Your Intrusion Detection Still Sucks (And What to Do About It)
summary
Argues that intrusion detection still fails at scale and gives concrete fixes: measure and reduce median dwell time (reported 10–15 day median dwell time with internal detection ~6–7 days and external ~20 days), classify events into 20% known good / 0.1% known evil / 80% unknowns, and build enrichment pipelines tying SSO, EDR, HR, GitHub, CloudTrail and GuardDuty into cohort analysis and automation that can auto-block lookalike domains, ticket users, rotate credentials, network contain hosts and pull forensic artifacts.
AI-written summary · about
chapters (13)
- 0:00Introduction and setup
- 1:03Speaker background and talk context
- 6:48Problem statement and detection challenges
- 8:32Detection effectiveness and dwell time data
- 11:38Basic assumptions for detection engineering
- 15:32Analytic techniques and data flow
- 18:00Use case one: Suspicious SSO login
- 22:16Use case two: New admin added
- 24:22Use case three: AWS GuardDuty alert
- 26:30Lapsis threat actor example
- 28:39Response strategies and automation
- 30:44Why context and correlation work
- 31:06Q&A and closing remarks
related talks
23mSecurity Tools Don't Detect Attacks—Humans Do
49mHow Threat Intelligence Sharing and Automation Wins the War against Attackers
42mThe Fault in Our Metrics: Rethinking How We Measure Detection & Response
55mKeynote - The Future of Cybersecurity Needs You, Here is Why.
40mEnemy Inside the Gates: Securing the New Battleground
27mCollect All the Data; Protect All the Things
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus
35mThe Best Defense is a Great Offense: Leveraging Automated...