Defenders Struggle as the Adversary Continues to Break Away
summary
Claims that most breaches succeed by moving inside the network with lateral movement (about 60–70% of incidents), and that defenders get the biggest wins by hardening workloads with microsegmentation, kernel visibility via eBPF sandbox, and behavioral exploit protection rather than piling on more endpoint agents. Presents a practical stack: visibility, policy, simulation, enforcement — including a digital twin for safe rule rollout and time-based defense to slow adversaries — and quantifies traffic triage so only ~4% needs full decryption.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:05Threat vectors by industry
- 3:30Defensive controls limits
- 7:00MITRE ATT&CK tactics
- 9:47Lateral movement success
- 11:13Campus security zero trust
- 15:49Data center security opportunity
- 22:12Zero trust simplicity
- 26:04eBPF kernel security
- 30:39AI traffic analysis decryption
- 33:28AI risks defenses
- 35:15Micro segmentation policy
- 37:46Vulnerability runtime protection
- 41:19Simulation digital twin
- 43:05Conclusion and key takeaways
related talks
40mEnemy Inside the Gates: Securing the New Battleground
46mShielding the Clouds: Advanced Cyber Defense in Hybrid Environments
05mDefenders Think in Lists. Attackers Think in Graphs.
21mThe New Ground Truth for Security
12mMulti-Layer Defense for Scalable Threat Mitigation
48mCrucial Cyber Hygiene Defenses for 2023
01h 11m2024 Security BSides // Adam Pennington
35mThe Best Defense is a Great Offense: Leveraging Automated...