by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Aug 5th, 2021
I get the question quite often: What is the difference between Azure Sentinel and the SIEM we already have? On the surface they do the same thing. Collect logs, correlate them and raise alerts. But a few differences matter a lot in practice. First, it is cloud native. There are no servers to size, no […]
Posted in Business, Security Architecture on Jul 13th, 2021
A short question for management: If an attacker logged on to one of your servers with a stolen admin account last night, would you know? In the incidents I work on, the answer is almost always no. Not because the company didn´t have tools, but because nobody had the full picture. The firewall logs were […]
Posted in Security Architecture, Technology on Jul 10th, 2021
This one is a bit longer than usual, because it is a topic close to my heart after this spring. There are two kinds of SOC. The first one watches. It collects logs, looks at alerts, and when something looks bad it writes a ticket or sends a mail to the customer: ‘We have detected […]
Posted in Business on Jun 14th, 2021
There are two reasons companies get a SOC. Because they must, or because they want to. The first kind is bought to satisfy a regulator, an auditor or a customer. The requirement says ‘continuous security monitoring’, so a service is purchased, preferably the cheapest one that ticks the box. It collects some logs, sends a […]
Posted in Business, Security Architecture on Jul 20th, 2020
Following my previous post, a question for management: Who is responsible for your security in July? In many companies the honest answer is ‘a consultant on call who has never seen our environment’ or ‘the summer intern’. Not because anyone decided it, but because everybody else is on vacation. The attackers know this. So the […]
Posted in Security Architecture, Technology on Jul 2nd, 2020
I have written about it before but it bears repeating. The attackers love holidays. Christmas, Easter and here in Sweden especially July, when half the country is at the summer house. It´s not a coincidence. A ransomware group that has been inside your network for weeks can choose when to strike, and they choose when […]
Posted in Security Architecture, Technology on Jul 19th, 2019
When I ask customers what they log the answer is usually something with the firewall. Gigabytes per day of network flows that cost a fortune to store and that nobody reads. In a Zero Trust world the interesting stuff happens elsewhere. Start with the identity logs: sign-ins, failed sign-ins, MFA changes, risky sign-ins, changes to […]