Learning security monitoring through failure
summary
Security monitoring focuses on concrete failures and fixes: cloud logging can cost 300,000 NOK/week for noisy Kubernetes ingestion, default vendor retention gives 30 days of logs so crucial evidence vanishes, and blanket deployment of 200 vendor detection templates produces alert fatigue. Examples show Microsoft Defender XDR Kusto queries missing scans due to concurrent activity, EDRs (SentinelOne, Palo Alto, Cortex XDR) get bypassed by malvertising, and reversing detections to define primary vs secondary data saves roughly $100k/month in one audit.
AI-written summary · about
chapters (9)
- 0:00Security monitoring through failure
- 1:12Security monitoring matters
- 8:14Foundational concepts
- 19:49Cloud logging mistakes
- 25:03Detection template dangers
- 28:34Anti-patterns in security
- 34:12Security failures examples
- 40:13Cultural shifts for security
- 44:04Key takeaways
related talks
15mAnti-patterns in Security Monitoring
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
21mRecognizing and avoiding cloud security survival mode
31mCollection is not Detection - Sec Ops in a Cloud Native Environment
15mThe origin of security challenges & a revolutionary solution
19mKubernetes Security: Navigating the Real-World Challenges
40mWhen Your Dashboard Explodes – Do You Care Enough to Send the Very Best?
37mOptimizing Cloud Detection & Response With Security Chaos Engineering