With all the countermeasures in place attacks still happen and that gets noticed only after an incident
has happened.
It is said that on average an attack takes 100 days to be discovered.
If undetected the attacker could have compromised the system long back and gained persistence to ensure
the malicious intent of the attacker gets noticed.
It is essential to log and monitor all the activities.
It is essential to log old activity and monitor it for any suspicious behavior.
Some of the examples of insufficient logging can be unnoticed seeing many failed logging attempts from
a particular source.
Too many requests from a particular source at an extremely fast low fixed rate junk traffic spikes in
pattern of traffics and extensive DNS squeeze because DNS is the only legitimate board along with HDP
and HDP as that connects corporations to outside work and an attack is a phone.
Lots of ways to to bypass firewall controls by injecting queries or malicious queries within the legitimate
DNS query so it's always important to monitor the spikes within their DNS traffic.
How to protect ourself.
Easy.
Always monitor the usage.
The logging of your applications network monitoring effective security incident in response produces
procedure should be in place and should be tested.