by Keith McCammon

Where do your incidents come from?

How do you identity your highest severity incidents in the first place? Which data sources or products deliver the investigative leads? And which are critical to detection and response? These questions speak directly to the value of data sources, products, and functions.

What are the prevailing root causes? This speaks directly to the quality of incident management, particularly post-incident review.

I can’t stress enough the importance of being able to answer these questions as the leader of any operational team (cybersecurity, technology, or otherwise).

August 28, 2024

SaaS attack technique matrix Permalink

Inspired by MITRE ATT&CK, the good folks at Push Security have taken a pass at enumerating attack techniques specific to Software-as-a-Service (SaaS) applications.

ATT&CK is a great and robust framework, and I love to see it adapted to capture techniques and tactics for different types of systems.

Push Security SaaS Attacks example

Your SIEM is only as valuable as you have time to ask it questions.

Do you have time to identify and ask the right questions? And most importantly, do you have time to sift through the results to find answers?

August 22, 2024

Left and Right of Boom (by Tim MalcomVetter) Permalink

Prevention is just detection with an action at the end.

-Casey Smith (subTee)

In security operations, or any harm prevention discipline, speed is really important. The faster you can find the bad thing, the better your chances of rolling over a proverbial speed bump vs. hitting a brick wall.

But speed can work against you: Move too fast, and you run a very real risk of responding decisively to the wrong things. False positives are never ideal, but can be made far worse when you take disruptive action on them.

A couple of the concepts I’d take away from this article:

  • Time to Detect, noting the important relationship between prevention detection: Prevention only exists where there is highly accurate and fast detection.
  • Time to Verdict, which is a great way to think about triage: The goal isn’t to triage faster, it’s to triage as fast as you can make good decisions.