A short question for management: If an attacker logged on to one of your servers with a stolen admin account last night, would you know?<\/p>\n
In the incidents I work on, the answer is almost always no. Not because the company didn\u00b4t have tools, but because nobody had the full picture. The firewall logs were in one place, the server logs in another, the cloud logs nowhere at all. And the people who could have connected the dots were looking at their own small part.<\/p>\n
Knowing what happens in your environment is the foundation of all security. Without it you don\u00b4t know if your protection works, you don\u00b4t know when you are under attack and, when the worst happens, you can\u00b4t tell how the attacker got in or what he took. That last part matters a lot when you have to report to regulators, customers and the press.<\/p>\n
So what should management ask for? Logs from the important places: identity, endpoints, servers, cloud services and the most sensitive data. Kept long enough to investigate an attack that started months ago. Brought together where someone actually looks at them. And people with the time and skills to do it, in house or as a service.<\/p>\n
It doesn\u00b4t have to be the most expensive solution. It has to be the one that gives you the picture.<\/p>\n
What you can\u00b4t see, you can\u00b4t defend.<\/p>\n","protected":false},"excerpt":{"rendered":"
A short question for management: If an attacker logged on to one of your servers with a stolen admin account last night, would you know? In the incidents I work on, the answer is almost always no. Not because the company didn\u00b4t have tools, but because nobody had the full picture. The firewall logs were […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,30,89],"class_list":["post-1272","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-soc","tag-visibility"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1272"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1272\/revisions"}],"predecessor-version":[{"id":1301,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1272\/revisions\/1301"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}