Science & Technology

Our Security Team's Love Language is Buying New Tools

📚 Main topics

The CISO’s roleA CISO must continually explain why yesterday’s protections failed, because attackers adapt to the defenses in place. 0:00
Forensics and legal defensibilityIncident response does not always require courtroom-level proof, but work that may enter litigation must be defensible. Practitioners should clearly distinguish what they can prove from what they only suspect. 7:17
Security must fit the businessSecurity controls should enable the organization rather than obstruct it. Teams should account for expected exceptions and tailor protections to the business’s pace, risks, and culture. 11:26
Choosing between two security risksThe hosts debate whether a temporary worker with domain admin access is worse than having no domain admin available during an outage. The answer depends on the worker’s role and the consequences of being unable to restore service. 16:39
AI and the future of SIEMThe guests argue that adding AI to a traditional SIEM is not enough; log data can also support broader security, operations, fraud, and observability workflows. 26:35
Insider collusionInsider threats may involve short-lived groups rather than lone actors. In the guests’ experience, intellectual-property theft is especially likely to involve collaborators, while financial fraud is more often solitary. 33:28

✨ Key takeaways

Defensibility matters more than perfect knowledgeIn legal settings, every claim should be supportable, and uncertainty should be stated openly. Opposing counsel may challenge investigative procedures and documentation to undermine credibility. 7:48
Plan for exceptionsIf a business needs exceptions to security controls, build them into the design rather than allowing them to accumulate as unmanaged gaps. 12:30
Log intelligence can reach beyond securityAgents can automate alert triage and investigations, but logs can also help with network operations, fraud detection, and other business needs. 28:38
Investigate beyond the first suspected insiderCollaborators may pass information or recruit others over time, so investigations should trace relationships and communications rather than assume a lone wolf. 34:30

🧠 Lessons learned

Start from the business’s operating realitySecurity models that work in highly restricted environments may not fit a fast-moving startup or a customer-facing business. Controls must reflect the organization’s actual needs and risk tolerance. 13:02
Access and recovery both need safeguardsExcessive administrative access can create serious exposure, but inadequate access during an outage can also prolong disruption. Organizations should plan appropriate, controlled recovery access. 18:13
Look for procedural weaknesses in forensic workInvestigators should document their methods carefully, since opposing counsel may focus on process and credibility rather than the technical conclusion itself. 9:21
Expect collusion in some insider casesThe guests describe collaborators as common in intellectual-property and technology-related cases, while financial fraud may be more likely to involve a lone actor. 36:36

🏁 Conclusion/next steps

Rethink SIEM as a log-intelligence hubConsider how logs and AI agents could support workflows across security and adjacent teams, rather than limiting the platform to alerts and first-pass investigations. 30:48
Prioritize exposures by business impactEvaluate what would stop working if a vulnerability were exploited, and use dependencies, revenue, safety, and regulatory obligations to guide remediation. 31:51
Try Strike 48 and follow upThe guest invites listeners to explore Strike 48’s platform and contact the company, which is hiring. 39:13

Transcript excerpt

0:00 Best advice for a CISO. Go. >> Well, I don't know about best advice, but I like the best definition for you. The best definition I ever heard of a CISO is someone who can tell you why the protection architecture he had in place yesterday didn't work. Uh it's just it's the nature of the beast, right? The attack profile is always built around whatever protection architecture is out there today. But the reality is half of your job is explaining why what you had

0:32 in place didn't work. You know, it's a tough life to lead in some ways. It's time to begin the CISO series podcast. Welcome to the CISO series podcast. My name is David Spark. I am the producer of the CISO series and joining me as my co-host. You know him, you love him. It's Andy Ellis, principal over at Dooha. Andy, say hello to the audience.

1:04 >> Good indeterminate time of the day, folks. I don't know what time it is right now, and I don't know what time you're going to be listening. So, enjoy. >> By the way, Andy claims that he has a cold of some sort, but you sound perfectly fine, Andy. So, >> it is amazing what modern pharmarmacology will do for one. >> I'm very impressed. We are available at cisoseries.com. You should check out all the wonderful programming we have over there. And a big shout out to our sponsor, brand new sponsor, Strike 48, the Agentic Log Platform without blind spot. So Strike

🔒 The full, searchable transcript is available with Pro.

Suggestions