Stop splitting security into silos
Dec 11th, 2021 by Jesper Kråkhede
Following my previous post, let me go a bit further on the technical side of seeing the whole environment.
Most IT organisations are split by technology: servers, clients, network, cloud, applications. Security has often followed the same split. One team for endpoint protection, one for the firewalls, one for identity, one for the SIEM. Each team buys its own tools and each tool has its own console.
The result is that an attack that touches all of those areas, and they all do, has to be pieced together manually across five consoles and five teams. In an incident that takes days we don´t have.
So what does it look like when it works? The detection tools share signals. An alert on a laptop is connected to the identity that was used, the servers it logged on to and the mail that started it. The investigation happens in one place, with one timeline. And the response can act on all layers at once: isolate the machine, disable the account, block the mail, all from the same incident.
You don´t need one vendor for everything to get there, but the tools must talk to each other, and somebody must own the whole chain.
Attacks don´t respect your silos. Your defence shouldn´t either.