This is the audio podcast version of Troy Hunt's weekly update video published here: https://www.troyhunt.com/tag/weekly-update/
…
continue reading
Sisällön tarjoaa Anton Chuvakin. Anton Chuvakin tai sen podcast-alustan kumppani lataa ja toimittaa kaiken podcast-sisällön, mukaan lukien jaksot, grafiikat ja podcast-kuvaukset. Jos uskot jonkun käyttävän tekijänoikeudella suojattua teostasi ilman lupaasi, voit seurata tässä https://fi.player.fm/legal kuvattua prosessia.
Player FM - Podcast-sovellus
Siirry offline-tilaan Player FM avulla!
Siirry offline-tilaan Player FM avulla!
EP197 SIEM (Decoupled or Not), and Security Data Lakes: A Google SecOps Perspective
MP3•Jakson koti
Manage episode 448474144 series 2892548
Sisällön tarjoaa Anton Chuvakin. Anton Chuvakin tai sen podcast-alustan kumppani lataa ja toimittaa kaiken podcast-sisällön, mukaan lukien jaksot, grafiikat ja podcast-kuvaukset. Jos uskot jonkun käyttävän tekijänoikeudella suojattua teostasi ilman lupaasi, voit seurata tässä https://fi.player.fm/legal kuvattua prosessia.
Guest:
Travis Lanham, Uber Tech Lead (UTL) for Security Operations Engineering, Google Cloud
Topics:
- There’s been a ton of discussion in the wake of the three SIEM week about the future of SIEM-like products. We saw a lot of takes on how this augurs the future of disassembled or decoupled SIEMs. Can you explain what these disassembled SIEMs are all about?
- What are the expected upsides of detaching your SIEM interface and security capabilities from your data backend?
- Tell us about the early days of SecOps (nee Chronicle) and why we didn’t go with this approach?
- What are the upsides of a tightly coupled datastore + security experience for a SIEM?
- Are there more risks or negatives of the decoupled/decentralized approach? Complexity and the need to assemble “at home” are on the list, right?
- One of the 50 things Google knew to be true back in the day was that product innovation comes from technical innovation, what’s the technical innovation driving decoupled SIEMs?
- So what about those security data lakes? Any insights?
Resources:
- EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations
- EP190 Unraveling the Security Data Fabric: Need, Benefits, and Futures
- EP184 One Week SIEM Migration: Fact or Fiction?
- Hacking Google video series
- Decoupled SIEM: Brilliant or …. Not :-)
- UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
- So, Why Did I Join Chronicle Security? (2019)
212 jaksoa
MP3•Jakson koti
Manage episode 448474144 series 2892548
Sisällön tarjoaa Anton Chuvakin. Anton Chuvakin tai sen podcast-alustan kumppani lataa ja toimittaa kaiken podcast-sisällön, mukaan lukien jaksot, grafiikat ja podcast-kuvaukset. Jos uskot jonkun käyttävän tekijänoikeudella suojattua teostasi ilman lupaasi, voit seurata tässä https://fi.player.fm/legal kuvattua prosessia.
Guest:
Travis Lanham, Uber Tech Lead (UTL) for Security Operations Engineering, Google Cloud
Topics:
- There’s been a ton of discussion in the wake of the three SIEM week about the future of SIEM-like products. We saw a lot of takes on how this augurs the future of disassembled or decoupled SIEMs. Can you explain what these disassembled SIEMs are all about?
- What are the expected upsides of detaching your SIEM interface and security capabilities from your data backend?
- Tell us about the early days of SecOps (nee Chronicle) and why we didn’t go with this approach?
- What are the upsides of a tightly coupled datastore + security experience for a SIEM?
- Are there more risks or negatives of the decoupled/decentralized approach? Complexity and the need to assemble “at home” are on the list, right?
- One of the 50 things Google knew to be true back in the day was that product innovation comes from technical innovation, what’s the technical innovation driving decoupled SIEMs?
- So what about those security data lakes? Any insights?
Resources:
- EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations
- EP190 Unraveling the Security Data Fabric: Need, Benefits, and Futures
- EP184 One Week SIEM Migration: Fact or Fiction?
- Hacking Google video series
- Decoupled SIEM: Brilliant or …. Not :-)
- UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
- So, Why Did I Join Chronicle Security? (2019)
212 jaksoa
Kaikki jaksot
×Tervetuloa Player FM:n!
Player FM skannaa verkkoa löytääkseen korkealaatuisia podcasteja, joista voit nauttia juuri nyt. Se on paras podcast-sovellus ja toimii Androidilla, iPhonela, ja verkossa. Rekisteröidy sykronoidaksesi tilaukset laitteiden välillä.