Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging Guide1. Develop a cyber security monitoring and logging plan2. Carry out prerequisites for cyber security monitoring and logging3. Identify sources of potential indicators of compromise4. Design your cyber security monitoring and logging capability5. Build or buy suitable cyber security monitoring and logging services6. Integrate the capability with your cyber security framework7. Maintain the cyber security monitoring and logging capabilityFigure 2: Implementing a cyber security incident management capability in practiceEach step of the process for implementing a cyber security monitoring and loggingcapability is described in more detail in Part 7 Cyber security monitoring andlogging in practice.RationaleThis Guide is based on the findings of a research project - conducted by Jerakano Limited on behalf of CREST –which looked at the requirements organisations have to help them monitor and log events that could lead to cybersecurity incidents.!Exponential growth in the number of users and devices connected to the Internethas led to an unprecedented expansion in the attack surface that can be exploitedby ever more sophisticated cyber security attackers, such as state-sponsored attacks,organised cybercrime and extremist groups.Monitoring such an extensive battlefield can be an uphill battle in itself – and it isoften easier to attack than defend.The objectives of the cyber security monitoring and logging project were to help organisations:• Become more difficult for cyber security adversaries to attack• Reduce the frequency and impact of cyber security incidents• Meet compliance requirements• Identify and respond to cyber security incidents at an early stage, doing so quickly and effectively• Procure the right cyber security monitoring and logging services from the right suppliers.There were high requirements from organisations who responded to the project survey for a cyber securitymonitoring and logging Guide to help them in a variety of areas, with the top five responses being to:• Bring all aspects of cyber security monitoring and logging together in one framework• Gain senior management support for a cyber security monitoring and logging capability• Understand what a good Security Operations Centre (SOC) looks like.8