3 ms·

Security monitoring is useful and part of a defense-in-depth strategy. So is fail2ban and many other things.

• tptacek 9y ago
  "Defense in depth" is just a way security product salespeople get customers to buy more stuff. If you remove attack surface altogether, you don't need more depth of defense.
  • eeZah7Ux 9y ago
    > "Defense in depth" is just a way security product salespeople get customers to buy more stuff. "just" that? That's a very bold statement that most of the security community would disagree with. An example: you don't monitor network traffic on the border because you trust your server not to be compromised. Then one gets compromised and the incident goes undetected due to lack of monitoring. > If you remove attack surface altogether That's a big if. Services can have a complex life, with software and configuration changing often. Unless you pull the plug you attack surface is never going to be zero and, on top of that, there so guarantee that it stays small. Hence organizations usually have different people taking care of different layers.