超越指标：在检测与响应中培养持续改进的文化.pdf

1、#SECTORCA SecTorCABeyond MetricsCultivating a culture of continuous improvement in detection&response#SECTORCA SecTorCA$whoami Evaluating metrics 2Fast2Measure:Rethinking metrics Building a culture of qualityAgenda#SECTORCA SecTorCA$whoamiZach ZeidPrincipal Detection&Response Engineer|E obsessedMeme

2、 enthusiast#SECTORCA SecTorCA#SECTORCA SecTorCACoverage widthCoverage depthMITRE as a 3D ruler How many detections do we have for those tactics?How many detections do we have for each tactics techniques?How many types of detections for each tactic?Coverage breadth#SECTORCA SecTorCA#SECTORCA SecTorCA

3、“We cover 100%of the 1,000+MITRE techniques.”-Wayne Gretzky -Michael Scott#SECTORCA SecTorCAChallengesUsing the MITRE ATT&CK to map detections to techniques isnt an indicator of quality coverage.Metrics as your North StarQuality metrics are essential to tracking progress and driving improvement.Comp

4、lexityIdentifying coverage gaps isnt as simple as reviewing detections(hint:use the 3D ruler).Evaluating security metrics#SECTORCA SecTorCATHE QUESTIONWell,what now?Some metrics(alert volume,false positive rates,etc.)only tell part of the story.For example:alert volume.Tracking alert volume is cruci

5、al,but questions remain Did we lose or gain a new data source?Are analysts tuning out noisy alerts?What needs the most attention?Do we invest in new tooling?And more.#SECTORCA SecTorCALets dial it back to the most important question:Why monitor metrics at all?Board reporting purposes?Monitoring for

6、the sake of monitoring?Metrics should do more than measure speed,they should tell us where to focus our resources and how to improve.#SECTORCA SecTorCATHE QUESTIONWhatre the flaws?THE QUESTIONTaking a closer look,traditional metrics lack some crucial information.For example:false positives and true