Following my previous post, let me go a bit further on the technical side of seeing the whole environment.<\/p>\n
Most IT organisations are split by technology: servers, clients, network, cloud, applications. Security has often followed the same split. One team for endpoint protection, one for the firewalls, one for identity, one for the SIEM. Each team buys its own tools and each tool has its own console.<\/p>\n
The result is that an attack that touches all of those areas, and they all do, has to be pieced together manually across five consoles and five teams. In an incident that takes days we don\u00b4t have.<\/p>\n
So what does it look like when it works? The detection tools share signals. An alert on a laptop is connected to the identity that was used, the servers it logged on to and the mail that started it. The investigation happens in one place, with one timeline. And the response can act on all layers at once: isolate the machine, disable the account, block the mail, all from the same incident.<\/p>\n
You don\u00b4t need one vendor for everything to get there, but the tools must talk to each other, and somebody must own the whole chain.<\/p>\n
Attacks don\u00b4t respect your silos. Your defence shouldn\u00b4t either.<\/p>\n","protected":false},"excerpt":{"rendered":"
Following my previous post, let me go a bit further on the technical side of seeing the whole environment. Most IT organisations are split by technology: servers, clients, network, cloud, applications. Security has often followed the same split. One team for endpoint protection, one for the firewalls, one for identity, one for the SIEM. Each […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[86,100,26],"class_list":["post-1280","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-detection-and-response","tag-organisation","tag-security-architecture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1280"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1280\/revisions"}],"predecessor-version":[{"id":1283,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1280\/revisions\/1283"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}