Here’s our top five moments from CISO Series Video Chat: “Hacking Anomalous Behavior: An hour of critical thinking on when user actions raise the red flag.”
Our guests from this discussion were:
- Purandar Das (@dasgp), CEO, Sotero
- Chris Hatter, CISO, Nielsen
Got feedback? Join the conversation on LinkedIn.
HUGE thanks to our sponsor Sotero
Best Bad Idea
Congrats to Jeff Baldwin, cybersecurity architect, Leidos for winning this week’s Best Bad Idea!
Other honorable mentions go to:
“Identify all behavior as anomalous and use a Google poll to determine which behavior should be allowed on a per instance cadence.” – Craig Hurter, director security operations, Colorado Governor’s Office of Information Technology
“Divide your users into “trusted” and “untrusted” users based on who you do and don’t like. Investigate all behavior from the untrusted ones while allowing the trusted users full access everywhere.” – Kira Wojack, marketing consultant
“Ignore all behaviors and investigate intent using a psychic hotline.” – Craig Hurter, director security operations, Colorado Governor’s Office of Information Technology
“Only use an hour of data to determine your baselines.” – Brian Colt, information security engineer, DASH Financial Technologies
“Keep your autoreply on at all times so if someone reports strange behavior you can say you never got the note because you were out of office.” – Neil Saltman, senior account executive, Anomali
“Let every user define his normal behavior and measure against that.” – Roland Mueller, self-employed
Best Unique Tip
“Use a tiered approach to determining standard behaviors. Use the monitor first, then baseline, and then create a dataset per each user that is overlayed on the organizational behaviors. This way you can track/alert/respond based on the dataset. This incorporates both the shotgun and the sniper approach.” – Craig Hurter, director security operations, Colorado Governor’s Office of Information Technology
Quotes from the chatroom
“When I first started looking for anomalies in rich datasets I quickly discovered that the world is an extremely weird place.” – Peter Schawacker, CISO, Axiom Technology group
“The ‘organic’ label in food was supposed to help us source healthier food. But the label was compromised and applied all over the place… I suspect ‘opt-in’ ML bias audits would also be gamed in that same way. Hence the need for regulatory oversight.” – Mike Wilkes, CISO, Security Scorecard
