Page 591 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Many organizations use large databases, known as data warehouses,
to store large amounts of information from a variety of databases for

use with specialized analysis techniques. These data warehouses often
contain detailed historical information not normally stored in
production databases because of storage limitations or data security
concerns.

A data dictionary is commonly used for storing critical information
about data, including usage, type, sources, relationships, and formats.

Database management system (DBMS) software reads the data
dictionary to determine access rights for users attempting to access
data.

Data mining techniques allow analysts to comb through data
warehouses and look for potential correlated information. For
example, an analyst might discover that the demand for lightbulbs
always increases in the winter months and then use this information

when planning pricing and promotion strategies. Data mining
techniques result in the development of data models that can be used
to predict future activity.

The activity of data mining produces metadata. Metadata is data
about data or information about data. Metadata is not exclusively the
result of data mining operations; other functions or services can
produce metadata as well. Think of metadata from a data mining

operation as a concentration of data. It can also be a superset, a
subset, or a representation of a larger dataset. Metadata can be the
important, significant, relevant, abnormal, or aberrant elements from
a dataset.

One common security example of metadata is that of a security
incident report. An incident report is the metadata extracted from a
data warehouse of audit logs through the use of a security auditing

data mining tool. In most cases, metadata is of a greater value or
sensitivity (due to disclosure) than the bulk of data in the warehouse.
Thus, metadata is stored in a more secure container known as the data
mart.

Data warehouses and data mining are significant to security
professionals for two reasons. First, as previously mentioned, data