Investigation & Incident Response Challenges for the Hybrid Enterprise
summary
Panel summarizes a 250+ interview study: 75% worry they don’t collect all investigation data and only one-third confident tracking incidents cloud-to-legacy, while SaaS logs are deemed essential but <50% actually ingest them. Operational reality shows 100+ terabytes of log data problems (SolarWinds example: massive collection in six weeks), near-universal reliance on external responders, EDR ubiquity but under‑collection of network flow, just ~31% automate non‑security data, and widespread staffing burnout and regulatory/privilege pitfalls.
AI-written summary · about
chapters (8)
- 0:00Introduction and panel overview
- 2:06Hybrid environments investigation challenges
- 6:25Reliance on third-party responders
- 12:10Tools and logging limitations
- 22:56Burnout and workforce shortage
- 33:22Communication and collaboration issues
- 41:53Future directions and solutions
- 48:04Evolution of cybersecurity challenges
related talks
17mIncident Response @ Scale-Building a Next Generation SOC
40mOptimizing Operations: Simplification, Visibility, Response and Automation
55mThe State of Incident Response
54mSOCcing: Responding to a Cyber Incident
39mHow Security Incidents Are Different ... and How They're Exactly the Same
14mIt’s Time for Data Contact Tracing
58mKeynote: The Future of Incident Response
28mRe-thinking and Re-defining Enterprise Infrastructure Security