Collection is not Detection - Sec Ops in a Cloud Native Environment
Talkat Cloud Native Security Day Europe 2020 · on Monday, 2020-08-17· at 13:15· InXpo, https://onlinexperiences.com/Launch/Event.htm?ShowKey=99259·
summary
Claim: collection is not detection — collecting all logs without detections or hunts wastes effort. Recommend collecting across the whole stack (orchestrator, pods, app, infra) driven by concrete use cases (example: alert if CEO logs in from outside the US). Tools named: SIEM and runtime security, vulnerability scanners, auditing/policy tools and image repositories. Note surprises: research shows 40% of alerts ignored; attackers favor cheap tooling (exploit kits ~$1,400/month, ransomware kits ~$66, compromised devices <$1) over costly zero‑days.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 2:53Why security operations matter
- 8:15Traditional SOAR challenges and silos
- 12:43From castle model to zero trust
- 15:35How to run security operations
- 17:21What logs to collect in cloud native
- 18:24Tools for visibility and detection
- 20:53Importance of use cases
- 23:20Conclusion and key takeaways
- 24:47Live Q&A session
related talks
15mAnti-patterns in Security Monitoring
27mCollect All the Data; Protect All the Things
46mLearning security monitoring through failure
53mSecurity Operations 2018: What Is Working? What Is Not.
29mDetection Engineering: Defending Networks with Purpose
21mRecognizing and avoiding cloud security survival mode
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
23mSecurity Tools Don't Detect Attacks—Humans Do