Index 04 / Talks

September 2023 · Spotlight Webinar

Spotlight Webinar: Autonomous Defense

Runtime
20:32
Series
Spotlight Webinar
Recorded
September 2023

A defense-in-depth stack assembled as a single workflow, layer by layer: firewall, agent, antivirus, VPN, SIEM, patch and vulnerability scan. The argument underneath is that attackers triage, so an organization that is expensive to enter gets skipped rather than defeated.

16 chapters
  1. 00:00:00Introduction: defense in depth
  2. 00:01:15Why attackers skip expensive targets
  3. 00:02:21A portfolio of tools, not one tool
  4. 00:03:33Architecture: agent-based telemetry
  5. 00:04:40Building the workflow: firewall first
  6. 00:06:53Antivirus: CrowdStrike Falcon
  7. 00:08:08VPN, then SIEM: Splunk versus Grafana Loki
  8. 00:09:20Patch scan and deploy
  9. 00:10:30Vulnerability scan filtered to CVSS 8+
  10. 00:11:43What 'not attractive anymore' looks like
  11. 00:12:50Spear phishing, email sandboxing, and log correlation
  12. 00:13:56Publishing a policy: choosing a cadence
  13. 00:15:05Interval tradeoffs and endpoint CPU load
  14. 00:16:10Scoping by location
  15. 00:17:17Reporting and benchmarking improvement
  16. 00:19:26Close

Also on YouTube · defense in depth, threat actor triage, port scanning, low-hanging fruit, firewall

Next — Blogs