4 ms·

1) Implement a good EDR solution. By far, I can't think of any other change or investment that has had better ROI. So much visibility! And you can quickly imple

1) Implement a good EDR solution. By far, I can't think of any other change or investment that has had better ROI. So much visibility! And you can quickly implement detections and controls based on attacker TTP which has a greater ROI than playing whack-a-mole with CVEs or rely on updated firewall rules,av rules,selinux rules,etc... 2) Log as much as possible and do something with the logs. Log everything and continue to improve your SIEM or security stack based on new threat intel. 3) Low effort,high ROI low hanging fruits. 2FA everything. Mutual certificate auth where i can. Turn on bitlocker. Make people use password managers,ssh pubkey auth. If you have typical corporate firewall/proxy: block any domain that isn't categorized or newly registered. 4) this is what I think will be good ,haven't done it IRL: segment network well. Remote management can only happen from jump boxes. Be hostile against removable drives. 5) Taking first step of NIST's incident response lifecycle seriously,preparation: Playbooks(Online and Offline),checklists,emergency communication channels. Document important assets and related contact when SHTF. And actually have a routine table top excercises and penetration tests (as the corporate wallet allows) 6) I hate that I put this last,but: good security tooling. Typical stuff like an in-house sandbox,dedicated DFIR platform. This should go without saying: you need people to do this and it really does start from the top (leadership).

phaus 7y ago
2) Log as much as possible and do something with the logs. Log everything and continue to improve your SIEM or security stack based on new threat intel. This is a good one. If you have a SIEM + Log Aggregation setup and you don't have robust logging and/or aren't feeding those logs into it, you should have saved yourself some time and burned the money you spent on it.

phaus 7y ago

2) Log as much as possible and do something with the logs. Log everything and continue to improve your SIEM or security stack based on new threat intel. This is a good one. If you have a SIEM + Log Aggregation setup and you don't have robust logging and/or aren't feeding those logs into it, you should have saved yourself some time and burned the money you spent on it.