Homeland Security Information Network

The Homeland Security Information Network is a computer-based counterterrorism communications system connecting all 50 states, five territories, Washington, D.C., and 50 major urban areas.

The Homeland Security Information Network (HSIN) allows all states and major urban areas to collect and disseminate information between federal, state, and local agencies involved in combating terrorism.

• helps provide situational awareness
• facilitates information sharing and collaboration with homeland security partners throughout the federal, state and local levels
• provides advanced analytic capabilities
• enables real time sharing of threat information
  

This communications capability delivers to states and major urban areas real-time interactive connectivity with the National Operations Center. This collaborative communications environment was developed by state and local authorities in the United States.

Risk Analysis and the Security Survey, Third Edition - A book review

Risk Analysis and the Security Survey, Third Edition. By James F. Broder, CPP; published by Elsevier Butterworth-Heinemann; available from ASIS International, Item #1684, 703/519-6200 (phone), www.asisonline.org (Web); $60 (ASIS members), $66 (nonmembers).

"Security is an element of risk management", writes James F. Broder in his third edition of the corporate security classic text "Risk Analysis and the Security Survey". And he ably backs up that statement in this wonderfully written book, which should be required reading for all current and future security professionals.

If anything, Broder undersells the book with the title; the book’s scope is actually much broader. It could easily comprise two books: one on risk in the security profession and the other on emergency management and business continuity.

Even at over 300 pages, the book is a quick read due to its sequence of concise chapters. This edition thoughtfully updates the book to include contemporary resources and post-9-11 and post-Katrina scenarios.

Security and risk management are explained and tied together elegantly in the first 100 pages of the book. To Broder’s credit, his definitions of terms such as risks, perils (threats), hazards, and exposures closely align with those used in the academic model of risk management.

The next 150 pages are basically a retread of information available from the Federal Emergency Management Agency. While the section isn’t as impressive as the first 100 pages, it provides good information on crisis planning for kidnap, ransom, and extortion, as well as useful advice for evaluating and hiring security consultants. It also provides the building blocks of disaster management.

Appendices cover the final 100 pages or so, offering excellent resources such as sample plans, letters, and memoranda for business impact analysis. If there’s a security thinker out there whose philosophy should be studied and adopted, it’s James Broder.

Terrorism and Organized Hate Crime: Intelligence Gathering, Analysis, and Investigations - A book review

Terrorism and Organized Hate Crime: Intelligence Gathering, Analysis, and Investigations. By Michael Ronczkowski; published by CRC Press, 800/272-7737 (phone), www.crcpress.com (Web); 280 pages; $71.96.

Like any perceived phenomenon or rapid growth area, global terrorism has inspired many authors to venture into the security and intelligence fields. That's not surprising given that there is an avid audience, not least in the security profession itself, keen to grasp the essential knowledge and skills needed to manage the current and emerging terrorist threat.

Many recent works provide a scant overview for the uninformed. Others provide excellent detailed reviews suited for reference only. This book tries to strike a balance between the two, but while it has flashes of excellence, it unfortunately succeeds at neither.

The problem comes after a useful introduction on the need for understanding crime and intelligence analysis. The work appears to drift from detailed and at times academic debates on definitions of terrorism to almost naïve views on emerging computer crime and terrorist threats. Most frustrating of all, when the author identifies a bona fide challenge, he fails to follow up with possible solutions.

Best described as a sound idea with disappointing execution, this book regrettably does not fulfill its potential. Excellent in some parts and poor in others, the book may have been developed in a hurry to capitalize on market demands rather than in the time necessary for the author to display his true abilities.

Introduction to Crime Analysis: Basic Resources for Criminal Justice Practice - A book review

Introduction to Crime Analysis: Basic Resources for Criminal Justice Practice. By Deborah Osborne and Susan Wernicke; published by Haworth Press, 800/429-6784 (phone), www.haworthpress.com (Web); 156 pages; $17.95.

The field of crime analysis is growing, as many of its principles and practices overlap with the burgeoning area of homeland security. Taking the intricacies of crime analysis and transforming them into an easily understood format, the authors of this book provide a foundation for anyone interested in working in or learning about crime analysis. Readers learn a lot more than the basics, including how to use crime-mapping software and how to rise to the top of the field.

Written by two police crime analysts, the book is replete with resources to assist in gathering evidence for analyzing crime. Moreover, the authors explain the "Ten Commandments" of crime analysis as a way to inculcate best practices in the reader. The first commandment, for example, is "Thy Task is Crime Analysis. Thou Shalt Have No Other Tasks Before It," and the sixth commandment is "Thou Shalt Know Thy Jurisdiction from One End Unto the Other."

As with any new endeavor, beginners must also learn the logistics of the field. With that in mind, the authors provide useful information on how to set up a crime analysis unit and how to outline a mission statement for the unit. The authors also offer sections on staffing, education, funding, and marketing. Another section is devoted to success stories from analysts. Given its abundance of resources and forthright instruction, this book is highly recommended.

Some Online Survey Analysis Articles

"Sampling Error Software for Personal Computers" by Jim Lepkowski and Judy Bowles, reprinted from The Survey Statistician: a general review of the reasons why special software is needed to analyse survey data, and a description of eight packages for the PC.

"An Evaluation of Alternative PC-Based Packages for the Analysis of Complex Survey Data," by Steven B. Cohen (1997), The American Statistician, 51, 285-292. (Postscript file, Adobe PDF file - note that pagination is close to but not precisely identical with published version)
"Comparison of Variance Estimation Software and Methods", a report prepared by a consortium of the UK Office for National Statistics, Statistics Sweden, the University of Southampton and the University of Bath, under the sponsorship of Eurostat. (See title page for full author list.) PDF file, 41 pages, released 1999. General discussion of principles, and comparison of 5 packages with detailed description of capabilities.

"Software for Statistical Analysis of Sample Survey Data" by Barbara Lepidus Carlson, reprinted with permission from Encyclopedia of Biostatistics, Wiley, 1998. A brief discussion of variance estimation in surveys and references for a number of packages.

"Pitfalls of Using Standard Statistical Software Packages for Sample Survey Data" by Donna Brogan, reprinted with permission from Encyclopedia of Biostatistics, Wiley, 1998. An example comparing analyses using standard software to that using software that recognizes special features of survey design.

Introduction to Survey Analysis from UCLA Academic Technology Services defines some key concepts of survey analysis and gives examples from several packages. See also their Survey Analysis Portal for additional links.

Analysis of Survey Data from Household Surveys in Developing and Transition Countries from the United Nations. See Chapter 21 (by Donna Brogan) for software examples and reviews.

Survey Analysis Software Packages

Need to do surveys? Need to analyze the results? Here is some software to help.

• AM Software from American Institutes for Research
• Bascula from Statistics Netherlands
• CENVAR from U.S. Bureau of the Census
• CLUSTERS from University of Essex
• Epi Info from Centers for Disease Control
• Generalized Estimation System (GES) from Statistics Canada
• IVEware from University of Michigan
• PCCARP from Iowa State University
• R survey package from the R Project
• SAS/STAT from SAS Institute
• SPSS Complex Samples from SPSS Inc
• Stata from Stata Corporation
• SUDAAN from Research Triangle Institute
• VPLX from U.S. Bureau of the Census

WesVar from Westat, Inc

WebTAS 3.0

Here is some cool software for visualizing events over a timeline. The U.S. Military has used this for mission planning for a few years. It came from an older system called TAS (Temporal Analysis System)

According to their website:

WebTAS is a modular software toolset that supports fusion of large amounts of disparate data sets, visualization, project organization and management, pattern analysis and activity prediction, and various presentation aids.

These tools have been successfully used by many Federal and regional government organizations, and is ideally suited to distributed networks and intranets.

WebTAS provides an integrated toolbox to users needing to make sense of large and diverse sets of data. The capabilities bundled in this environment include:

• Bringing together multiple sources of data into common, fused pictures
• Sophisticated visualization components for viewing data
• Ad-HOC query of disparate data
• Trend and pattern detection
• Dynamic web content generation based on these data sources
• Easily configured domain customization

WebTAS History

WebTAS is the result of the evolution of the Temporal Analysis System (TAS) in effort to satisfy user requirements for the U.S. intelligence community. WebTAS was developed by AFRL to assist intelligence analysts with the comprehension of large amounts of information.

The TAS program was first formulated in 1988 in an effort to relieve analysts from time-consuming manual techniques. The goal was to provide intelligence analysts with tools to build and maintain event activity timelines and to observe and discover behaioral patterns via data query and visualization techniques. Once behavioral patterns are identified and modeled, WebTAS can automatically search for data, in near real-time, that matches model or models, and then alert users to these situations of interest. Based on information described in the models, WebTAS can also compute predictions of future activity.

WebTAS functionality has expanded to include more generalized features, including data representation, data access to a variety of diverse data sources, data visualization, easy-to-use user interfaces, web-based functions, extensible and pluggable interfaces, etc. WebTAS is an integration platform that has been used on many other programs.

WebTAS deployment has also expanded drastically. In addition to the intelligence community, WebTAS is now used in command and control, resource planning, drug interdicition, counter-intelligence, counter-terrorism, special operations planning, maritime suveillance, computer network defense, and many other application areas and problem domains.

WebTAS Overview
WebTAS Training
WebTAS Downloads
WebTAS White Paper

CRM Collaboration Firm SPSS Notes MarketBridge

MarketBridge, a vendor of sales and marketing services, has announced it was named SPSS (News - Alert) Systems Integrator Partner of the Year 2007 at the annual SPSS Directions User Conference in Orlando.

MarketBridge took home the Systems Integrator honor for developing joint products with SPSS, a vendor of predictive analytics software, to solve such marketing and sales problems as marketing mix optimization, improving B2B pipeline performance and leveraging "passive" market research techniques to estimate the attitudinal effects of marketing activities.

To read the Marketing Sciences white paper, ''Putting the Relationship Back in Relationship Marketing,'' detailing methods such as predictive analytics for building Relationship Marketing programs click on this link: http://www.market-bridge.com/Forms2/Relationship_Marketing.html. This summer MarketBridge (News - Alert) and SPSS formed a partnership to develop and implement marketing and sales products.

MarketBridge delivers the marketing and sales optimization side of things, customizing and installing customers' marketing analytics applications, while SPSS has the platform required to satisfy the complexity of a multi-channel marketing model.

Using SPSS' Predictive Enterprise architecture, MarketBridge has implemented a "collaborative CRM" program for a computer hardware vendor, allowing channel partners to "take advantage of the power of analytics and OEM data to build, deploy and measure campaigns," MarketBridge officials say. The partnership is being driven by the development of joint products designed to solve several marketing and sales problems, including marketing mix optimization, improving B2B pipeline performance and using passive market research techniques to estimate the attitudinal effects of marketing activities.

"For the last 15 years, MarketBridge has been increasingly focused on using analytics," says Andy Hasselwander, Vice President of Marketing Sciences. "SPSS' suite of predictive analytics products is a natural fit, for both our internal project work and for deployment within client environments."

Patrick McCue, Vice President of Worldwide Alliances for SPSS, said embedding SPSS technology inside of MarketBridge's pay-for-performance execution programs "has allowed MarketBridge to attain peak levels of performance by using predictive analytics."

Attack Tree Models

An attack tree model is a graphical representation of the possible paths or ways in which an asset can be attacked. Nodes are shown in Attack Tree Models as geometric objects like boxes, polyhedrons, etc. In an attack tree, these nodes represent goals or states that an attacker wishes to achieve.

The Root node resides at the top of the tree, and represents the overall goal of the attacker. The attacker's goals will vary depending on the type of asset being analyzed and may be broad or narrow depending on the attacker’s purpose. Examples of root goals might include: Steal company assets; Destroy a building; Damage reputation.

The attacker’s overall goal is then broken down into increasingly detailed subgoals. The Analyst gains insights by decomposing the higher-level parent goals into the lower goals that the attacker must achieve in order to prevail.

Nodes below a particular node represent subtasks and are referred to as children and the nodes above any particular node are referred to as parent nodes. Nodes two levels above are called grandparents and so on.

Risk Theory

How much security do we need? Just enough so that Security is Commensurate with Risk. What most people want when they ask for a “secure” system is one in which the level of risk is acceptable. To understand what is meant by this it is first necessary to understand the meaning of risk.

Risk (of a particular event) / Event Probability × Resulting Damage

This formula is used, with slight variations, in many fields. It is often expressed as an Annualized Loss Expectancy (ALE) in $/year. In theory, it should be easy to determine the risk of a particular type of event. All that is needed is to find out how likely it is that the event will occur and how much damage it will cause. While it is usually straightforward to estimate the impact of an incident, coming up with a figure for Event Probability is more difficult.

The probability of simple events(such as tossing a coin or rolling dice) can be determined using common mathematical principles. Real world situations are seldom this simple so this approach must be judiciously applied.

Adversary Path Diagrams or ASDs

A little something from the Department of Energy.

Sandia National Laboratories, of Albuquerque NM was assigned by the United States Department of Energy (DOE) as the lead laboratory for physical security research and development during the mid-1970’s. This initiative was intended to aid in the protection of nuclear weapons from theft or sabotage. As a part of this responsibility, Sandia developed Cost and Performance Analysis (CPA). CPA provides actionable information on the cost and effectiveness of DOE security systems.

This strategy was an integration of two existing PC-based software tools:

· ACEIT (Automated Cost Estimating Integrated Tools) developed by Tecolote Research Inc. for the U.S. Air Force. ACEIT is widely used throughout the Department of Defense (DOD). ACEIT supports costs analysis over the full life-cycle of a system;

· ASSESS (Analytic System and Software for Evaluating Safeguards and Security) developed jointly by Lawrence Livermore National Laboratories and Sandia National Laboratories for the DOE. ASSESS supports performance analysis.

CPA organizes the cost and performance data generated by ACEIT and ASSESS into Excel spreadsheets. These spreadsheets make the data more accessible to analysts and organizes the results for management.

ASSESS models the protective domain visually, and maps out Adversary Sequence Diagrams. The Adversary Sequence Diagram (ASD) is a graphical representation of physical protection system elements along paths that adversaries can follow to accomplish their objective. For a specific physical protection system and threat, the most vulnerable path can be determined.

This path with the least physical protection system effectiveness establishes the effectiveness of the total physical protection system. An ASD is developed for a single critical asset associated with an undesired event.

Modeling 7: More Complex Models

Markov chains, queuing theory, inventory theory, decision analysis and simulation are examples of probabilistic models useful to analytical loss prevention and analysis. A Markov chain consists of a set of sequential stochastic events that are independent of each other.

An example of a Markov Chain could be a typical alarm response. A specific alarm may or may not activate; if it does, it may or may not be a false alarm; if it is an actual alarm, force may or may not be required; if force is used, it may or may not be deadly physical force.

Based on this chain, the probability that deadly force will be required for any given alarm activation can be estimated. Queuing Theory and inventory theory focus on moving things or people (entities) through a system. They can help to answer questions like, “How long can I expect screening facility lines to be?” or “Where are the Risk Points of Failure in my Package Delivery Process” or “How many widgets do I need to keep in stock?”

Most of these techniques are complementary. In fact, most complex systems and issues require a combination of these tools if planners are to understand the interrelationships fully and work them toward an optimal solution.

Linear Programming is a deterministic, mathematical, problem-solving technique. It is used optimize a specific goal, such as minimizing cost or maximizing profit.

Monte Carlo simulation is commonly used in Risk Analysis, a technique for applying probability theory to business problems to build probabilistic models. We will demonstrate a fairly complex risk-based Security and Loss Prevention model later in this blog. These models enable Loss Prevention and Security management to make decisions under uncertainty (such as how should I deploy my staff and budget to minimize risk).

Simulation and role playing are most useful in decision-making when:

· The environment is changing.
· There are conflicts among the people involved.
· There is little accurate data on the intentions of the relevant people.
· The decision is important.

Sounds perfectly suited for use by Loss Prevention and Security Professionals doesn’t it?

Modeling 6: Deterministic Vs Probalistic Models

There are two categories of mathematical models used to describe security and loss prevention systems and environments – deterministic and probabilistic (also known as stochastic). The gravitational formula described in the last posting is an example of a deterministic model. This relationship between falling bodies and gravitational pull never varies regardless of circumstance – it is always the same. The size of a parachute adequate to reduce the velocity of a falling parachutist to acceptable limits can be determined using the deterministic gravitational formula, and the analysis of this phenomenon is called parametric analysis. The model is completely predictable.

Unpredictable systems have an element of uncertainty (risk) associated with them. That “normal (20,5)” access control point makes an excellent example. If the loss prevention or security practitioner were to make random, one-minute counts of traffic through that point, the individual counts would not likely consist of all 20’s (always counting 20 people per minute in each and every count). Using stochastic modeling, however, we can make intelligent and accurate predictions about the most likely capacity range of the access control point based on the known distribution information. By combining this information with the facility population, we can make very dependable decisions regarding the access control point (is it adequate, or does it pose a potentially hazardous bottleneck, etc.).

For solving problems in which we are certain of the relationships that are present within a system or process that is important to our operations, we can use linear and nonlinear programming, goal programming, network analysis and deterministic dynamic programming techniques. These are very useful tools for measuring stochastic systems because deterministic models are normally more simple and easier to manipulate than probabilistic models.

By judiciously assuming away the uncertainties in a system, we can usually identify the parts (attributes) of the system that have the greatest influence over its operation. This process focuses a problem and allows for more effective analysis of a stochastic system.

Modeling 5: Mathematical Models or Algorithms

A mathematical model expresses a physical model using mathematical formulae, or in software models, these formulae are called algorithms.

The formula A = -32 feet/second squared describes the acceleration of a body falling toward the earth (like a parachutist) as experienced by the effects of gravity. The term “normal (20,5)” could describe an access control point that processes an average of 20 people per minute. It also tells you that the number of people processed has normal variation (graphed like a bell curve) and that the standard deviation around that average is five people per minute.

Once the language of mathematics is understood, we have a powerful analytical tool for describing and manipulating complex systems (like the complex organizational systems Security and Loss Prevention practitioners must describe and manipulate).

Modeling 4: So, What Exactly is a Model?

What is a model? It is an idealized, usually simplified, representation of something that exists in the real world, or that could exist in the real world. Models have been used throughout history as people have tried to understand, describe, and influence the environment they live in. Maps and globes depicting the earth are models. Similarly, Cesare Lombroso’s late 19th century theory of criminal anthropology was a model intent on explaining the cause of, and perhaps predicting, criminal behavior.

A good model enhances understanding, stimulates thought, and can evolve until it is no longer required or useful. Medieval Portuguese maps were considerably different from modern navigational charts. Lombroso’s criminal anthropology has been considered invalid for many years, but to many criminology students, is considered to be the foundation of positivist theory. The prominent 20th century criminological theories were stimulated by Lombroso’s model. My models merge three of these criminological theories in the tactical theft factor measurement systems to create yet a new model.

Modeling 3: Modeling and Simulation Today

Today’s business planners have at their disposal an entire discipline that is widely practiced, known as Operations Research. The methodologies my group use draw heavily upon the Operations Research methodologies, and so you will see much of that on my blog. Quantitative Risk Analysis and Quantitative Forecasting are, essentially, mathematical modeling of business processes. The cost of modeling and computer simulation is well within the reach of managers with modest resources. In addition, the cost of a bad system or bad decision (particularly in the Security industry) is significantly greater than it was 30 years ago. Given these facts, modeling and simulation are emerging as viable, even necessary tools for the modern manager.

Modeling 2: Modeling and Simulation in History

Military strategic models and simulations have been effectively used since Count Schlieffen, Chief of the German General Staff utilized simulation and gaming to plan for the German two-front campaign during World War I. Germany again used simulation and gaming to plan the Blitzkrieg strategies of World War II. The U.S. Secretary of Defense, Robert McNamara used Monte Carlo gaming techniques during the Vietnam War. However, U.S. decision-makers ignored the predictions that limited bombing of North Vietnam would not be effective. The result of ignoring these predictions is now a lesson to modern military planners. The Federal Government of the United States and many other organizations have used mathematical modeling and computer simulations since the late 1950’s as aids in developing policies, conducting research and development, and engineering complex systems. Initially, when mathematical modeling was young, the computing resource costs were beyond the means of most managers and analysts. In fact, for most applications, the cost of modeling or simulating a system was greater than the cost of a bad system.

Forecasting 2: An Example of Simple Forecasting for Security

The National Express Corporation (NexCo) is a package delivery company, and it’s losses have been fairly stable for the past four years. Losses are recorded as records in the Corporate Loss Prevention Case Management System (CMS). It is now the end of the fiscal year (June thru May) and Raymond Cole has been requested by management to do a loss forecast for June. Ray has records going back for five years in the CMS, and can easily query the losses from his database. Ray believes that NexCo’s loss environment (due to employee turnover) has changed substantially over the years, and losses from years ago have little or no effect on June’s losses, and so focuses only on losses for the previous fiscal year. May’s losses, however, seem rather erratic compared to previous losses, and Ray feels he should use Excel to prepare a better forecast. He decides to use the previous year’s losses to prepare the spreadsheet model.

To be continued...

Forecasting 1: Introduction to Security Forecasting

Loss Prevention and Security Management need to have an idea of what the future holds in order to appropriately staff, budget and plan. However, changing employee markets, theft motivation, personnel attitudes, management attitudes, business practices and technology ensure they may never be certain how to reach their goals.

Analysts may extrapolate the future business trends based on historical records, however, and this process is called forecasting. If loss patterns are stored in a database (even paper or spreadsheeted records may be used) then the analyst can use these records to forecast future losses. Many sophisticated forecasting applications are available, and costs of these applications can run into the tens of thousands of dollars. Fortunately, Microsoft Excel contains many sophisticated forecasting tools, and their use is fairly simple. To illustrate the use of Excel to do basic forecasting (and even some more advanced techniques in future posts). We will develop a hypothetical case study using the fictitious National Express Company (NexCo).

The Police Executive Research Forum

I've found a new source of analytical data...the Police and Executive Research Forum or PERF. They are pushing collaborative resilience with their Clergy/Police Leadership Program, and offer lots of free research information.

Here is what their website says about the Police Executive Research Forum

Mission

The Police Executive Research Forum (PERF) is a national membership organization of progressive police executives from the largest city, county and state law enforcement agencies. PERF is dedicated to improving policing and advancing professionalism through research and involvement in public policy debate. Incorporated in 1977, PERF's primary sources of operating revenues are government grants and contracts, and partnerships with private foundations and other organizations.

We are proud of the service we provide to law enforcement stakeholders. Our research and publications are targeted in areas our members find important to their agencies and for professional development. Our conferences and training programs are targeted to audiences who want to be on the cutting edge of relevant policing topics. Our leadership is constantly looking for ways of improving our ability to meet your dynamic needs. You will find out more about what PERF is all about in this, our information section of our member network.

Origins

Ten leaders of large American law enforcement agencies created the Police Executive Research Forum in 1976 as a national membership organization that would foster debate, research and an openness to challenging traditional police practices.

Membership

PERF general members lead larger police agencies in the United States and around the world; their jurisdictions are often the seedbeds of the toughest problems and hard-won solutions in policing. They collectively serve a majority of the U.S. population.

Subscribing and sustaining members include police chiefs and executives from smaller jurisdictions, personnel below the rank of chief from all police agencies, researchers and scholars, and others interested and involved in the criminal justice field. All members must be committed to PERF’s founding principles and possess a four-year college degree from an accredited educational institution.

Governance

PERF is governed by a member-elected President and Board of Directors and a Board-appointed Executive Director. A staff of 30 full-time professionals is based in Washington D.C.

Taking a Leadership Role

PERF assumes leadership on the difficult issues facing police. We encourage debate among members and the wider criminal justice community on controversial issues that affect public safety; fear of crime; and fair, humane treatment of all members of society. PERF is a leading voice in the media, legislative arena and among policy-makers for progressive policing. Two examples of PERF initiatives include:

Balancing Crime Strategies and Democratic Principles

Nationwide concern about perceived police misconduct in a number of urban, particularly minority, communities prompted PERF to convene police chiefs and community leaders to discuss anti-crime measures and police tactics. One significant result was PERF’s commitment to develop best-practice guidelines for traffic stops, which have been frequent flashpoints of discord between police and minority citizens.

Reducing Violent Crime Through Clergy-Police Collaboration

PERF assembled a group of major city police chiefs, clergy and government officials from around the country to explore clergy-police anti-violence initiatives. Community leaders and police officials shared their experiences with policy-clergy collaboration—a promising strategy to counteract the crime endemic to so many urban American neighborhoods.

The Medici Effect

In his book by the same title, Frans Johansson calls the proliferation of new ideas “the Medici effect”—referring to the remarkable burst of creativity enabled by the Medici banking family in Renaissance Italy.

The assumption is that the best and brightest will find one another and collaborate to innovate, facilitated by the technology itself.

Johansson explains that three driving forces

1) the movement of people
2) the convergence of scientific disciplines
3) and the leap in computational power

are increasing the number and types of intersections we can access.

Fred Smith of FedEx also is making a big splash about the concept of "Access", and I'll explore that later too.

What marks an organization as being analytically sophisticated?

According to Thomas H. Davenport and Jeanne G. Harris in their incredibly timely and insightful book, Competing on Analytics, there were four common key characteristics:
1) Analytics supported a strategic, distinctive capability
2) The approach to and management of analytics was enterprise-wide
3) Senior management was committed to the use of analytics
4) The company made a significant strategic bet on analytics-based competition

Modeling 1: Introduction to Security Modeling and Simulation

The whole point of a model is to present information in such a way that complex material becomes understandable.

Businesses have been using mathematical modeling techniques for many decades in order to streamline processes, to make management decisions and to forecast future trends, risks and events. Science and engineering have used mathematical modeling and statistics to describe natural phenomena for over a century and a half. Weather models predict, prevent, and warn against natural disasters and forecast the weekend weather. Farmers would find it even more difficult to be profitable without forecasting models.

More to come...

Modeling 2

Business Resilience Forum in London

On November 28th I presented to the Business Resilience Forum in London, England I had the priveledge of meeting with some of the top people in this field, and I'll feature some of their information in here over the next few days. My agenda was:

Innovating information sharing across the enterprise

• Understanding how a new approach to intelligence gathering can facilitate the security of a global corporation and aid key external partners
• Creating the conditions for information on threats, vulnerabilities, and challenges to be sourced and shared throughout every level of the enterprise
• Enfranchising the entire employee-base with the ability to contribute to corporate security

Security Analytics Debut

Today I'm excited to announce the debut of the Security Analytics Blog. Over the next few weeks, we'll begin to flesh out the structure of our subject matter, and I'll list links to some of our data, wiki's, websites and other resources. I hope this effort is useful.