Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging Guide!Manyrespondents seemed to believe that their organisation was more mature in cybersecurity monitoring and logging than their responses to the rest of the Project Surveywould indicate, showing that there is still a strong need for awareness in this area.Standards and guidelinesThere are many standards that specify (or allude to) requirements for cyber security logging (but very few about cybersecurity monitoring), which include:• 10 Steps to Cyber Security and the Cyber Security Essentials from CESG• ISO 27002 - Section 12.1 Logging and Monitoring• PCI DSS V3.1, particularly:o Part 10. Track and monitor all access to network resources and cardholder datao Part 11. Regularly test security systems and processes• The SANS 20 Critical Controls for Effective Cyber Security Defence particularly:o Control 14 – Event logging• The NIST 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems andOrganizations as part of a directive from the Federal Information Security Management Act (FISMA).“Being fully compliant with standards is still likely to leave you exposed to cyber security incidents”There are also a number of good sets of guidance in this area, which include:• Effective Log Management from the Centre for the Protection of National Infrastructure (CPNI) in conjunctionwith Context (April 2014)• CESG’s Good Practice Guide 13 (GPG13): Protective Monitoring for HMG ICT Systems• Magic quadrant analysis of related tools, such as the Gartner Magic Quadrant for Security Information andEvent Management 2014• SANS Analytics and Intelligence Survey (October 2014)• IDC Market Analysis – Worldwide Specialized Threat Analysis and protection 2013 – 2017 forecast• Logging and Monitoring to Detect Network Intrusions and Compliance Violations in the Environment fromthe SANS Institute InfoSec Reading Room (July 2012)• Guide to Computer Security Log Management (SP 800-92) from NIST (Sept 2006)• Many different vendor publications (often product-led).However, although these compliance and guidance documents are often very useful, they do not typically provide:1. Coverage of all aspects of cyber security monitoring and logging in one framework - more focus is needed on theactual monitoring process, plus specialised areas like security intelligence, SOCs and analysis of advanced persistentthreats (APT)2. Best practice for logging and monitoring cyber security (eg. focused on identifying, interpreting and responding toindicators of compromise - IOC), particularly for consumer organisations outside government or Finance sectors3. Guidance on how best to use scarce security budgets and resources – what’s the best ‘Bang per buck’?4. Advice on who organisations can ask for help – backed up by selection criteria.14