10lbs of tacos in a 5lb bag: Lessons Learned from Security Operations in a Dynamic and Resource Constrained Environment

The speaker, who previously ran a security operations center for a software company, opens with the threat landscape. Most attacks involve only a few steps, ransomware keeps growing, and ransomware-as-a-service lowers the barrier for criminals. He then contrasts well-resourced security teams with the typical small, stretched team that covers many duties at once.

The core story follows joining a fifteen-year-old global software company during a turnaround, where two people covered thousands of employees and endpoints. Incident response was weak, infrastructure was not centrally controlled, and development and cloud environments were largely unmanaged. The approach started with visibility: identifying key assets, rolling out endpoint detection broadly, and inventorying accounts and existing controls against a framework. Early wins included enforcing multi-factor authentication, automatically installing the EDR agent on new cloud instances, running incident response tabletop exercises, and having finance hold cloud expenses that bypassed security review. A missing response standard was addressed with a 24-hour target for critical issues.

Closing lessons centred on hiring for specific capabilities, planning for self-sufficiency when outsourcing, adopting known frameworks and implementing them fully, and building processes before relying on technology. He urged communicating in terms of business impact and education rather than fear, factoring security into total cost of ownership, and showing progress in phases. He also argued that a defensible decision made through a clear process beats no decision.