3 ms·
There's value here in detection of a breach that's already been monetized, but this isn't in the kill chain; it's long-after, so it appears reactive-only. Why
by eganist 9y ago
There's value here in detection of a breach that's already been monetized, but this isn't in the kill chain; it's long-after, so it appears reactive-only.
Why should a non-massive company implement this rather than boosting and refining centralized logging and monitoring which can, if done right, provide far more immediate (even real time) notification of a breach? Your Wells Fargos of the world might do it because they can spare the change, and in your position I'd target the whales for initial revenue, certainly, but why should any mid-sized SaaS firm do it?
Not asking cynically. I want you to sell me on it.
- graystevens 9y agoI completely agree that preventative/proactive measures are always going to be better than something retrospective such as my service (although I’d argue that they complement each other nicely, of course). In terms of why a mid-sized SaaS should go this route - I would like to think that Breach Insider is a slightly more cost-effective option. To do detection and correlation properly, you’re looking at a SIEM with the right logs and hopefully some well formed rules. However at this stage, I’d argue that to get the absolute most out of this, you’re looking at supporting & monitoring this with at least one dedicated employee, else all those logs will be wasted.
- gesman 9y agoAny measures can miss the breach. For example disgruntled insider admin quietly stole all users data on his last day at work.
- eganist 9y agoProperly calibrated monitoring should catch that scenario with near certainty though.
- ExactoKnight 9y agoThe brilliance of this service is they don't even need to do any real work in keeping their dictionary that up to date, and they've been given a license to print money.