8 Stel Valavanis "Detection is your Superpower"

### Overview Stel Valavanis, CEO of Montreal Security (and referencing Onshore Security's Panoptic platform), argues that detection is an organization's ultimate cybersecurity advantage. While conventional thinking holds that defenders must be right 100% of the time whereas attackers only need to succeed once, Valavanis explains that once an adversary breaches the perimeter, the dynamic reverses. Inside the defender's territory, attackers must avoid making a single mistake across days or months of activity, whereas defenders only need to catch one slip-up.

### Key Topics - **Defenders' Inherent Territory Advantage**: Attackers can fail repeatedly from the outside across the vast internet without consequence, but once inside a monitored network, every action creates risk for them. - **Protection vs. Detection**: Protection controls (firewalls, EDR, web filtering, microsegmentation) create false confidence when treated as "set-and-forget." Every protection mechanism must simultaneously operate as a tripwire and detection sensor. - **Attacker Realities and Dwell Time**: Intrusions require reconnaissance, lateral movement, privilege escalation, and staging. Average dwell times remain around 100 days, with cases like SolarWinds lasting up to two years and ransomware operators needing days or weeks to ensure backups are compromised before detonation. - **Managed Detection and Response (MDR)**: The combination of network packet sensors, host agents, centralized log management (SIEM), Big Data correlation tools (Elasticsearch, Kibana), and critical human analyst oversight.

### Technical Details - **Comprehensive Sensor Coverage**: Telemetry must span servers, operating systems, cloud host workloads, SaaS API logging, remote users, switches, routers, VPN tunnels, DNS, and DHCP. - **Tripwires and Correlation**: Logging blocked connection attempts, failed logins, abnormal producer-consumer data ratios, subnet port scans, open printer ports, or memory reads creates breadcrumbs. Correlating these derivatives of network behavior allows analysts to spot intrusions. - **Tooling Architecture**: Valavanis highlights the Panoptic platform components: distributed network/cloud sensors, host agents (EDR/IDS/DLP), and a central SIEM leveraging Elastic and Kibana. He differentiates SIEM from XDR (viewed primarily as an evolution or expansion of EDR) and NDR. - **Contextual Data**: Live event telemetry is enhanced by continuous vulnerability scanning and penetration test results, helping analysts filter noise and pinpoint exposures.

### Takeaways - Stop relying solely on prevention controls; configure every defense mechanism to log and alert as a detection sensor. - Centralize independent network and system telemetry into a SIEM or Big Data platform to correlate behavior. - Employ human analysts (via MDR) for threat hunting, tuning, and interpreting complex telemetry. - Maintaining robust detection and forensic logs satisfies compliance frameworks and can significantly reduce financial liability by proving whether data was actually exfiltrated during an incident.