Cybersecurity Controls: It Isn't Just Technical Controls That Need Testing
summary
Claim: continuous control monitoring tests the whole control lifecycle — rule match, log delivery, automation and human playbook — not just code scans. Concrete examples include five examples (DLP blocking credit card emails with a 4-hour SLA, unauthorized AD account creation with an 8-hour SLA, privilege escalation, VPN policy bypass, endpoint agent disable leading to SOAR quarantine). Tools named: DLP, SIEM, SOAR, RPA and Breach & Attack Simulation. Proven in three companies, starts manually with analysts spending 30–60 minutes, then automates.
AI-written summary · about
chapters (18)
- 0:00RSAConference2021
- 2:31IS IT ENOUGH???
- 4:10SECURITY INCIDENTS... BREACH... DATA LEAKAGE!
- 4:58AUDIT FINDINGS...
- 5:52IS CHANGE MANAGEMENT SUFFICIENT?
- 8:17DATA LOSS PREVENTION RULES
- 10:50UNAUTHORIZED ACCOUNT CREATION
- 13:06PRIVILEGE ESCALATION
- 14:36REMOTE ACCESS CONTROL
- 15:53EXAMPLES: DISABLING ENDPOINT SECURITY
- 19:10MAP THE CONTROLS TO TEST
- 21:39HOW TO START
- 23:16ADDRESS THE CORRECTIONS
- 24:21SOCIALIZING THE RESULTS
- 25:16ESTABLISH A FORMAL PROCESS OF TESTS
- 27:13Automation is the path to scale the process!
- 29:11MAIN CHALLENGES
- 32:53Achieved Benefits!
related talks
28mImplementing Critical Cybersecurity Controls in a DevOps Environment
32mThe One About Controls
50mAdaptive Assurance: Implementing an Automated Control Testing Program
44mCybersecurity - Protecting the Organisation's Technological Assets
52mContinuous Security
24mSecurity Compliance as Code
04mPreventative+Detective Control for Security
51mHow to Benefit from Internal Audit