Beyond SIEM – Next Generation Security Analytics
I’ve written before that security is fundamentally an information management problem. It’s about having good sensors and instrumentation in the environment, having that information flow to a central repository where anomalies can be identified, and then being able to take action on it back in the environment. That’s traditionally be done through a SIEM solution, […]
Entering the era of pervasive security
I often open a keynote presentation by noting that organizations are undergoing a fundamental shift in security strategy – moving from compliance focused, to a risk based approach. That’s still ongoing, even for large and sophisticated organizations there is still a gravity towards ‘doing it for the audit’, rather than ‘doing it because there’s risk’. […]
Photo Friday – Sunset in Santa Cruz
Friday Photo – New Horizons in Warrnambool
Commander’s Intent
So all your preventative measures have failed – to be fair, they succeeded for the last few thousand hacks, but the bad guys got lucky once, and you now have a full blown incident underway. Unfortunately you (the CEO) is at 23,000’ knocking K2 off their bucket list. How does your company execute?
Friday Photo: Here’s looking at Emu
Don’t Poke the Buffalo
How much should you spend on security?
I regularly get asked by new CISOs for information – benchmarks – on how much organizations like theirs should spend on security. That’s a deceptively simple question, and while there’s plenty of surveys that you can reference, none of them provide more than a rough starting point – there’s just too many variables.
Disaster Recovery isn’t Security Recovery
I had an interesting conversation about data integrity attacks recently. Those involve altering records, rather than stealing them. The initial reaction was that they’d just restore from backup (like a disaster recovery plan). When I pointed out that most advanced attacks are in the environment for months before discovery, the light bulb went off: You […]