[Autogenerated] so thinking now of requirement 10,
you're going on a successor for the second year.
What?
What typically goes wrong?
What people get wrong in this, Um, you know, if they've done it, right?
Actually,
the thing that I find that happens the most is that the person
whose job it was to sort of deal with the alerts,
um, you know,
maybe stops doing it or doesn't have sort of good
kind of records keeping from it, right?
So if it's I have a task to go look at alerts, right?
And then all the output was was I looked at the alerts today, right?
You know, two weeks later, you're not gonna remember what you did, right?
So when I say tell me about how you follow up on alerts that error significant,
and they sort of look at you with that funny face and kind of
scratch their head like I don't remember,
um, because they didn't take any time to document what they did.
Now, if there's a a ticket right or something like that,
that says I had this alert here.
Here's what it told me.
Here's what I investigated.
Here's what I found even if the end result is,
you know, that wasn't really anything particularly relevant.
Or it was a false alarm.
Or, you know,
it was just some ____ on the Internet scanning me with some crummy
vulnerability scanning tool That happens 40 times a day,
you know?
Then then you have some record of the effectiveness of your loggers.
Right?
And you have some metric to track on that.
So you look so the failure point is people stop doing it.
And if they are doing it, they're not keeping good records.
Show right that they can prove that they're actually doing something worthwhile.
Is opposes going.
Yeah, Yeah, the logs.
Error.
Fine.
Right.
What about changes to the c D and making sure new devices
get brought into the logging family?
That can happen.
Right.
Um, I actually don't see that as a failure particularly often,
but it certainly can happen.
Um,
the other thing that I'm I'm expecting sort of more failures for in
the future is the new requirement stuff in 10.8,
right?
Which is about tracking failures, right?
That That's to say, Hey, if something has gone wrong,
do some, you know, identify it do some root cause analysis,
figure out what your window of exposure was and then fix it right on.
That's a really interesting sort of set of steps,
Uh, in that new requirement on, I think you get kind of two sorts of failures.
This is a requirement for service providers only GUID.
Is IT?
It is.
It is requirement specifically for service providers.
I think you get two sorts of failures, though, right?
You get the kind of active failure, right?
A device goes down, right?
A thing doesn't respond to health or uptime Check.
Right.
Um, and and those error relatively obvious.
Right?
And sussing that out and going and doing something about it.
Pretty straightforward, right?
Then there's the more sort of silent failure, right?
Your intrusion detection sensor doesn't detect anything, right?
Does that mean that there was nothing to detect or it
just isn't doing anything harder to say?
So So So what we're talking about really,
is to sort of fairly we've got failure,
effectiveness and the failure of operations.
Right?
Operational effectiveness is pretty easy, isn't it?
It's like it's not working anyway.
Someone turned it off.
Right?
Effectiveness is quite hard to test, although, isn't it?
I think it can be hard to test for, um, there are.
There are some cases where I think it's relatively easy, right?
At a client a tous point many years ago,
who is paying a third-party to do their sort of intrusion detection.
Right.
And I was on site.
I was saying, Well, you know,
what kind of things are they providing you with them?
Like, Oh, you know, we haven't heard anything from them.
What do you mean?
You haven't heard anything from them?
What we do, they just haven't set up any alerts.
Well, like our CSV services just did a vulnerability scan last week did that.
I mean, you're not getting alert.
Like we've never seen an alert from your scans.
Well, we did a pen test before.
Did you see any of that?
No.
Okay, so So you're writing somebody a check every month,
and then they're not really doing anything for you.
Yeah, great.
But they bought something, right?
But but But we paid them right.
So So clearly that must get us an in place, right?
10.8 for service providers.
Do you try and encourage merchants to do it.
I mean non service providers to do as well.
Um, e can't insist on it.
I you know,
sometimes it comes up and I say this is a really interesting practice.
You should consider it, you know,
And usually they give me that sort of glazed overlook Knowing
the council on the way the council work.
If a requirement goes in like this,
that says for service providers only on it's not about
things that only a service provider could do,
like keep separate logs for different organizations.
There would have been a discussion around the table saying,
Should we put this to everybody, right?
I think that's a very realistic possibility that yeah,
I mean, that's typically what happens, right?
And people look at it and they say that XAML put it to
service providers to begin with, see how it gets adopted,
see if it produces results on if it's successful,
will roll it out to the rest of the community s.
So my my view,
whenever I see a new requirement in the standard for a service provider,
is I need to be thinking of in three years time,
that's gonna be on everyone's in everyone.
That seems like a likely I can right Is really just a question of timing.
Yes, it is, Um, and will have a notice period,
as usual, but but but it's actually quite a good thing.
I mean, you know, incorporate in corporate information security.
I am known as someone who is just really annoying.
I just annoy people about control, effectiveness and control operations.
You know, it's not good enough just to buy it.
It has to be turned on and working, and we have to know it's turned out well,
you have to do something with it and has to It has to improve things.
Eso yeah, if you're If you've got some other control,
we've got some intrusion, detection or whatever,
and it's not catching intrusions or it's not compelling you to take action.
Yeah, I mean, whatever, you know, open family,
you know,
you commission pan tests and you get the pen test
results on you go to the I T people.
Go.
Look.
Look at the pen test result we have We have controls against that.
How did they get through?
That is like it wasn't configured properly or Oh,
yeah, Fred was going to update it next week.
There's always sort of a reason behind it.
A control failure, you know, a nonworking control is like having no control,
right?
You know, right, Exactly.
Um so obviously favors of logging are not are not causes of compromises,
but failures of logging on responding to blog events
really lengthen the time it takes to detect something
that's not right in your right well.
And so,
looking again at those sort of statistics about weeks or months
until the organization finds out about it,
in many cases these organization is never the one who detects it,
right?
It's the it's the bank or the payment processor.
Who says I think you're a common point of purchase for
all of these fraudulent transactions.
I think maybe you've been breached, right?
So, like at some point it stops being you that finds out right?
It starts being somebody else who complains about it.
I think you know we should.
We should hark back to the very, very public breach of a large retailer in the U.
S.
Where they're logging system was telling them there
was bad activity on the network, you know,
And that came out in the reports that were very public afterwards.
You know, they just the response wasn't there is like,
you know, it's just not gonna do anything about it.
Well, and what I read about that case in particular,
uh, you know, somebody was responding to an interview and saying,
Yeah, okay, there were alert saying, Hey,
there's this malicious activity but I get 50 of those alerts every day,
right?
And picking out the good stuff for the most salient stuff
from the less salient stuff is hard right?
And And that, I think,
points you to the idea that you really want to
figure out how to tune your analysis, you know,
to your organization so that you can find the really bad stuff right?
And that's easier said than done.
But it's worth doing so the end of the day we're talking,
having a scene, managing it properly.
Response.
DLL.
That's properly IT great