Feed on
Posts
Comments

Tag Archive 'Detection and response'

Following my previous post, let me go a bit further on the technical side of seeing the whole environment. Most IT organisations are split by technology: servers, clients, network, cloud, applications. Security has often followed the same split. One team for endpoint protection, one for the firewalls, one for identity, one for the SIEM. Each […]

Read Full Post »

This one is a bit longer than usual, because it is a topic close to my heart after this spring. There are two kinds of SOC. The first one watches. It collects logs, looks at alerts, and when something looks bad it writes a ticket or sends a mail to the customer: ‘We have detected […]

Read Full Post »