In this lesson, we're going to cover accounting.
Now, accounting in cybersecurity is a security measure
that ensures all user activities during a communication
or transaction are properly tracked and recorded.
Essentially, accounting focuses on monitoring
and logging the actions of users
or entities during their digital interactions.
Let's imagine you just received
two different bank statements from your online bank.
The first one states
that you spent a thousand dollars last month
but they didn't provide any details
on the specific transaction, dates, times, locations
or amounts.
Your second statement though
came with a complete transaction log
showcasing every deposit, withdrawal and purchase
that you've made over the last 30 days
with their associated dates, times, locations, and amounts.
Now, which of these two bank statements
would give you more confidence and clarity
about your financial activity over the last month?
Well, if you're like most people,
you probably prefer the second bank statement
with all the supporting details
because now you know exactly what happened and where.
This gives you more trust in the validity
of this bank statement too
because it provides more transparency, security
and accountability.
This is exactly what we're aiming to achieve
by utilizing accounting inside of our organizations.
You see, accounting isn't just about keeping tabs
on your money,
it's about monitoring and logging every action
that a user makes within a given system.
These actions can include things
like logging into the system, accessing files,
modifying configuration settings,
downloading or installing software
or even attempting unauthorized actions
across the organization's systems and networks.
Your organization should use a robust accounting system
so that you can create an audit trail,
maintain regulatory compliance, conduct forensic analysis,
perform resource optimization
and achieve user accountability.
First, we have an audit trail.
Now an accounting system is used to create an audit trail
that provides a chronological record
of all of your user activities that can be used
to trace any changes, unauthorized access or anomalies
back to a specific user or point in time.
Second, we have regulatory compliance.
Now, many industries and countries have strict regulations
regarding data protection and privacy.
By using an effective accounting system,
we can ensure that our organizations
are adhering to these regulations
by maintaining a comprehensive record
of all of their users' activities.
Third, we have forensic analysis.
In the unfortunate event of a security breach,
a detailed accounting and event log
can help our cybersecurity experts
understand exactly what happened,
how it happened, and how to prevent similar incidents
from occurring again in the future.
Fourth, we have resource optimization.
By tracking which resources like bandwidth or cloud storage
are being utilized and by whom,
organizations can make more informed decisions
on resource allocation to ensure that system performance
is being optimized and your costs are being minimized.
Fifth and finally, we have user accountability.
With a thorough accounting system in place, users will know
that their actions are being monitored and logged,
which in turn
can also deter potential misuse and ensure adherence
with your organization's cybersecurity policies.
Now, to perform accounting,
we're usually going to use different technologies
like Syslog servers, Network analysis tools
and Security Information and Event Management systems
known as a SIEM.
Syslog servers are going to be used to aggregate logs
from across various network devices and systems
so that system administrators can analyze them
to detect patterns or anomalies in the organization systems.
Network analyzers like Wireshark can be used to capture
and analyze network traffic so that network administrators
can gain detailed insights into all the data moving
across their network.
And a security information and event management system
known as SIEM will provide us with a real-time analysis
of our security alerts that are generated
by various hardware and software infrastructure pieces
inside of our organization.
So remember, accounting is used to ensure
that every action within a system is tracked and recorded.
This meticulous record keeping provides transparency,
enables regulatory compliance, aids in forensic analysis,
ensures resource optimization
and holds users accountable for their actions.
Just as you'd want a detailed statement
of your bank transactions to ensure financial transparency
in the digital world, accounting stands as a testament
to a system's integrity and security.
It's a pivotal component of security
and it's used to ensure that every transaction
and every interaction is transparent, traceable
and trustworthy.