GS-InfoSec

3 compliance frameworks fails: they mandate presence of controls, not their effectiveness; they create a scenario that vendors satisfy at minimum viable level; they have never required root-cause problems to be fixed, only that compensating controls be installed around them.

AI SOAR is the way imo. IDK many orgs without a SOAR if they don't use an MDR service. You must correlate. Nobody works just alerts. It's SOC 101

We’re always talking in cyber about how boards don’t get cyber risk, how boards need to improve their understanding etc……… we never talk about how Governments have a worse knowledge gap and they are passing laws that impact all of us……. Just saying

This isn't so much about cyber even though it applies to cyber: Threats are blended whether you choose to acknowledge that or not. States like North Korea, Iran, and Russia have links to criminals and criminal activity if not outright primary actors. The practitioner chooses the core characteristics to decompose and categorize, because it helps make development of the threat picture more manageable. However, it's important to always be thinking of whole systems while analyzing components. Your analysis is going to suck if you don't consider the broader context.

We suffer from a huge level of over abstraction and over simplification in this industry.

Is it not anymore? I built one of these in Rust (running on >60 threads atm) but felt that even with all the enrichment, it didn't present enough fidelity so I started building additional data sources to correlate to the discovered adversary infra. There are more active C2's than a lot of people think 🤣