Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuideTo give you a flavour, workshop attendees identified their main focus areas for the future in terms of cyber securitymonitoring and logging. Analysis of their number one focus areas for 2015 indicates that they have four main types, asshown in the table below:Focus areaLog managementIncident responseCyber securityintelligence andsituational awarenessThe customerexperienceActivities• Ensuring companies are logging cyber incidents and that the logs are configuredcorrectly and of good quality• Looking beyond existing compliance regimes (not just logging, but logging the right things)• Analysis of logs• Integrating new techniques/tools.• Bringing the attacker mind-set into the realms of defending from an attack• Use of new technologies in compromise activity• Encouraging best practice in incident response• Reaction times and methods.• Utilisation of information gathered• Managing security assessments beyond SIEM• Developments of SOCs, particularly to be used as a glorified SIEM tool• Incorporating cyber threat intelligence into monitoring• True situational awareness.• Bespoke solutions for customer analytics – education/how best to deploy solutions• Assessment of value• Risk based reporting and metrics;• Interpretation simplification to clients (ie. make reports easy to understand/less technical)• Maturity of managed security services and bringing value to customers, particularlyaround reporting.ConclusionOrganisations seldom have an adequate cyber security and monitoring capability. They often suffer from a lack of budget,resources, technology or recognition of the type and magnitude of the problem.Whilst you are unlikely to achieve utopia in cyber security monitoring and logging, you can build a more effective cybersecurity and monitoring capability. To achieve this you will need to:• Identify and investigate anomalies in cyber security-related events• Recognise that detail is important• Prioritise your cyber security and monitoring and logging activities• Correlate suspicious events with cyber security intelligence• Consider building or a buying a Security Operations Centre as this appears to be one of the main ways forward tosupport cyber security monitoring and logging effectively• Seek the right kind of help from expert external suppliers for carefully selected activities• Keep an eye on future requirements.What organisations often need is the ability to access demonstrably skilled,knowledgeable and competent individuals working for organisations that havebeen independently assessed against best practice and who have the policies,processes and procedures in place to monitor all relevant events whilst protectingconfidential information.Many CREST members are well placed to meet these, and other, requirements. Byappointing one of these CREST organisations you can rest assured that you are procuringcyber security monitoring and logging services from a trusted, certified external companywho employ professional, ethical and highly technically competent individuals.59