Lead Cybersecurity Architect • Executive and Board Advisor • Keynote Speaker • Professional Storyteller https://xitter.cf/t.co/UW4j471MsT
Joined July 2016
- Tweets3.8K
- Following379
- Followers5.9K
- Likes6.8K
Pinned Tweet
My new video on Security Operations (SecOps/SOC) just dropped!
I cover all the important aspect of SecOps including how AI does 𝘢̲𝘯̲𝘥̲ 𝘥̲𝘰̲𝘦̲𝘴̲𝘯̲'̲𝘵̲ change SecOps.
Share and Enjoy!
youtube.com/watch?v=DX2NehNM…
I'm updating an MCRA visual mapping Microsoft security technologies to security disciplines + the roles that primarily use them.
Early draft 👇
Useful? Wrong? Confusing? Missing something?
What would you change or add?
Would love your feedback!
Security is a Team Sport
…but if you have no idea who the players and positions are, you are probably going to lose most of your games.
All roles in an organization have a critical part to play in avoiding the next cybersecurity crisis, including YOU! 🙂
👇
I wrote up an article describing how each role from CEOs and CFOs to IT Infrastructure to lawyers to architects to SecOps/SOC analysts play a critical part in keeping attackers from causing a really bad day (disrupting your business, stealing data, etc.)
linkedin.com/pulse/cybersecu…
I was updating the slide notes for the AI top priorities slide in the MCRA (aka.ms/mcra) and thought it would make a nice LinkedIn article to guide folks, so I did a quick conversion.
Share and enjoy!
linkedin.com/pulse/what-do-f…
Progress isn’t “we deployed another security product.”
You want outcomes:
→ Less standing privilege
→ Fewer unmanaged exceptions
→ Smaller blast radius
→ Better access decisions
→ Faster investigation and recovery
AI makes Zero Trust even more important.
AI agents identities can access data, call tools, make decisions, and act at machine speed.
Same core Zero Trust principles. New kinds of identities and risk.
🎥 YouTube: youtube.com/watch?v=dVa9K3n3…
🔉 Spotify: open.spotify.com/episode/4J8…
If your Zero Trust strategy starts with a shopping list of security products, you’re probably not doing it right. 😀
A few thoughts from a recent podcast 👇
Where do you start?
Not by trying to “implement Zero Trust” everywhere at once.
Start with what matters to the business, then work outward to the identities, data, apps, devices, infrastructure, and networks that enable it.
One of thing I talked about in my last Tampa BSides talk is how security and business leaders can and must work together effectively as accountable and responsible stakeholders.
Video Here - youtube.com/watch?v=l0cCZX4Z…
Link to download the slides here - zerotrustplaybook.com/events…
If your business and security and technology people are fighting with each other instead of working together, you will experience more business disruption from more incidents and higher impact of each incident.
Hot take: AI isn't going to eliminate the SOC analyst.
It will eliminate a lot of the work SOC analysts do today.
That's an important distinction.
We've seen this movie before. 👇
We need to think about how to shift people into more:
→ Threat hunting
→ Detection engineering
→ Prevention
→ Threat intelligence
→ Security architecture
There's no shortage of work, especially when attackers are using AI too.
The mistake is viewing AI primarily as an opportunity to remove people.
The bigger opportunity is to increase the ambition of the SOC.
I cover how AI is changing SecOps roles in my latest video - youtube.com/watch?v=DX2NehNM…
▬▬▬▬▬▬ Video Chapters ▬▬▬▬▬▬
0:00 SecOps/SOC Explained
2:52 How AI-Driven Attacks impact SecOps workload
6:18 SecOps Mission and Key Metrics
7:35 Core SecOps Capabilities
10:38 Bringing SecOps Capabilities to Life with People, Process, and Technology
⬇️