Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging Guide!Capability and intent is what makes both detecting and responding to attacksfrom well-resourced organised crime/state-sponsored attackers different and moredifficult than ‘traditional’ incidents.The main focus of this Guide is to help you monitor indicators of possible cyber security attacks, but it will also beuseful for monitoring traditional information (or IT) security incidents.Details about how to prepare for, respond to and follow up cyber security incidentscan be found in the CREST Cyber Security Incident Response Guide, available fromCREST at http:// www.crest-approved.orgTypical phases in a cyber security attackCyber criminals innovate just as business does and the potential rewards for them grow as business use of cyberspacegrows. They have access to powerful, evolving capabilities which they use to identify, attack and exploit carefullychosen targets. They also have well-developed marketplaces for buying and selling tools and expertise to executesophisticated attacks.!Well-resourced attackers, sufficiently motivated by their target, will often innovateand evolve their methods during a single attack, trying different techniques untilsomething works. Evolution and innovation in ‘traditional’ attacks happens moreslowly, with new techniques evolving over time between waves of attack.For example, in traditional attacks, new variants of malware are released withinweeks/months (after many systems have been patched/AV protected). In contrast, insome state-sponsored attacks, the attackers re-compile their malware several times aday to overcome responsive actions taken.When looking at a cyber security attack in more detail there are often a number of phases that attackers willundertake, which can sometimes take place over a long period of time. An example of the basic componentsof such a phased approach is outlined in Figure 4 on the following page, together with some of the commoncountermeasures for each phase.11