Alerting: Process of notifying relevant personnel as a potential security incident occurs. Alert fatigue can be avoided by maximizing true positives and minimizing false positives.

Monitoring: Continuous observation of a system/network.

Monitoring Resources

• System Monitoring: Observation of computer system, including the utilization and consumption of its resources.
• Baseline: Established performance metrics and data points for standard behavior of a system, network, or application.
• Application Monitoring: Emphasizes management and monitoring of software application performance and availability.
• Infrastructure Monitoring: Observation of the performance and availability of an organization’s physical and virtual infrastructure.

Alerting and Monitoring Activities

• Log Aggregation: Process of collecting and consolidating log data from various sources into a centralized location. Used for Troubleshooting, Performance monitoring, Security analysis, Compliance.
• Alerting: Setting up notifications to relevant stakeholders when specific events or conditions occur.
• Scanning: Involves examining systems, networks, or applications to identify vulnerabilities, configuration issues, or other potential problems.
• Reporting: Generating summaries and detailed reports based on collected and analyzed data.
• Archiving: Storing data for long-term retention and future reference, including organization’s log, performance, and incident data.
• Alert Response and Remediation or Validation: Involves taking appropriate actions in response to alerts and ensuring that identified issues have been effectively addressed.
  • Remediation: Steps used to resolve identified issues/vulnerabilities (patching, reconfiguring, modifying source code).
  • Quarantining: Isolating system, network, or application to prevent spread of threat and limit potential impact.
  • Alert Tuning: Adjusting alert parameters to reduce errors, false positives, and improve relevance.
  • Validation: Verifying remediation was successful.

Simple Network Management Protocol (SNMP)

Internet protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior.

An SNMP agent sends three types of messages to agents:

1. Set: Set variable(s).
2. Get: Retrieve variable(s).
3. Trap: Asynchronous notifications from agent to manager for near real-time notifications.¹1. Roles: The Manager is the central server monitoring everything. The Agent is the software on the device being monitored. The Management Information Base (MIB) is the database of variables the Agent can report. Both Granular and Verbose traps use Variable Bindings (key-value pairs) to send data.

There are three versions of SNMP:

• Version 1 and 2 use a shared secret (community string) stored in plaintext as their security mechanism.
• Version 3 provides three security enhancements to add Confidentiality, Integrity, and Availability to the protocol:
  1. Integrity: Hashing Messages.
  2. Authentication: Validating source of messages using HMAC (Hash-based Message Authentication Code).
  3. Confidentiality: DES with 56-bit encryption key (Newer devices that rely on SNMP v3 has replaced DES with 3DES and AES, but this break backward compatibility).

Security Information and Event Management (SIEM)

SIEM: Solution that provides real-time or near-realtime analysis of security alerts that are generated by network hardware and applications.

• Agent: Software agent installed on each system from which SIEM needs to collect log data. Allows for more detailed and more real-time information.
• Agentless: SIEM directly collects log data form each system using standard protocols like SNMP or WMI. Less maintenance.

Popular SIEMs: Splunk, Elastic Stack (ELK), ArcSight, QRadar.

Data from Security Tools

All of the tools below can have their logs aggregated by a SIEM.

• Antivirus Software
• Data Loss Prevention
• Network Intrusion Detection and Network Intrusion Prevention
• Firewalls
• Vulnerability Scanners

Security Content Automation and Protocol (SCAP)

Open standards that automate vulnerability management, measurement, and policy compliance. Developed by NIST.

Three main languages:

• Open Vulnerability and Assessment Language (OVAL): XML schema for describing system security states and querying vulnerability reports and information.
• Extensible Configuration Checklist Description Format (XCCDF): XML schema for developing and auditing best-practice configuration checklists and rules.
• Asset Reporting Format (ARF): XML schema for expressing information about assets and their relationship between assets and reports.

Common Vulnerability Scoring System (CVSS): Used to provide a numerical score to reflect severity of a given vulnerability.

NetFlow and Flow Analysis

• Full Packet Capture (FPC): Capture entire packet.
• Flow Analysis: Records metadata and statistics rather than recording each frame passing through the network.
• NetFlow: Cisco-developed means of reporting network flow into a structure database.
• IP Flow Information Export (IPFIX): An open standard based on Cisco’s NetFlow v9 used to export network flow data for analysis and monitoring.
• Zeek: Passively monitors network like a sniffer, but only logs full packet capture data of potential interest.

Single Pane of Glass

Central point of access for all information, tools, and systems security team needs to monitor, manage, and secure an organization’s IT environment.