Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!
I was the lone security person there for a bit. Now there's 4 of us. I broke it down into two risks:
service / system outage data breach / loss
The way I approached shoring up defenses was with specific activities each week:
vulnerability remediation audit & compliance incident response governance & policy security awareness program
It might help to think of things in a maturity model. Putting in a SEIM is a big job, and maybe more appropriate for when the security program at your org has matured more. What you can do is spend time working on the other stuff - what's your endpoint protection? What compliance requirements do you have? How's your inventory & asset management? What's policy look like? Do your AD accounts all make sense? What's the password policy? Do you have any old service accounts?
Picking little stuff allows you to make progress, and gets you ready to move to the bigger things. A mentor once told me to use a checklist (for life in general, but applies to cyber):
1 Did they ask you for help 2 Do you have it to give 3 Have you done enough for now
Good luck!