Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging Guide!Turning on significant event monitoring for a system can:• Produce unpredictable results and could seriously detract from the resourcesavailable to the rest of our systems or networks• Place a large overhead on bandwidth, host processing capacity and memoryCentralised log managementYou should combine key information from as many of the different logs as possible (where relevant) into one centralrepository, such as a Security Information and Event Management (SIEM) system.For example, evidence of an incident may be captured in several logs that each contains different types of data:• A firewall log may have the source IP address that was used, whereas an application log may contain a username• A network IDS sensor may detect that a cyber security attack was launched against a particular host, but it may notknow if the attack was successful.An investigator may need to examine the host’s logs to determine that information. Correlating events among multipleindicator sources can be invaluable in validating whether a particular incident occurred.SIEM solutions are a combination of SIM (security information management) and SEM(security event manager) systems. SIEM technology provides real-time analysis ofsecurity alerts generated by network hardware and applications.SIEM solutions come as software, appliances or managed services, and are also used tolog security data and generate reports for compliance purposes.Some modern SIEMs provide additional features, such as the ability to handle ‘BigData’ or the provision of a dashboard for analysis and monitoring.SIEM servicesA number of services that suppliers can provide for the cyber security monitoring and logging arena are in the SIEM arena,which includes:• Managed Security Services Providers (MSSP) solutions for SIEM and threat intelligence• ‘Dropship’ SIEM solutions (basically a server supplied by the supplier with the customer managing the service with noreal external support )• Hybrid SIEM MSSP services - with threat intelligence fed into the SIEM, supported by SOC analysis.Workshop participants agreed that ‘information is only any good if it is actionable’. It therefore needs context, analysis andinterpretation. It should also include Big Data, taking a much richer set of data sources into account (over and above justevent logs) in the detection, triage and investigation processes at the heart of cyber security monitoring.Examples of producing actionable intelligence include generating metadata from every single web, email and other keynetwork transaction; and taking contextual data sources such as device catalogues and user account data. The value ofthis in a cyber security monitoring context is the increased ability to detect particular attacks that have been crafted to avoidbeing detected by traditional security devices and hence logs from such devices are of limited use on their own.Finally, information being analysed should be backed up with proper security intelligence and be supported by automation.19