Gregory's ServerOne of the greatest values you can provide to an employer is saying No. To have experience to know what's important. If we don't log this thing we will have more retention of what matters MORE, longer. The real world has costs, and those have to be paid.
 9 comments
Security decisions informed only by compliance and fear and novelty are not ones that produce results. I've seen the machine with a 1 hour Security log because everything is turned on. According to the saintly instructions but not operational reality. It cost you everything about what happened. @SwiftOnSecurity Or doing everything in a "lockdown your OS" list and wondering why all your apps broke. @Xavier @SwiftOnSecurity Yep, regardless of security posture work needs to get done. Locking down all of the things means work gets harder to accomplish. @SwiftOnSecurity I have never been to a place with too few logs in their SIEM. They are regularly missing one or two critical logs, but they are never at a point where they understand, or can action, everything they have. @SwiftOnSecurity I wish more managers understood that creeping the scope of a project is possibly the most expensive thing you can do. |
As a security principal I am in fact the one saying No, we are going to turn that Off. It costs too much. Often, that cost is retention of what matters. Or business impact. There is no limit to the amount of data you can generate about the operations of a machine. And it will cost you everything.