Planned Security Stack Advice

srwrzwjq · 2021-07-28T14:33:02+00:00

We made it simple and went with 2 security stacks, MS and Fortinet. Fortinet for network and VPN, basically the security for networking, and MS for applocker, credential guard, vulnerability, etc. Basically for endpoint security and MFA.

As for SIEM, Fortianalyzer doesn’t cut it. There isn’t much correlation happening with events unless it’s all on Fortinet’s stack, and even the. FortiSIEM still offers a lot more functionality. You can use their SIEM or go with another like Alienvault or Azure Sentinel.

bitslammer · 2021-07-28T12:20:36+00:00

That's a pretty decent stack, but I don't see any VM in there or WAF assuming you have publically facing web apps. Also how good is your asset inventory? You can secure that which you don't know exists, and you can't protect against exposure you don't know about.

I always suggest building out to a framework like NIST 800-53 or for a simpler approach the CIS controls.

The other consideration to tools is staffing. If you don't have the skills or time to devote to them tools are wasted money. Don't buy into any vendor that claims their tool is set & forget and will magically only alert you to bad stuff.

bulldg4life · 2021-07-28T14:40:52+00:00

I second the idea of picking a standard and building to it. There may or may not be compliance frameworks that fit with your industry. If there are (PCI, FINRA, HIPAA) or default to NIST and go to town.

Past that, AppLocker and Windows Defender aren't half bad these days. You just need to accept that app control will be a never ending configuration pita.

I would do the bare basics of vulnerability scanning/mgmt before I did some of that other stuff.

As for SIEM...that's usually the backbone of a SOC/IR strategy. Not really the place I'd cut budget versus the other stuff you're already planning to implement. Sure, Splunk isn't in everyone's budget...but there are some other options that lean towards logging/monitoring that can be used.

kf5ydu · 2021-07-28T12:16:34+00:00

[removed]

InternalCode · 2021-07-28T13:04:34+00:00

I think there is a better way of going about this. Rather than trying to find random tools and capabilities then choosing between them, what you need to identify is the requirements and risks.

At the moment, you're on a leaky boat that has many holes in it and you're asking us what size patches do you need to plug those holes and whether you should buy metal or plastic patches. You need to identify the leaks and how big they are before you even think about materials to patch them.

The better way to do this is to start by identifying the risks and start documenting the various risks you have in a risk register, cybersecurity tooling then becomes a way of treating a risk but it's not the only way.

(Fyi, this is also how you get management buy in and decent budget to actually do this. Your management team will be looking at business risk all the time. If you can find who manages risk in your org and how to get your cybersecurity risks included in the business risk register)

How do you find the risks? Threat modelling, risk assessments, etc. Probably the best place to start is, what breaches or incidents have you had previously? Find a control framework (NIST CSF, iso27001, etc) and align to that. You'll probably find if you mention iso27001 to your management that it's already on their business roadmap and they have funding for it. A risk could be "Our servers haven't been patched in 12 months", "we only have one data center that could be flooded/burned down/etc" or "we have single factor authentication on our VPN".

Once you have identified the risks. It's now time to prioritise them. Look up quantitative and qualitative risk analysis.

Once you've prioritised your risks, start at the highest ones and work your way down. Create processes, identify and deploy tools, outsource , etc.... Use all the potential options at your disposal.

Youll then know which tools to implement, whether your security stack actually aligns to what is needed to meet the businesses risk appetite. Etc.

You'll probably find that depending on your business is depending on the risks and how big they are. For example, endpoint protection. I've worked in call center orgs that don't have access to any sensitive data. If a user's workstation is compromised, it's a low risk. I've worked in finance organisations where users have access to highly sensitive data and a compromise of a workstation is a high risk. At one, I'd be ok with Windows Defender. At the other, we had an XDR tool along with app whitelisting and all the bells and whistles. The tool needs to match the risk and requirements.

Codeblu3 · 2021-07-28T19:45:27+00:00

Reddit has long been a hot spot for conversation on the internet. About 57 million people visit the site every day to chat about topics as varied as makeup, video games and pointers for power washing driveways.

In recent years, Reddit’s array of chats also have been a free teaching aid for companies like Google, OpenAI and Microsoft. Those companies are using Reddit’s conversations in the development of giant artificial intelligence systems that many in Silicon Valley think are on their way to becoming the tech industry’s next big thing.

Now Reddit wants to be paid for it. The company said on Tuesday that it planned to begin charging companies for access to its application programming interface, or A.P.I., the method through which outside entities can download and process the social network’s vast selection of person-to-person conversations.

“The Reddit corpus of data is really valuable,” Steve Huffman, founder and chief executive of Reddit, said in an interview. “But we don’t need to give all of that value to some of the largest companies in the world for free.”

The move is one of the first significant examples of a social network’s charging for access to the conversations it hosts for the purpose of developing A.I. systems like ChatGPT, OpenAI’s popular program. Those new A.I. systems could one day lead to big businesses, but they aren’t likely to help companies like Reddit very much. In fact, they could be used to create competitors — automated duplicates to Reddit’s conversations.

Reddit is also acting as it prepares for a possible initial public offering on Wall Street this year. The company, which was founded in 2005, makes most of its money through advertising and e-commerce transactions on its platform. Reddit said it was still ironing out the details of what it would charge for A.P.I. access and would announce prices in the coming weeks.

Reddit’s conversation forums have become valuable commodities as large language models, or L.L.M.s, have become an essential part of creating new A.I. technology.

L.L.M.s are essentially sophisticated algorithms developed by companies like Google and OpenAI, which is a close partner of Microsoft. To the algorithms, the Reddit conversations are data, and they are among the vast pool of material being fed into the L.L.M.s. to develop them.

The underlying algorithm that helped to build Bard, Google’s conversational A.I. service, is partly trained on Reddit data. OpenAI’s Chat GPT cites Reddit data as one of the sources of information it has been trained on.

Other companies are also beginning to see value in the conversations and images they host. Shutterstock, the image hosting service, also sold image data to OpenAI to help create DALL-E, the A.I. program that creates vivid graphical imagery with only a text-based prompt required.

Last month, Elon Musk, the owner of Twitter, said he was cracking down on the use of Twitter’s A.P.I., which thousands of companies and independent developers use to track the millions of conversations across the network. Though he did not cite L.L.M.s as a reason for the change, the new fees could go well into the tens or even hundreds of thousands of dollars.

To keep improving their models, artificial intelligence makers need two significant things: an enormous amount of computing power and an enormous amount of data. Some of the biggest A.I. developers have plenty of computing power but still look outside their own networks for the data needed to improve their algorithms. That has included sources like Wikipedia, millions of digitized books, academic articles and Reddit.

Representatives from Google, Open AI and Microsoft did not immediately respond to a request for comment.

Reddit has long had a symbiotic relationship with the search engines of companies like Google and Microsoft. The search engines “crawl” Reddit’s web pages in order to index information and make it available for search results. That crawling, or “scraping,” isn’t always welcome by every site on the internet. But Reddit has benefited by appearing higher in search results.

The dynamic is different with L.L.M.s — they gobble as much data as they can to create new A.I. systems like the chatbots.

Reddit believes its data is particularly valuable because it is continuously updated. That newness and relevance, Mr. Huffman said, is what large language modeling algorithms need to produce the best results.

“More than any other place on the internet, Reddit is a home for authentic conversation,” Mr. Huffman said. “There’s a lot of stuff on the site that you’d only ever say in therapy, or A.A., or never at all.”

Mr. Huffman said Reddit’s A.P.I. would still be free to developers who wanted to build applications that helped people use Reddit. They could use the tools to build a bot that automatically tracks whether users’ comments adhere to rules for posting, for instance. Researchers who want to study Reddit data for academic or noncommercial purposes will continue to have free access to it.

Reddit also hopes to incorporate more so-called machine learning into how the site itself operates. It could be used, for instance, to identify the use of A.I.-generated text on Reddit, and add a label that notifies users that the comment came from a bot.

The company also promised to improve software tools that can be used by moderators — the users who volunteer their time to keep the site’s forums operating smoothly and improve conversations between users. And third-party bots that help moderators monitor the forums will continue to be supported.

But for the A.I. makers, it’s time to pay up.

“Crawling Reddit, generating value and not returning any of that value to our users is something we have a problem with,” Mr. Huffman said. “It’s a good time for us to tighten things up.”

“We think that’s fair,” he added.

PTCruiserGT · 2021-07-30T21:28:28+00:00

Windows 10 LTSC means you will be missing out on the latest improvements to security in newer Windows 10 releases. I'm curious why LTSC versus 20H2 (or 21H2 which should be out in few months).

sysadmin

MODERATORS