3 ms·

I can not recommend watching this Defcon talk enough: https://www.youtube.com/watch?v=_SsUeWYoO1Y https://www.youtube.com/watch?v=_SsUeWYoO1Y - "You Spent All T

• freehunter 9y ago
  Dude I'm a security consultant for a major vendor and I can't tell you the number of times I've A) Found an incident while installing new equipment B) Installed new equipment last year and came back this year because they still got hacked and/or C) Ripped out their old gear and put in my company's gear after a hack because the sales guy told them they wouldn't get hacked with our (passive, monitor-only) gear. You need the right tools, no doubt. But you need to understand your needs first. Centralized logging is the first step, but without knowing what you want to get out of it, those logs just sit there unnoticed. Even intelligence platforms like Splunk or ArcSight, unless you know what you're looking for and write it into rules, it's just sitting there. Knowledge is what matters, the tools just make it easier.