The cost of session recording
May 25th, 2023 by Jesper Kråkhede
A follow-up for management on session recording.
Session recording has a price that is easy to underestimate. The licences for the PAM features. The storage, because video of every admin session adds up quickly, especially if you keep it for a year. The operation of the recording infrastructure. And the people needed if anyone is actually going to review the recordings, which is rarely budgeted at all.
Then there are the hidden costs. Admin work through a recorded session is often slower. Some tools don´t work well through the recording proxy, so exceptions are created, and every exception is a gap.
Is it worth it? Sometimes. If a regulator requires it, or if you need to monitor external suppliers working in your most critical systems, recording can make sense. It can also have a deterrent effect: people behave better when they know they are recorded.
But if the goal is to detect and investigate attacks, the same money gives a lot more in other places. Good logging and an EDR on all servers. A SOC with time to look at what it collects. Or simply a few more weeks of an engineer´s time to clean up privileged access.
With limited resources, every krona spent on video is a krona not spent on something that stops the attack.
Record what you must. Log what matters.