Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideAnalysing logs and alertsSecurity-related event logs should be analysed regularly by skilled analysts (eg. using automated security information andevent management (SIEM) tools or equivalent) to help identify anomalies, and include:• Processing of key security-related events (eg. using techniques such as normalisation, aggregation and correlation)• Interpreting key security-related events (eg. identification of unusual activity)• Situational awareness (putting the events in context), backed up by various types of internal, commercial andgovernment sources of cyber security intelligence• Responding to key security-related events (eg. passing the relevant event log details to a cyber security incidentmanagement team).Security information and event management (SIEM) tools should be configured (often referred to as tuning) to:• Identify expected events (to help reduce review and investigation activities for legitimate business events)• Detect unexpected events (to help reduce the likelihood false negatives)• Manage confusing or misleading data, often referred to as ‘noise’ (as opposed to ‘signal’) generated by event logs.“We have been working with a SIEM for some time and the biggest challenge is to findappropriate use cases which makes sense and are possible to be implemented”!Organisations may believe they are monitoring events to detect potential indicatorsof compromise, but even though they have an IDS (or even a SIEM), they fail to:• Monitor all relevant events• Carry out monitoring regularly enough - or in an appropriate manner• Aggregate what may seem like benign alerts into what can be a coherent threatmessageUsing log management toolsTo help face these log management challenges, many organisations use a variety of log management tools and techniques,such as IDS, SIEM and tools that employ potential malware isolation and investigation techniques (eg. sandboxing or virtualexecution engines).Responses to the Project Survey revealed extensive use of tools and services, be theybasic log management tools, SIEMs, managed security services (MSS) or SecurityOperations centres (SOCs). However, only just over half the respondents stated thatthey use a SIEM (although their SOC probably would, where they use one), which maycause them difficult log management issues.23