoming more complex. The requests for access to organisational resources are rising multi-fold; demand of flexibility and seamless operations are bringing new devices and ways of connectivity and drive of hyper-specialization are extending an origination’s boundaries rapidly. Security threats, on the other hand, are becoming more focused and targeted, by deploying more and more sophisticated techniques. This was evident in the revelation of many targeted attacks, which deployed multi-vector, multi-channel, flexi-architecture method in the operations spread across multi-geography. Nation states add to the gravity of the problem by arranging significant resources for sophistication of techniques, development of customised attack tools and finding unknown vulnerabilities. Such advanced attacks remain in the systems for many days, months or even years before detection.

Human intervention-driven conventional methods may not really work. Many permutation and combinations, varied historical and current contexts and vast aspects are required to consider a security decision. This amounts to collecting and processing a large set of information for security decision-making. The stream of information collected from security and IT sources plays an important role in taking a real-time decision. A decision also necessitates factoring many historical contexts and developments. Historical data processing, thus, must also be an important aspect for taking effective security decision. Data science, as a field has been evolving to solve many pertinent business problems. The sheer challenges of security offer quite interesting challenges to the field of data science. Security has emerged as a critical area for application of data science.

Security Data Science is now becoming a founding block of most of the contemporary security solutions. Different use cases of security data science have been developed into solutions and many more are being discovered. DSCI Best Practices Meet (BPM) focuses on the contemporary evolution of security by organising its content and deliberations under a dominant theme. This year’s version will focus on ‘Security Data Science’. Apart from delving into fundamentals, it would extensively deliberate on different use cases of security data science that are shaping the security technology market. The Meet will also provide an opportunity to undertake review of policy development, deliberations on global issues related to security and privacy, and check the progress of cyber security industry development efforts.