登录查看更多内容

What do you do if you want to learn from security breaches as a network security professional?

由人工智能和领英社区提供技术支持

As a network security professional, understanding and learning from security breaches is paramount. These breaches can be invaluable learning experiences, providing insights into vulnerabilities and the tactics used by cybercriminals. To effectively learn from these incidents, you must approach them with a mindset geared towards improvement and prevention, rather than mere reaction. This means dissecting each breach methodically, identifying what went wrong, and taking steps to ensure similar vulnerabilities are fortified. By doing so, you turn a negative event into a proactive tool for enhancing your network's security posture.

此文章中的业界达人

由社区从 8 条内容中精选。了解更多

Alexandre Murakami

Security Practice Director Latam
Ryan Breed

Security at HashiCorp

1 Analyze Events

When a security breach occurs, your first step is to conduct a thorough analysis. Gather as much data as possible about the incident, including how the breach was detected, which systems were affected, and the type of attack that was carried out. Understanding the attack vector—whether it was a phishing scam, malware, or an exploited vulnerability—will help you to identify weaknesses in your network. This information is crucial for patching holes and preventing future breaches. Remember, the goal is not just to fix the problem, but to learn from it.

添加您的观点

Alexandre Murakami

Security Practice Director Latam
举报内容
Na verdade, muitas vezes esta etapa é denominada análise forense do incidente. Como sugest?o para realizar esta etapa, considerar a contrata??o de empresas especializadas que já possuem know how e cases de sucesso. S?o vários procedimentos, processos e atividades que somente aqueles que est?o acostumados com esta situa??o, ter?o mais sucesso de alcan?ar o objetivo. Com certeza o resultado de uma análise forense, poderá dar visibilidade dos gaps e vulnerabilidades da sua infraestrutura e direcionar possíveis formas de mitiga??o visando um ganho na maturidade de seguran?a.

已翻译

赞
Ashhish P Shrivastava

Head IT Applications, Infrastructure, Operations | CISO | ITIL,PMP,CEH V12 | Digital Strategist. SAP S4 HANA, Cloud Migration, Manufacturing Process Improvement, Shared Services Setup | Ex Bombay Dyeing, Ex Tata Autocomp
举报内容
To learn from security breaches as a network security professional, it is essential to conduct a thorough analysis of the incident. Identify the root cause, assess the impact, and implement necessary measures to prevent future occurrences. Stay updated on the latest security trends and technologies to enhance your skills. Continuous learning and sharing knowledge with peers in the industry are crucial for professional growth.

已翻译

赞

2 Incident Response

After analyzing the breach, review your incident response plan. This plan should outline the steps to take when a breach occurs, including containment strategies, eradication of threats, and recovery processes. If the breach was successful despite having a response plan in place, it’s important to identify why the plan failed and how it can be improved. Was the response too slow? Were procedures not followed correctly? Use this as a learning opportunity to refine your response plan and ensure faster, more effective action in the future.

添加您的观点

3 Upgrade Skills

To keep up with evolving threats, you must continuously upgrade your skills and knowledge. This includes staying informed about the latest security trends and attack methods. Consider obtaining certifications such as Certified Information Systems Security Professional (CISSP) or Certified Ethical Hacker (CEH), which can provide structured learning paths. Participate in workshops, webinars, and conferences to learn from other professionals' experiences and to share your own insights on security breaches.

添加您的观点

Alexandre Murakami

Security Practice Director Latam
举报内容
O aprendizado contínuo na área de seguran?a, faz parte do processo de sobrevivência do profissional desta área. A todo momento s?o publicados novas vulnerabilidades, novos tipos de ataques, novas solu??es tecnológicas de seguran?a, novas normativas e frameworks que alimentam este ecossistema. O compartilhamento de experiências através do networking com diversos profissionais é uma das formas mais importantes para se manter atualizado.

已翻译

赞

4 Share Knowledge

Sharing knowledge with your peers is an important aspect of learning from security breaches. By discussing recent incidents with colleagues or through professional networks, you can gain different perspectives on how to handle similar situations. This collective wisdom not only broadens your understanding but also contributes to the development of best practices within the network security community. Collaboration is key to staying ahead of cyber threats.

添加您的观点

Ryan Breed

Security at HashiCorp
举报内容
"It's not a failure until it's a failure to learn" Cyber security incindents, more often than not, occur at the end of a years-long process of rational decisions made by reasonable people. There will always be infinite work, but pre-mortem/near-miss/post-mortem lessons are the hardest-earned and most valuable. Advertise them and incorporate into your forward-looking estimates of potential risk. Each new identified failure mode has an opportunity to re-frame assumptions and risks. See how people work normally in ways that create conditions for crisis. What controls or guidance make this more likely? Do you still need that? What systems can be deprecated?

已翻译

赞

5 Implement Changes

Once you’ve learned from a breach, it's critical to implement changes to prevent recurrence. This could involve updating software, changing policies, or reconfiguring network architecture. It's essential to prioritize these changes based on the risk they pose to your organization. Additionally, ensure that all stakeholders are aware of the changes and understand their roles in maintaining network security. Effective communication and training are vital to the successful adoption of new security measures.

添加您的观点

Ryan Breed

Security at HashiCorp
举报内容
There will always be infinite work. Do you really need to add something new? New controls create new failure modes and additional assumed complexity over time. Can you remove components, systems, and processes before you add them? Each new alert becomes camouflage for the next ttp. Smaller, more defensible, and more observable components that generate usable diagnostics will win out over adding security components, analytics, or processes.

已翻译

赞

6 Continuous Monitoring

Finally, establish a system of continuous monitoring to detect anomalies that could indicate a breach. Use tools like intrusion detection systems (IDS) and security information and event management (SIEM) to keep an eye on network traffic and logs. Regularly review these systems to ensure they are capturing the right information and that you are able to respond quickly to any alerts. Continuous monitoring is a proactive way to stay one step ahead of potential security breaches.

添加您的观点

Alexandre Murakami

Security Practice Director Latam
举报内容
Como sugest?o, as solu??es de detec??o e resposta de rede (NDR), s?o ferramentas interessantes para detectar incidentes em redes, usando inteligência artificial (IA), aprendizado de máquina (ML) e análise de dados. Além das solu??es tecnológicas de seguran?a de redes, n?o podemos deixar de esquecer dos processos e fator humano. Assim, considero o Centro de Opera??es de Seguran?a (SOC) um importante aliado para a monitora??o continua. Um SOC bem estruturado é que contém todos os elementos necessários para obter o sucesso.

已翻译

赞
Ryan Breed

Security at HashiCorp
举报内容
Alerts should reference governance scope, control IDs, infrastructure resources, and resolved identity information where possible. Scope validation should be a key part of surface monitoring and governance-related inventory management. Signal dropouts, unexpected changes to scope-level observabilty, and analytical errors should be tracked on a separate queue compared to security/activity alerts.

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Ryan Breed

Security at HashiCorp
举报内容
Grow your talent from personnel with a naturally-unsatisfiable curiosity. Adversary mindset can be taught. Value analytical talent that can flip between layers of abstraction to see how system activity might be represented from different observable surfaces. Provide a gentle gradient for investigative work and lots of pointers to how to get to the next more detailed/more abstract level of information as an investigation progresses. Plan high churn for early-career talent if you are lucky and can provide increasing levels of autonomy and interesting work. Talent has a way of finding a good challenge and a handsome paycheck. Theres' always something interesting to look at. keep analysts engaged with rewarding work that worth talking about.

已翻译

赞

Network Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What do you do if you want to learn from security breaches as a network security professional?

1

2

3

4

5

6

7

1 Analyze Events

2 Incident Response

3 Upgrade Skills

4 Share Knowledge

5 Implement Changes

6 Continuous Monitoring

7 Here’s what else to consider

Network Security

给文章评分

感谢您的反馈

更多Network Security相关文章

更多相关阅读内容

What do you do if you want to learn from security breaches as a network security professional?

1

2

3

4

5

6

7

1 Analyze Events

2 Incident Response

3 Upgrade Skills

4 Share Knowledge

5 Implement Changes

6 Continuous Monitoring

7 Here’s what else to consider

Network Security

给文章评分

感谢您的反馈

查看其他技能