In this lesson, we will learn
about monitoring and response.
Monitoring and response is continuously observing
system activities to detect, analyze,
and respond to threats.
Monitoring and response concepts include event logging
and monitoring, as well as endpoint detection and response.
Event logging and monitoring is the process of recording
and tracking system and application activities
to identify abnormal behavior.
Endpoint detection and response, or EDR,
offers individual endpoints real-time visibility,
automated threat detection, and remediation to isolate
and quarantine malicious activity as quickly as possible.
Let's learn more about event logging and monitoring,
as well as endpoint detection and response.
First, we have logging and monitoring.
Logging and monitoring
are essential components of cybersecurity.
In enterprise networks, computers and network devices
constantly perform actions that are invisible
to the human eye.
To understand what is happening on a system,
network device, or firewall,
information system professionals like us rely on log files.
These logs capture system events, application events,
user actions, and network activities.
Network defenders monitor and analyze these logs
to identify indicators of attack, indicators of compromise,
and to reconstruct attack timelines
during incident response.
But despite its importance,
logging presents a major challenge.
We cannot log everything.
Each log requirement consumes a valuable processing power,
memory, and hard drive space.
So if we log too much, we risk degrading the performance
of the devices we are trying to protect.
On the flip side, logging too little
can leave us without critical information that we might need
to fully understand and audit a malicious event.
The need for balance is why we must carefully design
our logging and auditing mechanisms,
making deliberate decisions
about what to log and what not to log.
So to maintain an effective logging system,
we need a solid audit log management plan.
This plan needs to define what is logged,
how long logs are kept, and how logs are backed up.
Additionally, we need to plan
for how often logs will be reviewed.
Protecting log files against unauthorized deletion
is equally important.
We may even require controls such as two-person approval
for any log modification or deletion
to help ensure the integrity and availability of our logs.
These controls become particularly important
when logs are needed in incident response.
Building on log management.
Audit trails play a vital role
in capturing detailed records of system transactions.
An audit trail is a detailed record of all transactions
and system activities, documenting the sequence of events,
actions taken, and any changes made.
Audit trails help in tracking and analyzing user behavior
and system performance for security and compliance purposes.
Audit trails may also specify whether attempted events
were successful or if they failed.
This can be directly used to detect misuse or attack,
including attacks on the logging systems themselves.
By monitoring and analyzing logs for unusual behavior,
professionals can quickly spot indicators of attack.
So when setting up a logging strategy,
deciding what to log is critical.
Establishing thresholds for logging specific actions
is also important.
For example, should every failed login attempt be logged,
or should we only log it after the third failed attempt?
Logging every attempt might flood the system with data,
especially if the event is simply a user
mistyping their password a few times.
However, logging too little could mean missing signs
of a brute force attack.
Similarly, logging actions like user additions,
modifications, or deletions can help us maintain visibility
because these types of changes are often made by attackers
after they breach a system.
It's also important to consider that attackers
might try to cover their tracks by manipulating logs,
a tactic known as scrubbing the logs or covering tracks.
Missing time entries or unexplained gaps in logs
are often signs of tampering.
So to enhance our logging systems, we can use automation
to trigger alerts or notifications
when specific events occur.
For instance, if a user account is elevated
to an administrative level, the system can send an alert
to a system administrator for verification.
With such a volume of logs to manage,
organizations often turn to tools
like a security information and event management system,
also known as a SIEM.
At work, you might hear this pronounced
as either SIEM or SEIM.
In this lesson, I will be pronouncing it SIEM.
SIEMs combine security event management
and security information management into one platform,
and they are typically used
by security operation centers, or SOCs.
SIEMs provide real-time monitoring, automated alerts,
and notifications when activities deviate from the norm.
Well-known SIEM tools like ArcSight, AlienVault,
and QRadar are widely used across the industry.
One of the key strengths of SIEMs
is their ability to perform data aggregation
and data correlation.
Data aggregation involves collecting logs
from various devices, servers,
and applications into a centralized database,
making it easier for security professionals
to access and analyze logs in one place.
For instance, instead of an operator
manually retrieving logs from individual devices
like DHCP servers, DNS servers,
routers, firewalls, and intrusion detection systems,
SIEMs gather all this data
into one accessible platform for analysis.
Following data aggregation,
data correlation helps connect the dots
between the different logs,
revealing the bigger picture of an attack.
For example, if an attack occurs at 3:01 AM,
a SIEM can automatically align all relevant logs
to a standard time, such as coordinated universal time,
making it much easier to compare apples to apples
and oranges to oranges in the logs.
This makes it possible to analyze all related events
across multiple devices,
and it eliminates the time-consuming process
of manually downloading logs from each device,
normalizing time zones, and piecing together a timeline.
Beyond daily monitoring.
SIEMs are invaluable for regulatory audits
and forensic analysis.
They act as a central repository
that demonstrates compliance during audits
and facilitates forensic investigations after an incident.
Second, we have endpoint detection
and response, or EDR.
EDR solutions are designed to give professionals
better visibility over endpoints such as computers,
laptops, and servers, and to help detect
and respond cyber threats and exploits.
Unlike simple anti-malware solutions,
which mainly focus on identify and blocking known threats,
EDR tools can identify previously unknown attack patterns
and ongoing attacks on a device.
To achieve this, EDR continuously monitors
the processes running on a computer, keeps track of files
being accessed and detects any suspicious network activity.
It also notices changes to the device's baseline,
such as unexpected software installations
or unauthorized setting modifications.
This monitoring capability gives EDR a distinct advantage
in spotting unusual activities
that could be early signs of an attack.
A critical aspect of EDR is its ability
to act quickly when a threat is detected.
And one of its most powerful features
is isolating compromised endpoints
to prevent the spread of malicious activity.
When an EDR identifies suspicious behavior,
it can immediately disconnect the affected device
from the network while still allowing remote access
to it for investigation,
stopping threats like malware, ransomware,
or unauthorized data transfers
from spreading to other devices and IT systems.
Beyond isolation.
EDR enhances overall security by cross-correlating data
across the organization and integrating techniques
like allowlisting and denylisting with behavioral analysis.
This allows EDR to observe endpoint activities
without telegraphing that it knows about ongoing attacks.
An important element that sets EDR apart
from other security tools
is its use of machine learning to identify threats.
Machine learning, which is a type of artificial intelligence
that enables the systems to learn from data patterns
on their own and improve on their own over time,
significantly enhances EDR's ability
to detect advanced threats.
By analyzing large volumes of past behavior,
machine learning models can identify subtle anomalies
and patterns that traditional security tools might miss.
For example, if a user's computer starts performing
out of the ordinary tasks, such as connecting
to unfamiliar networks or running unauthorized scripts,
EDR's machine learning algorithms
can flag these activities as potential threats
even if they've never been observed before.
Next, the data collected by EDR is important not only
during an act of attack, but also afterward.
Historical data provides critical insights
for incident responders and forensic investigators
by offering clues on how an attack started,
which files were affected,
and the steps the attacker took within the network.
For example, if ransomware has infected a device,
EDR can provide a detailed timeline
showing when the malware was downloaded,
which files were encrypted, and how the attack spread.
Finally, once an endpoint is isolated,
EDR tools allow security teams
to conduct a thorough analysis of the affected device.
Responders can identify the attack's entry point,
determine if other systems were impacted,
and ensure the threat is fully contained and removed.
Then once the threat has been eradicated,
the isolated device can be safely reconnected
to the network.
In the end, the proactive nature of EDR
is what sets it apart
from traditional anti-malware solutions.
EDR tools not only detect and block known threats,
but also offer real-time capabilities
to isolate compromised devices,
leverage machine learning for advanced threat detection
and swiftly contain threats.
These features enable security teams to act quickly,
minimizing damage, and preventing the spread
of malicious activity across the network.
Beyond detection and response.
EDR also plays a critical role in remediation
and capturing detailed attack information
to provide a clear roadmap for cleanup.
This makes it easier to remove malicious files,
restore affected systems, and address vulnerabilities,
also ensuring that the recovery process
is both thorough and efficient.
So remember, monitoring and response
involves continuously observing system activities
to detect, analyze, and respond to threats.
Key concepts include event logging and monitoring,
as well as endpoint detection and response, or EDR.
Event logging and monitoring track system
and application activities to identify abnormal behavior,
while EDR provides real-time visibility
and automated threat detection at the endpoint level.
Furthermore, EDR stands out by quickly isolating
and quarantining malicious activity,
enhancing an organization's ability
to prevent the spread of threats.