Eric Capuano - Fortune 100 InfoSec on a State Government Budget

### Challenging the High-Cost InfoSec Myth At 00:00, Eric Capuano, experienced security architect and former state government CISO, opens with a challenge to conventional enterprise cybersecurity dogma: the widespread assumption that building an elite, mature security operations center (SOC) requires spending millions of dollars on proprietary commercial software licenses. Capuano argues that high-priced enterprise security suites frequently generate false senses of security while overburdening internal teams with administrative overhead and vendor lock-in.

### Designing an Enterprise SOC on an Open-Source Foundation At 08:20 and 16:15, Capuano presents architectural blueprints for deploying a robust, enterprise-scale security monitoring infrastructure using freely available open-source tools. He highlights the power of centralized log management using Elasticsearch, Logstash, and Kibana (ELK) alongside Graylog. By architecting scalable ingestion pipelines, state agencies and budget-constrained enterprises can aggregate, parse, and query millions of security events per day across heterogeneous operating systems without paying exorbitant per-gigabyte licensing fees.

### Endpoint Telemetry: The Cornerstone of Detection At 24:18, the presentation focuses on endpoint visibility as the primary line of defense. Capuano explains that network perimeters have largely dissolved due to mobile workers and cloud migrations. He details deploying Microsoft Sysmon (System Monitor) across Windows fleets, configured with community-vetted logging schemas to capture granular process execution, network connections, memory injection events, and driver loads. Paired with OSSEC or Wazuh for endpoint log shipping and file integrity monitoring, defenders gain real-time visibility into adversary techniques.

### Full Packet Capture and Network Analysis with Moloch and Zeek At 32:40 and 40:15, Capuano details the network monitoring tier of his architecture. He advocates deploying Moloch (Arkime) for scalable, indexed full packet capture (FPC) alongside Bro (Zeek) for stateful network protocol parsing. This combination allows incident responders to pivot seamlessly from an endpoint alert directly into raw session packets, verifying whether suspected malware payloads were successfully transferred across the network.

### Operational Success Through People and Threat Hunting Playbooks Concluding between 45:30 and 48:48, Capuano emphasizes that technology represents only one leg of the cybersecurity triad: the most critical factor is training and empowering human defenders. By replacing expensive vendor contracts with internal talent development, organizations can cultivate skilled threat hunters who utilize structured detection playbooks. He demonstrates that a disciplined, well-trained team utilizing open-source tools consistently outperforms poorly maintained commercial software suites.

(AI summary — Gemini 3.8 Flash)