Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideSummary of key findingsThis Guide has brought together all aspects of cyber security monitoring and logging in one place, highlighting what istypically best practice for each main component. It explains how your organisation can:• Capture and correlate the most relevant cyber security-related events in the right logs – overcoming the wide rangeof log management challenges• Introduce a suitable cyber security monitoring process, helping to identify and analyse indicators of compromise(which may be caused by potential or actual cyber security incidents); and respond to anomalous cyber securityevents quickly and effectively• Build an appropriate cyber security monitoring and logging capability, considering the benefits of using a SecurityOperations Centre (SOC)• Find the right cyber security monitoring and logging tools, processes and people to help you easily, effectively and atthe right price.Implementing a cyber security monitoring and logging capabilityThis Guide will have given you a good understanding of the most important elements of cyber security monitoring andlogging, highlighting the main challenges and describing ways in which they can be overcome.However, building, reviewing or improving your own cyber security monitoring and logging capability in practice is noteasy. Consequently, a seven stage process has been deigned to help you do this more effectively. The overall process isoutlined in Figure 13 below and then each step is described in more detail in the remainder of this chapter.1. Develop a cyber security monitoring and logging plan2. Carry out prerequisites for cyber security monitoring and logging3. Identify sources of potential indicators of compromise4. Design your cyber security monitoring and logging capability5. Build or buy suitable cyber security monitoring and logging services6. Integrate the capability with your cyber security framework7. Maintain the cyber security monitoring and logging capabilityFigure 13: Implementing a cyber security incident management capability in practice1. Develop a cyber security monitoring and logging planBefore wading straight in and trying to build your cyber security monitoring and logging capability, you should first developa plan. This will help you to design the capability more effectively, gain senior management support and produce asolution that is more likely to be implemented as you would like.Part 7 Cyber security monitoring and logging capability in practice“A careful, realistic and well thought through plan can be worth its weight in gold”53