Re:Ask HN: How do you continuously monitor web logs for hack...
by eeZah7Ux on Wednesday May 09, 2018 @06:48PM
(#17034958)
> "Defense in depth" is just a way security product salespeople get customers to buy more stuff.
"just" that? That's a very bold statement that most of the security community would disagree with.
An example: you don't monitor network traffic on the border because you trust your server not to be compromised. Then one gets compromised and the incident goes undetected due to lack of monitoring.
> If you remove attack surface altogether
That's a big if. Services can have a complex life, with software and configuration changing often. Unless you pull the plug you attack surface is never going to be zero and, on top of that, there so guarantee that it stays small. Hence organizations usually have different people taking care of different layers.
"just" that? That's a very bold statement that most of the security community would disagree with.
An example: you don't monitor network traffic on the border because you trust your server not to be compromised. Then one gets compromised and the incident goes undetected due to lack of monitoring.
> If you remove attack surface altogether
That's a big if. Services can have a complex life, with software and configuration changing often. Unless you pull the plug you attack surface is never going to be zero and, on top of that, there so guarantee that it stays small. Hence organizations usually have different people taking care of different layers.