Our friends at ElasticSearch have published an eye opening white paper with SANS on modern security monitoring. We encourage everyone in the security and cloud community to give it a read.
This blog is an attempt at how we’d explain this article to a 5th grader.
Key points:
- Most organisations think of cyber & cloud security as preparing for war. Big aircraft carriers, tanks and the like are thrown in for offence and defence. i.e a dependency on tools like end-point protection (aka anti-virus / anti-malware detection) as the focus of their security strategy.
- This leaves large surface areas unprotected allowing bad actors to sneak in. And once they’re past these point defence tools, they have a free rein within the network.
- We at SquareShift believe that modern cyber security is more of a counter spy operation.Listen in to all the signals being generated by your servers, networks and apps. Let machine learning and anomaly detection surface unusual activity.Conduct investigations & collect proof to locate the site of breach and bad actors.Protect, defend and remedy with pinpoint accuracy and speed.
- Listen in to all the signals being generated by your servers, networks and apps.
- Let machine learning and anomaly detection surface unusual activity.
- Conduct investigations & collect proof to locate the site of breach and bad actors.
- Protect, defend and remedy with pinpoint accuracy and speed.
- This strategy shifts the focus from point-defence and tools to one that is reliant on data and visibility across the landscape.
- This is a subtle but profound shift in the way we think about cyber and cloud security.
With that layman’s explanation now out of the way, let us give you some insightful excerpts from the white paper.
Translation: Bad actors are constantly probing. Why are your organisation’s cyber security defences static?
Translation: Your infrastructure, network and apps are generating tons of log data and signals. If you string them together properly, you get a wealth of insights to defend & protect better.
Translation: Identify gaps, deploy data collection agents, bring them to a central location, identify anomalies across these data sets. There, you have a powerful detection capability already
There is so much more in this white paper above and beyond what we have captured here. Read it, enjoy it, and share your thoughts with us. If you need help with anything cyber security or cloud security, just call us. Nothing excites us like helping organisations strengthen their security posture and build better security practices.
Here is a quick list of some of the awesome security services SquareShift provides:
- Security posture assessment for cloud workloads.
- Security strategy to meet compliance and regulatory requirements and cyber security frameworks (MAS TRM, ISO 27001, SOC2, PCI-DSS, GDPR, NIST CSF and the like).
- Security event monitoring (SIEM) and Security operations center (SOC)
- DevSecOps to strengthen software supply chain security.
Talk to us at aananth@squareshift.co, Elango@squareshift.co (Asia & Singapore), venky@squareshift.co (North America). You can always visit our website - www.squareshift.co to know more about us.