General security

Data analytics in cybersecurity

The National Institute of Standards and Technology (NIST) has created the NICE framework to help standardize the terminology used to describe cybersecurity roles. The role of a cyber data analyst is defined within this framework, along with the tasks and requirements for an individual to be able to operate effectively within the role.

What is a cyber data analyst?

As the name suggests, a cyber data analyst performs data analysis in a cybersecurity context. More specifically, the NICE framework defines the role as analyzing data from multiple sources in order to produce conclusions that would be useful for improving privacy or security.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

The cyber data analyst is responsible for data throughout its life cycle, from generating requirements to reporting conclusions. This includes the analysis as well as designing and implementing algorithms and processes for large-scale datasets.

What does a cyber data analyst do?

The job of a cyber data analyst is to use data analysis techniques to create useful intelligence to improve security and privacy. To do so, the analyst needs to be competent in all stages of data collection and processing:

1. Defining Needs: The analyst needs to identify gaps where data collection is necessary for analysis
2. Data Collection: While the analyst may not collect the data, they should understand what is possible in order to appropriately define collection needs
3. Analyze Data: The analyze must perform any necessary pre-processing (outlier detection, gap analysis, normalization and so on) and then perform the actual analysis
4. Drawing Conclusions: Based on the data collected and the analysis, the analyst should be able to prove or disprove any hypotheses
5. Visualization and Reporting: The analyst needs to know how to make visuals and report results in a form that is understandable to customers or stakeholders

While this analysis process is important, it is not the entirety of the analyst’s job. The analyst is also responsible for ensuring that they have the resources necessary to effectively perform analysis. This can include acquiring and maintaining tools, managing data storage and processing infrastructure and developing any processes necessary to perform analysis.

What do I need to know?

The role of a cyber data analyst spans several disciplines. In order to be effective, the analyst needs to understand the fundamentals of computer science for identifying and collecting data, data analysis for processing and analyzing the collected data and cybersecurity for understanding, collecting and drawing conclusions on the data.

Computer Science

A cyber data analyst needs to have a solid grasp of the fundamentals of computer science in order to perform their job roles effectively. These fundamentals are valuable for all stages of the data analysis process, from identifying the necessary data (and where it can come from) through processing it and drawing conclusions in an efficient and scalable manner.

From a practical perspective, computer science is necessary for identifying the types of data that can be collected and how to collect that data. An analyst should be familiar with operating system internals, Identity Access Management (IAM) systems, databases, networking and any other systems where they may need to perform collection actions. They also should be competent at programming and use of the command line to enable data collection and aid in processing.

Analysts should also be familiar with the theoretical side of computer science. Important concepts include the fundamentals of mathematics that underlie algorithms and data science, machine learning and information theory.

Data Science

Once an analyst has collected the necessary data, they need the skills to analyze it. Many of these skills fall within the field of data science.

As mentioned previously, a cyber data analyst needs to perform preprocessing of data, analyze it, draw the correct conclusions and present them in a way that is accessible to any stakeholders or customers of the analysis. It is important to perform these steps properly to avoid introducing artifacts or other errors into the analysis, so understanding of best practices in the field of data science is useful for the cyber data analyst.

Another important consideration when dealing with data analytics is the storage of collected data. A cyber data analyst should be familiar with databases, data mining and data warehousing to ensure that data is stored in a way that is accessible but also meets any necessary security requirements for the data.

Cybersecurity

The skill sets mentioned previously are largely independent of the type of data analysis being performed. Of course, a cyber data analyst also requires a background in cybersecurity.

Cyber data analysts often work to identify potential weaknesses or vulnerabilities in networks or endpoints, either from an offensive or defensive perspective. An analyst should understand common vulnerabilities, the threats that they pose and ways to manage these risks. It is also important to understand the potential impacts of insufficient or non-existent security controls and how to address these within an organization’s risk management strategy.

With the increasing number of privacy regulations, collection and processing of sensitive data has become more difficult. A cyber data analyst needs to be aware of the laws and regulations in all relevant jurisdictions and how to structure their operations to comply with any applicable operations.

How do I get started?

Many different resources exist for the person wanting to expand their knowledge. For those without the time or resources for a four-year degree in computer science, data science and cybersecurity, it’s possible to perform online self-study or enroll in a bootcamp for certain skill sets.

For those who want a bit of structure, it might be worth pursuing the Certified Ethical Hacker (CEH) exam to cover the practical computer science and cybersecurity knowledge. This certification is designed to enable someone to collect data from endpoints and networks and is extremely useful for identifying potential sources of data. For the data science knowledge, there are some world-class courses offered on educational platforms like Coursera and edX with the option to earn certificates or micro-degrees on the subject.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Sources

• NICE Cybersecurity Workforce Framework, NIST
• NICE Framework Supplement: Specialty Areas and Work Roles and Tasks, NIST (download)
• NICE Framework: Competency Mapping, NIST (download)
• Certified Ethical Hacker Certification, EC-Council