Cyber-Security-Monitoring-Guide

More documents

Recommendations

Info

Cyber Security Monitoring and Logging GuideAt the heart of any capability are four key phases, which are required to carry out an effective cyber security monitoringprocess on a continuous basis, as shown in Figure 14 below. This process should be supported by various types of cybersecurity intelligence to bring context to the events.Collect relevantevent dataTake appropriate actionFuse events togetherAnalyse anomalouseventsFigure 14: Cyber security monitoring – key components!Without situational awareness, it can be very difficult to identify potential indicatorsof compromise, particularly during the early (eg. reconnaissance) phase of asophisticated cyber security attack.5. Build or buy cyber security monitoring and logging servicesHaving designed your cyber security monitoring and logging capability, you will now need to determine how to run it in aneffective manner, but at a reasonable cost. A good cyber security monitoring and logging capability will be supported by arange of different tools and services, most of which you can either build yourself and/or buy from third parties.More and more organisations are now choosing to use a Security Operations Centre(SOC), with many of them outsourcing their SOCs to specialised third parties.Project research identified many different ways in which cyber security monitoring and logging services can be provided(evaluating their advantages and disadvantages), which include:• In-house/in-sourced service• Cloud & appliance based/Software as a Service provider• Shared/MSSP – either sourced from a Network Service Provider/IT Service Outsourcer or a Managed Security ServicesProvider (MSSP)• Captive outsourced (hybrid model)• A combination of the above.56
Cyber Security Monitoring and Logging GuideMost respondents to the Project Survey placed a high value on the many differingbenefits of outsourcing cyber security monitoring and logging services, which included:• 24 x 7 x 365 coverage• Cost advantages over developing your own solution (eg. because of leveraging,personnel, tools and approaches)• Access to cyber security monitoring and logging specialists• Cyber security (protective) monitoring• Access to ‘surge support’ (swift deployment of experienced coordination)If you choose to outsource some or all of your cyber security monitoring and logging services, a systematic, structuredprocess has been developed to help you select suitable suppliers (described in Part 6 of this Guide), as shown inFigure 15 below.AUnderstand thebenefits of usingexternal suppliersDAppoint appropriatesupplier(s)BDetermine whichactivities should beoutsourcedCDefine supplierselection criteriaFigure 15: The supplier selection processYou should procure cyber security monitoring and logging services from a trusted,certified external company who employ professional, ethical and highly technicallycompetent individuals. CREST member companies are independently assessed,providing a certified, trusted relationship, backed by an effective industry body.57
Page 1:
Cyber SecurityMonitoring and Loggin
Page 4 and 5:
Cyber Security Monitoring and Loggi
Page 6 and 7: Cyber Security Monitoring and Loggi
Page 60: The quadrants in this diagram outli
show all

Cyber-Security-Monitoring-Guide

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?