Conference season is kicking in again. It looks like this year will be a busy year for me. I will be speaking at the RSA conference mid February in San Jose. Then I just got notice that I got accepted to EuSecWest06. Both places I will be talking about Security Event Visualization. The EuSecWest presentation is going to be more technical and AfterGlow driven, while the RSA presentation is more on the higher level of visualizing security data and attaching a workflow to that.
I have been interested in the workflow aspect of security monitoring for a long time already. It kind of started about three years back with a presentation on Intrusion Management I gave at ETH Zurich. There I tried to outline that the incident response and security event monitoring processes need to be tightly integrated into the other IT process. I guess over time this has become quite apparent, but I still don’t see it completely implemented at many places.