Security Monitoring, Logging and Detection

Assume something gets through

Preventive controls reduce risk but never remove it. Detection limits the damage: the sooner an attack is spotted, the less an attacker can do.

Example. An attacker used stolen credentials for four months before anyone noticed. The logs had recorded every step. Nobody was looking at them.

From logs to alerts

A security information and event management (SIEM) system collects logs from many sources, puts them in a common format and correlates them to spot patterns no single log shows. A security operations centre (SOC), in-house or outsourced, triages the alerts, investigates and escalates real incidents to incident response.

Protecting the evidence

Logs are only useful if they can be trusted:

• central and separate: sent off the source system as they’re created
• tamper-proof: administrators can’t delete or edit records of their own activity
• kept long enough: retention set by investigation needs and regulation
• time-synchronised: all systems on one time source, so events line up

Is monitoring effective?

The diagram shows three questions for judging whether monitoring works. Coverage: can we see it? Critical systems, cloud, endpoints and identity should send logs, with any gaps known and accepted. Detection: will we notice? Detection use cases should map to the top risk scenarios, rules should be tuned to cut false alarms, and detection should be tested, for example with simulated attacks. Response: will we act in time? Alerts need triage around the clock, clear escalation to incident response, and tracking of mean time to detect and respond.

The risk practitioner’s question is whether detection matches the top risk scenarios. If the biggest risk is ransomware through stolen remote access, there should be detection for unusual logins, privilege changes and mass file encryption, and someone ready to act on it at any hour.

Metrics for detection

How the exam asks about it

In short

• Preventive controls eventually fail, so the organisation needs to detect attacks and respond quickly.
• Logs must be collected centrally, protected from tampering, kept long enough and actually reviewed.
• A SIEM collects and correlates logs; a security operations centre (SOC) triages and investigates alerts.
• Effective monitoring needs coverage, detection use cases linked to risk scenarios, and timely response.
• Mean time to detect (MTTD) and respond (MTTR) are key indicators of detection capability.

Exam traps

• Collecting logs that nobody reviews.
• Letting administrators delete or edit logs of their own activity.
• Measuring the number of alerts instead of how quickly real incidents are found.
• Detection rules that don't reflect the organisation's top risk scenarios.

Slides

Click the slide and use the arrow keys. F toggles full screen.