Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideThe need for collaborationProject research revealed a need for greater collaboration in cyber security monitoring, the main aims of which are to helpyour organisation, your sector and the government to:• Proactively respond to cyber security attacks (eg. by closing channels or ‘attacking the attacker’)• Close down criminal operations• Prosecute those responsible for the attack• Reduce the frequency and impact of future security incidents.Some of the main challenges organisations face in collaborating about cyber security monitoring and logging are in:• Dealing with cloud computing and other outsourced suppliers• Using cyber security intelligence sharing platforms and collaboration forums effectively• Adopting a common language for communicating.The UK is one of many governments around the world that recognise the serious nature of the threat that is emergingfrom cyber-space. Nations of the world are giving high priority to implementing cyber security strategies that will bothimprove their resilience to cyber security incidents and (where possible) reduce the impact of cyber security attacks.Fusion cell and the CISPThe UK has set up a cyber security “fusion cell” for cross-sector threat information sharing. The intention is toput government, industry and cyber security analysts side-by-side for the first time. Public and private sectoranalysts will be joined by members of intelligence agencies, law enforcement and government IT as they exchangeinformation and techniques and monitor cyber security attacks in real time.The fusion cell is a cyber security attack monitoring operations room at an undisclosed location in London as partof a government cyber security initiative. The Cyber Security Information Sharing Partnership (CISP) also includes asecure web portal and programmes aimed at building cross-sector trust to underpin information sharing. The webportal is based on a social networking structure, giving members of the CISP freedom to choose who they wish toshare information with in real time.Note: This sort of information sharing is typically only available to very large organisations – and should only beconsidered as part of your armoury for responding to cyber security incidents.Furthermore, a number of international organisations (eg. ENISA, NIST, ISF and ISACA) work constantly to promote or usecollective defences to analyse the latest developments in cyber threats and cybercrime.One of the roles of the UK National Crime Agency (NCA) - previously called the Serious Organised Crime Agency (SOCA)- is to promote the collaboration between many key bodies to improve the provision of cyber security intelligence andsituational awareness generally. This would include helping to build data about the Modus Operandi (MO) of criminals andabout attack vulnerabilities.The NCA also support the three pillars of GovCertUK, which are to:• Be part of the international cert to cert network• Provide incident management and response support• Improve situational awareness (through the CISP), such as the sharing of IP addresses that are about to attack anetwork and alerting organisations to large scale malware harvesting.Both GovCertUK and the NCA help to provide attribution of malicious events.36