CyberTRIZPEDIA

Cybersecurity Visibility vs. Data Volume

Apply data-minimisation principles to telemetry collection, retaining only operationally valuable logs to balance detection capability with storage and privacy obligations.

CyberTRIZ analysis · Cyber contradiction C133 · one of 8,235 worked contradictions published by CyberTRIZ.AI

Regulations

EU_GDPRISO_27001NIST_PRIVACY_FRAMEWORKCOBIT2019

Overview

Collecting large amounts of security data improves visibility into organizational activity but also increases storage requirements, operational costs, and analytical complexity. Excessive data collection may overwhelm analysts instead of improving decision-making. Traditional organizations frequently assume that more data automatically leads to better security. CyberTRIZ recommends collecting information according to operational value and business risk, prioritizing quality, relevance, and actionable intelligence over raw volume.

Practical Example

A SOC retains detailed telemetry for internet-facing systems while summarizing lower-risk operational logs, improving visibility without unnecessary storage costs.

TRIZ principles applied

P02 Taking OutP03 Local QualityP23 Feedback

Controls that address this (22)

EU_GDPR-CTRL-001 - Daily safeguarding reconciliationoperational · critical priority · Daily reconciliation between safeguarded customer balances, core ledger balances and safeguarded bank accounts. Variances above EUR 100 mustEU_GDPR-CTRL-002 - Critical ICT incident reportingoperational · critical priority · All major ICT incidents impacting payment services, customer data or availability must be classified within 4 hours and reported under DORA EU_GDPR-CTRL-003 - GDPR breach notification workflowoperational · critical priority · Personal data breaches must be assessed within 12 hours and reported to the Belgian DPA within 72 hours where risk to data subjects exists.