Collaborate Disseminate
This fun discussion on industry analyst craft reminded me of an unfinished post I had sitting in my draft folder … for a year. And now it is finished! When we create research and decide to include or mention vendors [uh-oh, careful with the topic… Continue reading Why We Value Inquiry Visibility Over … Well … Over Everything Else?
This post is part of our current SOC research, but it also touches on our past SOAR research. Here is the thing: when we looked at SOAR technology, we mostly saw more mature SOCs adopting the tech. This is primarily based on the fact that they “t… Continue reading SOAR-native SOC, Can This Work?
As Gartner GTP client inquiry volumes grow, our team needs to expand again. We now have THREE positions open (one long-running replacement hire and two expansion hires). So … our team at Gartner for Technical Professionals (GTP) is HIRING! If you… Continue reading Our Team Is Hiring: THREE New Positions Open – North America and Europe
Contrary to what some “analytics” or “AI” vendors will have us believe, SIEM in 2018 is not the SIEM of our grandfathers. In 2002, when I was first initiated into the dark arts of SIEM, it was very different (it was called eithe… Continue reading What Is “SIEM+” Or “Can We Have A Cyber Defense Platform?”
Now, when you hear a phrase “application security monitoring”, what picture comes to mind? For me, nothing does… As I said in February 2012, “the industry has not yet figured out what application security monitoring (ASM) is.… Continue reading 2012 Redux: What Is Application Security Monitoring?
One more important angle we are exploring in our SOC paper update is about so-called “hybrid SOCs.” In our SOC materials, this admittedly nebulous term refers to a SOC that uses a substantial (as I warned … “nebulous”) amo… Continue reading Hybrid SOC Scenarios
Along the lines of this post where we discussed the concept of “SIEM alternatives”, let’s discuss this in the context of a modern SOC. Will I ever do or recommend a SIEM-less SOC? — As you can guess from the above, my answer is … Continue reading Can You Do a SIEM-less SOC?
OK, I got a catchy headline, now what? This is another philosophical post about the fate of our beloved domain of cyber. Specifically, we all remember Dan Geer’s classic quote “Internet security is quite possibly the most intellectually cha… Continue reading Is Security Just Too Damn Hard? Is Product+Service The Future?
Here is my traditional “reading the DBIR aloud” (i.e with quotes shared) post. Read the entire thing, BTW, and not my favorites below: “Incident: A security event that compromises the integrity, confidentiality or availability of an i… Continue reading Highlights from Verizon DBIR 2018
As we are preparing for a project to update our famed SIEM and SOC guidance documents, let’s have a quick discussion of so-called “SIEM alternatives.” If you recall my funny post “Is SIEM The Best Threat Detection Technology, Ev… Continue reading SIEM Alternatives? What Are They? Do They Exist?