DtR Episode 80 - Lies, Damned Lies, and #InfoSec Statistics [Guests: Jay Jacobs, Bob Rudis]

In this episodeJay and Bob talk about their new bookA discussion on using data as 'supporting evidence' rather than gut feelingsDo we have actuarial quality data to answer key security questions?A discussion on "asking the right question", and why it's THE single most important thing to doBob attempts to ask security professionals to use data we already have, to be data-drivenJay tells us why he wouldn't consider "SQL Injection" a "HIGH" risk ranking - and why data challenges what you THINK you knowQuick shout out to Allison Miller on finding the little needles in the big, big haystackWe think about why security as an industry needs to start looking outside of itself to get its data - nowJay discusses how there is a definite skills shortage in working with large data sets, and doing analysisI ask whether there is a chicken and egg problem in large-scale data analysisBob brings up the "kill chain" and whether we really need real-time data analysis for attacksBob makes a pitch for having a "Cyber CDC" ... stop laughingJay laments the absolute bonkers problems dealing with information sharing (when you don't have any to share)Jay urges you to "count and compare" GuestsJay Jacobs ( @JayJacobs ) - www.linkedin.com/pub/jay-jacobs/3/896/4b0, Jay is currently a Principal at Verizon BusinessBob Rudis ( @hrbrmstr ) - www.linkedin.com/in/hrbrmstr, Director. Enterprise Security, IT Risk Management at Liberty Mutual Insurance & Co-author of Data-Driven SecurityHave something to say? Let's hear it.Support the show>>> Please consider clicking the link above to support the show!-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHqLinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/X/Twitter: https://twitter.com/dtsr_podcast