Reset Assumptions: Rate of Security Control Degradation "RoCD" and How to Reset
summary
Defines Rate of Control Degradation as how fast specific controls (firewall rules, VLANs, log feeds, EDR fields) stop doing their job and ties that to intrusion root causes, then proposes a lifecycle: inventory controls, build threat-informed emulation plans (example vendor: AttackIQ), map each emulation to the control, run unscheduled emulation tests to update a control-confidence matrix, prioritize log retention and crime-of-opportunity defenses, and report control efficacy to justify ongoing investment.
AI-written summary · about
chapters (5)
- 0:00Introduction and background
- 13:15Rate of control degradation concept
- 25:23Automated testing for control efficacy
- 37:48Executive metrics and investment justification
- 42:00Q&A on control degradation
related talks
32mThe One About Controls
28mSecurity Basics: Burn It All and Start Over
34mDefining Steady States and Developing Hypotheses
40mCybersecurity Controls: It Isn't Just Technical Controls That Need Testing
28mImplementing Critical Cybersecurity Controls in a DevOps Environment
27mGet Your Security Priorities Straight! How to Identify Workloads Und...
08mShift up: Continous Security and feedback loop
50mYou’re Doing It Wrong! Common Security Anti Patterns