Department of Defense Releases Zero Trust Strategy and Roadmap

Re:Department of Defense Releases Zero Trust Strategy and Ro... by nekoashide on Tuesday November 22, 2022 @10:08PM (#33714671)

A big problem is insiders selling information or ransoming it under the guise of a breach. Employees are the single greatest threat to any organization so behavior analytics is starting to become really big.

As I tell people, "We don't care if you browse Reddit, we only care if you start doing things an employee shouldn't".

But to answer your questions we would just ingest those alerts into Splunk, build a KB on how to handle the alerts when they trigger and then begin the process of filtering out the noise. The SOC Analyst who works these alerts will get numb to them but still pick out the unusual ones to investigate.

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by CDT-MLT on Tuesday November 22, 2022 @10:35PM (#33714837)

That is something right there. I am intrigued by this.

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by bogomipz on Tuesday November 22, 2022 @11:41PM (#33715287)

I'm curious are there any open source "behavior analytics" projects that are gaining traction?

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by Godel_unicode on Wednesday November 23, 2022 @09:04PM (#33727079)

No, you need too much data and it’s too specific to the environment.

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by traceroute66 on Wednesday November 23, 2022 @04:45AM (#33717094)

> just ingest those alerts into Splunk

Aah yes, Splunk....

Good tool, but realistically only viable for those working for a corporate-sized employer with corporate-sized pockets filled with $$$$$$$.

Most people can't afford to simply dump it all into Splunk and (if they are using Splunk at all) have to pre-filter first. Which kind of defeats the point of Splunk if they're already doing the hard work outside, and so might was well use some cheaper (F)OSS tool.

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by milkshakes on Wednesday November 23, 2022 @05:58AM (#33717648)

you can do the same type of work with spark, which is free

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by rsdbdr203 on Wednesday November 23, 2022 @08:33AM (#33718886)

Working on a startup to basically be 75% of the features of Splunk at 50% the cost: https://log-store.com/

Right now it's 100% free, because I'm just looking for user feedback. I think/hope there is an opening in the market for folks looking for an easy-to-use, but powerful tool like Splunk, but can't afford their hefty price tag. All feedback welcomed!

Also created an open-source ETL tool: https://log-ship.com

[ Parent | on HN ]

Re:Department of Defense Releases Zero Trust Strategy and Ro... by traceroute66 on Wednesday November 23, 2022 @09:03AM (#33719170)

That sounds interesting, I'll certainly give it a go when I get a chance in the near-future !

[ Parent | on HN ]