In this section of the course, we are going
to discuss monitoring and response.
The monitoring and response section
of the course focuses on domain four, security operations,
specifically objective 4.1.
Objective 4.1 states that given a scenario, you must be able
to analyze data to enable monitoring
and response activities.
Effective monitoring and response
are critical to maintaining a secure
and resilient system.
By continuously analyzing data
and comparing it against normal behavior patterns,
organizations can quickly detect anomalies
and potential threats.
Additionally, threat intelligence
and system logs provide valuable insights
into emerging risks and alerting systems
ensures that critical issues are flagged
in real time for investigation.
Finally, organizations may prioritize
and act on alerts based on their own assessed risk factors
to keep security efforts focused and proactive.
As we go through this section,
we will cover many topics related to monitoring
and response, including aggregate data analysis,
threat intelligence sources, system log sources,
vulnerabilities and data security, behavior baselines
and analytics, security information
and event or SIEM event management,
SIEM data management, alerting,
alert prioritization factors,
as well as reporting and metric.
First, we will look at aggregate data analysis.
Aggregate data analysis is the process
of efficiently combining
and examining large volumes of data from multiple sources
to identify patterns, trends
and potential security threats.
Aggregate data analysis concepts
include audit log reduction,
correlation, prioritization and trends.
Auto log reduction involves filtering out irrelevant
or low priority logs to focus on critical events.
Audit log reduction makes it easier
to detect anomalies across a significant number
of logs and devices.
Correlation is the process
of linking related events across different data sources.
Correlation helps identify the root cause of incidents
and detect coordinated attacks.
Prioritization assigns importance
to detected issues based on their potential impact.
Prioritization enables security teams
to address the most significant threats first.
Finally, identifying trends over time
helps teams spot recurring vulnerabilities
or attack vectors that require long-term mitigation.
For example, through aggregate data analysis,
a security team might filter audit logs
to isolate critical events such as repeated failed log-ons
or unauthorized access attempts.
They could then correlate these anomalies
with other indicators such as unusual network traffic
to identify a potential breach, based on the severity
of the attack and the impact of affected systems,
the team could prioritize their response,
addressing the most critical threats first.
This process helps the security team respond quickly
and recognize attack patterns
for preventive defense improvement.
Next, we will explore threat intelligence sources.
Threat intelligence sources are external
or internal information streams
that provide insights into emerging threats,
vulnerabilities and attacker tactics.
Threat intelligence source concepts
include threat intelligence feed,
common vulnerabilities and exposures
or CVE details, bounty programs,
as well as third party reports and logs.
Threat intelligence feeds deliver real-time data
on potential security risks.
Potential security risks include indicators of compromise
and demonstrated attacker behaviors.
Next, CVEs are considered threat intelligence.
A CVE is a standardized identifier
for a publicly known cybersecurity vulnerability
in software or hardware.
CVE details provide information on known vulnerabilities,
including their severity
and exploitability, enabling security teams
to prioritize patching efforts.
Next, bug bounty programs
encourage external security researchers to identify
and report vulnerabilities to application owners.
Finally, third party reports
and logs offer additional context
and data on specific threats or incidents.
This proactive approach helps organizations discover
and resolve security flaws
before they can be exploited by malicious actors.
In application, a security team
might use threat intelligence feeds
to detect a new exploit,
targeting a specific CVE,
cross-reference third party reports
for further details and analysis
and then prioritize mitigation based on the criticality
of the vulnerability and affected asset.
After that, we will look at system log sources.
System log sources are the logs generated
by network infrastructure and enterprise devices.
System log sources provide detailed records of activities
and events and include infrastructure device logs,
endpoint logs, application logs
and Cloud Security Posture Management tools.
Infrastructure device logs capture data from routers,
firewalls and switches, helping identify network anomalies
and malicious traffic.
Endpoint logs track activities on individual devices
like computers or mobile devices.
Endpoint logs offer insights into user actions
or potential compromises, application logs
document events within software applications,
aiding in the detection of software issues
or unauthorized access.
Finally, Cloud Security Posture Management
or CSPM tools monitor Cloud environments
to identify misconfigurations or security risks.
For example, a security team might analyze firewall logs
to detect abnormal traffic,
such as unexpected inbound connections
from untrusted IP addresses.
Then they might correlate this with logs
to identify suspicious user behavior
or unauthorized access attempts.
Next, we will explore vulnerabilities and data security.
Vulnerabilities and data security
involve identifying system weaknesses
and ensuring sensitive data is protected
from unauthorized access or loss.
Vulnerability and data security concepts
include vulnerability scans and data loss prevention tools.
Vulnerability scans are automated applications
used to scan for and detect security flaws,
misconfigurations or unpatched software
on the enterprise network.
Data loss prevention is a security strategy
that monitors, detects
and prevents unauthorized transmission
or exposure of sensitive data.
Data loss prevention systems monitor data flows
to prevent the unauthorized transmission
of sensitive information, ensuring compliance
with security policies.
For example, a security team might run vulnerability scans
to detect outdated software on a server,
then use data loss prevention tools
to monitor for any suspicious attempts
to export sensitive data.
Following that, we will look
at behavior baselines and analytics.
Behavior baselines and analytics
are used to establish normal patterns
of activity for networks, systems, users and applications.
Only after understanding normal patterns
can anomalies that indicate security threats be recognized.
Behavior baselines and analytic concepts
include network systems users
as well as applications and services behavior baselines.
Network behavior baselines track typical traffic patterns
to identify unusual data flows or connection.
System Baselines monitor regular system resource usage
such as CPU or memory to detect unexpected anomalies.
User behavior analytics identify deviations
from normal user actions, such as unusual login times
or access to sensitive data.
Application and service baselines
help detect anomalies in service usage
or response times.
By monitoring baselines,
security teams can detect anomalies
like a sudden spike in resource usage,
indicating potential issues such as a denial
of service attack or malware causing excessive CPU load.
In practice, a security team might detect an abnormal spike
in network traffic
combined with an unexpected system resource load,
prompting them to investigate and identify a user account
that has suddenly started accessing restricted areas
of an application, potentially indicating a security breach.
Then we will explore security information
and event management or SIEM event management.
A SIEM system is a platform that collects, analyzes
and correlates security event data from various sources
to detect and respond to potential threats in real time.
SIEM event management is collecting, analyzing
and responding to security events in real time
to identify and mitigate threats.
SIEM event management concepts include event parsing,
event duplication, as well as the identification
of event false positives and false negatives.
Event parsing refers to the process
of breaking down raw event data into structured formats
for easier analysis.
Event duplication filters out repeated alerts
to reduce noise and enable focus on unique incidents.
Event false positives occur when benign activity
is mistakenly flagged as a threat
and false negatives occur when actual threats go undetected.
For example, a SIEM system might parse logs
to detect a potential security event,
remove duplicate entries for efficiency,
enable the security team to investigate further
and determine if the potential security event
is a false positive or an actual incident
that requires a response.
Next, we will look at security information
and event management or SIEM data management.
Again, a SIEM is a system that collects, analyzes
and correlates security event data from various sources
to detect and respond to potential threats in real time.
SIEM data management includes organizing
and maintaining security event data
for effective analysis detection and long-term storage.
SIEM data management concepts include data
from non-reporting devices and data retention.
Non-reporting devices refer to systems
or endpoints that fail to send logs or data to the SIEM.
Non-reporting devices create blind spots
in security monitoring.
Data retention policies
determine how long security event data is stored,
ensuring compliance with regulations
and assisting in forensic analysis.
For example, if a critical firewall stops sending logs
to the SIEM due to a misconfiguration,
this could go unnoticed,
leaving a gap in security monitoring.
However, with proper data retention policies in place,
logs retained from before
and including the misconfiguration could be reviewed
to help identify and address the cause of the issue.
After that, we will explore alerting.
Alerting is the process
of notifying security teams about potential threats
or suspicious activities based on predefined rules
and event triggers.
Alerting concepts include alerts associated
with vulnerabilities, false positives,
false negatives, malware and alert failures.
Vulnerabilities in this system can only generate alerts
if they are detected.
Actual vulnerabilities
that are detected are considered true positives.
False positives are alerts
for non-malicious activities wrongly flagged as threats.
False negatives occur when legitimate threats go undetected.
Malware alerts notify the team of potential infection
and alert failures such as missed
or delayed notifications
can lead to critical threats being overlooked.
For example, a SIEM might generate an alert
for detected malware on a critical server,
prompting the security team to investigate.
However, if the alert is identified as a false positive
or an alert failure occurs,
the security team could waste valuable time
chasing a non-existent threat
or miss the actual threat altogether.
Therefore, ensuring the accuracy
and reliability of alerts is crucial
to prevent missed threats
and mitigate security risks effectively.
Then we will look at alert prioritization factors.
Alert prioritization factors enable determining the urgency
of security alerts based on criteria
to ensure the most critical threats are addressed first.
Alert prioritization concepts include alert criticality,
alert impact, asset type, residual risk
and data classification.
Criticality refers to how essential the affected system
or process is to the organization.
Impact assesses the potential damage
that a threat could cause if not mitigated.
Asset type considers whether the compromised asset
is of high value, such as a production server
or a critical database.
Residual risk is the remaining risk
after mitigating controls have been applied.
Data classification refers to the sensitivity
of the data involved with higher priority alerts
being raised for systems handling confidential
or highly classified information.
For example, an alert affecting a critical financial server
storing classified data would be prioritized over an alert
on a low impact system due to the combination
of high criticality, impact and data sensitivity.
Finally, we will look at reporting and metrics.
Reporting and metrics are the collecting
and presenting of security data
to measure performance, identify trends
and guide decision making.
Reporting and metrics concepts
include visualization and dashboards.
Visualization products include the use of charts, graphs
and other visualization tools
to display complex security information
in an easily understandable format.
Dashboards aggregate key metrics
in a real time centralized view,
allowing security teams to track incidents
and responses efficiently.
Both visualization products
and dashboards help teams quickly assess the status
of security operations, identify potential threats
and evaluate the effectiveness of defenses.
For example, a security team might use a dashboard
to monitor the number
of detected malware instances over time,
using visualizations
to spot a unique spike in observed incidents
and prompting further investigation and action.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into monitoring
a response in this section of the course.