Gregory's Server
As a security principal I am in fact the one saying No, we are going to turn that Off. It costs too much. Often, that cost is retention of what matters. Or business impact. There is no limit to the amount of data you can generate about the operations of a machine. And it will cost you everything.
|
7 comments
@SwiftOnSecurity Or doing everything in a "lockdown your OS" list and wondering why all your apps broke. @Xavier @SwiftOnSecurity Yep, regardless of security posture work needs to get done. Locking down all of the things means work gets harder to accomplish. @SwiftOnSecurity I have never been to a place with too few logs in their SIEM. They are regularly missing one or two critical logs, but they are never at a point where they understand, or can action, everything they have. |
Security decisions informed only by compliance and fear and novelty are not ones that produce results. I've seen the machine with a 1 hour Security log because everything is turned on. According to the saintly instructions but not operational reality. It cost you everything about what happened.