http://www.darkreading.com/database/3-inconvenient-truths-about-big-data-in/240160352

"People say if you have all of your data in one place, you'll magically get the security benefit. That's not true," he says. "It's a ton of data -- you can dig into it, and you can find stuff. You can obviously find some good security benefit to having this data. But it doesn’t come for free."

Even more distressing to Moore, though, is the insecure infrastructure backing many big data security analysis tools -- homegrown or otherwise.

"We see a lot of stuff in development around big data toolkits -- things like Mongo and Cassandra -- and there's not a lot of security built into these tools," he says. For example, MongoDB doesn't support SSL by default, and there isn't the same level of security offered in similar tools as more established traditional relational databases. "It's actually pretty frightening how insecure these tools are by default, yet they're becoming the back-end for most of the big data services being sold today."

Meanwhile, organizations are consolidating their risks into these systems by aggregating huge stores of security metadata, log files, and more in order to do large-scale analysis.

"Organizations are doing whatever they can to get all of their data in these central locations," he says. "You're making these really juicy targets for someone to go after. Everyone kind of cringes when we look at some of those big password breaches in the past, but that's nothing compared to a multiterabyte data leak."

Not only are organizations putting their sensitive security data in one giant basket, but it is a rickety one at that.

Moore believes that with the greater proliferation of service providers, the insecurity in many of the products they're using and the growing list of important customer data held by these providers make a big breach inevitable, and very soon.

"One thing that's almost guaranteed to happen in the next year is we're going to see one of the large providers of analytics services -- whether security, log data, or something else -- get breached," he says. "It's just the law of averages at this point. There's enough folks offering services who don’t necessarily know what they're doing that we're going to see a big breach."