Us: In network for a month without detection.
Client: Why didn't nextgen EDR pick any of this up?
Us: Detection is more than just an EDR, it requires an understanding of your network.
Client: Can you get on phone with the vendor to share all of your TTPs so they can detect?
Client: Why didn't nextgen EDR pick any of this up?
Us: Detection is more than just an EDR, it requires an understanding of your network.
Client: Can you get on phone with the vendor to share all of your TTPs so they can detect?
We're working with the customer to help educate and shore up the deficiencies, but it's just rough because of the over-reliance on security tools versus baselining and doing the work for your own environment.
This also isn't just a CustomerX problem. It's a widescale industry problem in general. There is no solution out there that does the hard work of building a security program or focusing on your threat models and baselining your own infrastructure.
This is a great opportunity to help educate, help, and make them better in all ways that we can. I'm just pointing out that the over-reliance on security products isn't a valid substitute for building a security program.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
