A follow-up for management on session recording.<\/p>\n
Session recording has a price that is easy to underestimate. The licences for the PAM features. The storage, because video of every admin session adds up quickly, especially if you keep it for a year. The operation of the recording infrastructure. And the people needed if anyone is actually going to review the recordings, which is rarely budgeted at all.<\/p>\n
Then there are the hidden costs. Admin work through a recorded session is often slower. Some tools don\u00b4t work well through the recording proxy, so exceptions are created, and every exception is a gap.<\/p>\n
Is it worth it? Sometimes. If a regulator requires it, or if you need to monitor external suppliers working in your most critical systems, recording can make sense. It can also have a deterrent effect: people behave better when they know they are recorded.<\/p>\n
But if the goal is to detect and investigate attacks, the same money gives a lot more in other places. Good logging and an EDR on all servers. A SOC with time to look at what it collects. Or simply a few more weeks of an engineer\u00b4s time to clean up privileged access.<\/p>\n
With limited resources, every krona spent on video is a krona not spent on something that stops the attack.<\/p>\n
Record what you must. Log what matters.<\/p>\n","protected":false},"excerpt":{"rendered":"
A follow-up for management on session recording. Session recording has a price that is easy to underestimate. The licences for the PAM features. The storage, because video of every admin session adds up quickly, especially if you keep it for a year. The operation of the recording infrastructure. And the people needed if anyone is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,3,4],"tags":[38,70,124],"class_list":["post-1372","post","type-post","status-publish","format-standard","hentry","category-business","category-computer-forensics","category-security-architecture","tag-business","tag-cost","tag-session-recording"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1372"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1372\/revisions"}],"predecessor-version":[{"id":1397,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1372\/revisions\/1397"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}