3 ms·
A most interesting statement. If security is reported broken or compromised, it's very actionable, surely?
by tempguy9999 7y ago
A most interesting statement. If security is reported broken or compromised, it's very actionable, surely?
- badrabbit 7y agoNo, security alerts tell you something might be wrong. You have to then perform some analysis tasks and determine if it is a true or false positive alert. Even if it is a true positive you may not have enough info to action,you might continue monitoring or dismiss the threat. You might have to determine the cost of further investigstion and remediation vs security risk. For example in a past life I was in a position where malware traffic will be detected from some locations but the infected device can't be located. Or some overt webapp scanning is happening,I want to know about it and make sure it isn't excessive but it's not worth the effort of blocking. You don't really action security alerts and events,you action security incidents(which are security events/alerts confirmed to be true positive). With infrastructure monitoring if you see an alert that means something is wrong,the alert is an incident. Been on the responding side of both types of alerts. Incident response is very interesting,most plans hardly survive the battlefield.