The 7 Things I Know About Cyber Security After 25 Years | April 2024

1
The 7 Things I Know About
Cyber Security After 25 Years

© 2024 ExtraHop® | All Rights Reserved | Proprietary and Confidential
2
RA F A L L O S
Head of Services Strategy & GTM at ExtraHop
~25 years in cyber security
Broad expertise in product and services
development, security strategy, and problem-solving
Podcaster
Down the Security Rabbithole Podcast
Writer and public speaker
Biography

3
“What makes you qualified to give this talk?”
These are all lessons I’ve learned, first-hand, the hard way

4
My 3 guiding principles

5
Change is relentless

6
crime pays

7
Security vs “human nature”

8
1. You Don’t Want ZERO Risk
Check your math, and try again

9
business relies on taking risks

10
“Enigo Montoya” problem

11
security is a 1/x curve

12

13
you’re never getting to ZERO

14
at some point,
cost exceeds benefit

15
risk = probability x impact

16
don’t get fooled by chance

17
reducing risk, creates risk

18
either extreme is bad

19
2. Change the things you can
The magic quadrant of bad ideas

20
effort vs impact

21
low effort, high impact

22
low effort, low impact

23
high effort, high impact

24
high effort, low impact

25
law of diminishing returns

26
inverted hockey stick curve

27
“good ‘nuff”

28
3. Today’s Feature, Tomorrow’s 0-Day
How did this even happen?!

29
security ← → innovation

30
today’s innovative idea…

31
..tomorrow’s critical flaw

32
so what happened?!

33
what is the right response?

34
triage vs prevent

35
“seemed like a good idea”

36
plan for rapid triage

37
this will happen again

38
4. The “Great Awakening” Isn’t Coming
The “big one” happened, no one cared

39
“It’ll take a big incident…”

40
nope

41
catastrophes are recoverable

42
business is resilient

43
we screwed up, big time

44
the sky fell, we still lived on

45
some become disillusioned

46
too many “don’t get it”

47
now what?!

48
the hamster wheel is your
reality

49
5. Alt + Tab is a Hunter Killer
Smart does not scale

50
inverse proportionality

51
more screens

52
less security

53
your brain cannot correlate
(at scale)

54
platforms & integrations

55
ask the right questions

56
get better answers

57
tech isn’t magic

58
question
answer
analyze
act
analyze

59
6. DIY is Best Left on TV Shows
A fancy hammer does not a master carpenter make

60
re-inventing the same wheel

61
uniqueness is a weakness

62
patterns exist

63
expertise exists

64
what makes us do it
ourselves?

65
talent shortage (duh)

66
budget constraints

67
time/effort constraints

68
Most applicable in operations

69
accept limitations, and help

70
7. Stop Trying to Build Castles
We all basically live in the suburbs now anyway

71
castle as a metaphor

72
this metaphor aged poorly

73
we left the office

74
data went with us

75
clouds destroyed our models

76
sensitive data is everywhere

77
by use-case, or accident

78
security models must adapt

79
make data risk-resilient

80
Thank You
Thank You

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie The 7 Things I Know About Cyber Security After 25 Years | April 2024

Ähnlich wie The 7 Things I Know About Cyber Security After 25 Years | April 2024 (19)

Mehr von Rafal Los

Mehr von Rafal Los (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

The 7 Things I Know About Cyber Security After 25 Years | April 2024