Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideLogs and other sources that can be potential indicators of compromise (also known as triggers, alerts or alarms) willbe either (or both):• Precursors, which are signs that an incident may occur in the future• Indicators, which are signs that an incident may have occurred or be occurring now.Examples of possible cyber security incidentsPrecursors can include:• Web server log entries that show the usage of a vulnerabilityscanner• An announcement of a new exploit that targets a vulnerability ofthe organisation’s mail server• A threat from a group stating that the group will attack theorganisation.Indicators (there are many) can include:• A network intrusion detection sensor alerts when a buffer overflowattempt occurs against a database server• Antivirus software alerts when it detects that a host is infected withmalware• A system administrator sees a filename with unusual characters• A host records an auditing configuration change in its log• An application logs multiple failed login attempts from an unfamiliarremote system• An email administrator sees a large number of bounced emails withsuspicious content• A network administrator notices an unusual deviation from typicalnetwork traffic flows.The sources of these signs include…..• Security software (eg. IDS, IPS, DLP,SIEM, antivirus and spam software,file integrity checking software,monitoring services (often provided bya third party))• Logs (eg. operating system logs,service and application logs, networkdevice logs and network flows)• Publicly available information(eg. information on new exploits,information exchange groups, thirdparty organisations, governments)• People from within your organisation• Third parties (eg. customers,suppliers, IT providers, ISPs, partners;government bodies).Sources of IOCsThere are many different sources of data that relate to IOCs, which include:• Security software (eg. IDS, IPS, DLP, SIEM, antivirus and spam software, file integrity checking software, andmonitoring services (often provided by a third party))• Tools that employ potential malware isolation and investigation techniques (eg. sandboxing or virtualexecution engines)• Logs (eg. operating system logs, service and application logs, network device logs and network flows)• Publicly available information (eg. information on new exploits, information exchange groups, third partyorganisations, governments)• People from within your organisation• Third parties (eg. customers, suppliers, IT providers, ISPs, partners; government bodies).Workshop participants identified a range of publicly available sources of data that can be used in conjunction withcyber security events to help identify indicators of compromise (IOC), evaluating the purpose, likely criticality and costof each source.The results of this analysis are presented in the table on page 31 (in descending order of criticality), together withtheir purpose, criticality and relative cost.30