You can´t defend what you can´t see
Jul 13th, 2021 by Jesper Kråkhede
A short question for management: If an attacker logged on to one of your servers with a stolen admin account last night, would you know?
In the incidents I work on, the answer is almost always no. Not because the company didn´t have tools, but because nobody had the full picture. The firewall logs were in one place, the server logs in another, the cloud logs nowhere at all. And the people who could have connected the dots were looking at their own small part.
Knowing what happens in your environment is the foundation of all security. Without it you don´t know if your protection works, you don´t know when you are under attack and, when the worst happens, you can´t tell how the attacker got in or what he took. That last part matters a lot when you have to report to regulators, customers and the press.
So what should management ask for? Logs from the important places: identity, endpoints, servers, cloud services and the most sensitive data. Kept long enough to investigate an attack that started months ago. Brought together where someone actually looks at them. And people with the time and skills to do it, in house or as a service.
It doesn´t have to be the most expensive solution. It has to be the one that gives you the picture.
What you can´t see, you can´t defend.