An important part of security operations is to monitor for
how well our security program is working.
Is it achieving its goals?
We know that this can be done through things like continuous monitoring,
and we have a number of very good tools that will do this for us.
They will be watching our systems all the time and don't
require a person to be standing there observing.
A good example of this would be a security
information and event management system,
a SIEM, that can actually gather data from firewalls,
IDSs, IPSs, application servers, and bring all of this log data
together, do some aggregation and correlation.
So we're able to see if there's anything that isn't quite right or bring in
an alert of something that's happening that is strange.
Traditional monitoring was done using logs. A person could look through the log
and see if there's anything wrong or suspicious in there.
Now the problem with the log analysis is that it is difficult.
It takes a lot of time.
It takes the proper tools to be able to filter through very often tens
of thousands of entries in a log to find something which was in any
way significant. It requires the training to be able to detect and
notice if there's something wrong.
And of course, the sheer volume of logs can be overwhelming to the
point that really is unrealistic to expect someone to be able to
go through them and find something.
Use of tools is,
shall we say here, almost required. One of the things we
should always do is know what's going on.
It's important to know what's happening outside in the real world
because these are things that could affect us. And this is where we
can have commercial feeds that come in, antivirus,
antispam, as well as a number of very good threat intelligence feeds that
come and say these are the types of attacks we're seeing. This is how these
attacks have been launched and been successful.
And from that, we can learn and see are there vulnerabilities we have
that then could be exploited as well? There's also a number of open
source intelligence feeds available, ones that will actually show to
us things we should watch for.
And the problem with these, of course, is that, again,
we can have so much intelligence that we don't know what to do with it.
So, we do sometimes see managed security service providers will
actually do a lot of this work for us. They will tell us if there's
things that we should especially be watching for.
But the challenge, of course, is that the attackers can be very advanced,
advanced persistent threats, the very determined,
very skilled, good resources and support behind them.
And they go after organizations for things like ransomware,
distributed denial of service, theft of intellectual property.
And it's really important that we know whether or not we are
an industry sector that's being attacked,
whether we're using a certain type of technology
that's being attacked right now.
Those are important things for us to know.
And it's also good sometimes just look at blogs. What are people talking
about because very often things go kind of in waves and fads, and all of
the attacks are against one certain type of,
should we say,
language or software and so on, and it's good to know what's going on around us.
The key points review.
The reason we need to monitor is that controls can fail.
In fact, they can just fail to be effective.
It used to work, but not anymore.
And it could be that that control we had was great for the attacks of yesterday,
but it's not suitable for new threats.
So therefore, monitoring is essential.
We need to do this to ensure that we are always aware of the
risk, and we manage that risk adequately.
Now the problem is we use these, I like to call them waffle words,
words that almost mean nothing a lot.
We use terms like adequate security. And what is adequate?
Adequate means that if we've had a breach,
obviously, our security was not adequate.
If we haven't had a breach,
then we're going to be accused of having spent too much money.
So, adequate is very much open to interpretation, and we need to know
what is management's sense for what is adequate? Now it could be we
need to educate management. Do we have enough security or not? And it
could be that management doesn't realize how serious certain things
are and that the security they thought was adequate really isn't in
today's world.
But then again,
we have to be able to present a business case for security
so that hopefully management is convinced maybe to take
certain steps and changes as well.
Our job in security will never end because the people that are trying
to break in are desperate, and it's their job, in some cases. And so
therefore, we have to be just as desperate to keep them out as they
are desperate to try to get in.