3 ms·
Those are good points, but there's quite a bit more to it than that. Off the top off my head, hunting within your network and reducing attackers' dwell time is
by jason-phillips 5y ago
Those are good points, but there's quite a bit more to it than that.
Off the top off my head, hunting within your network and reducing attackers' dwell time is another strong recommendation. Proxying internal network traffic with SSL-decrypt and rules-based analysis is another. Defining boundaries and firewalling off infrastructure to limit the blast radius is another. Scanning project code, dependencies and containers, and so on.
It really requires a holistic approach and commitment. There is no one right answer here but it's something we all need to take seriously, imo.
Disclosure: Have worked for several cyber-security startups with former .gov and .mil professionals while assisting many sensitive federal agencies myself.
- AyyWS 5y agoDoes SSL-Decryptand and rules-based analysis work? These are the times I've interacted with them: 1. Disabling SSL-Decrypt because it blocks HTTPS from PowerShell, bash, git, android studio and other comandline tools where I couldn't figure out how to trust our internal cert. I figured it out for Postman, but mostly I just couldn't figure it out. 2. Disabling or exempting rules that blocked our pharmacy app from going to webpages or perform SQL Queries that included legal drug names that were also illegal drug names. I think it's tough for non-security professionals who feel burdened and never get to see the benefits.
- jason-phillips 5y agoDefine "work". It's a layer in your overall plan. You should be able to apply it selectively and tweak as appropriate. If an internal resource is exfiltrating information somehow, the goal is to uncover that activity.