1 00:00:00,020 --> 00:00:01,350 In this section of the course, 2 00:00:01,350 --> 00:00:03,960 we're going to be talking about Alerting and Monitoring. 3 00:00:03,960 --> 00:00:04,980 Now, alerting and monitoring 4 00:00:04,980 --> 00:00:06,750 are crucial components in security, 5 00:00:06,750 --> 00:00:08,850 especially when it comes to maintaining the integrity, 6 00:00:08,850 --> 00:00:10,620 confidentiality, and availability 7 00:00:10,620 --> 00:00:12,420 of our information systems. 8 00:00:12,420 --> 00:00:13,830 Alerting refers to the process 9 00:00:13,830 --> 00:00:15,510 of notifying relevant personnel 10 00:00:15,510 --> 00:00:17,730 when a potential security incident occurs. 11 00:00:17,730 --> 00:00:19,950 And alerts can be generated by various security tools, 12 00:00:19,950 --> 00:00:21,840 including our intrusion detection systems, 13 00:00:21,840 --> 00:00:23,310 intrusion prevention systems, 14 00:00:23,310 --> 00:00:25,590 security information event management systems, 15 00:00:25,590 --> 00:00:27,210 and antivirus software. 16 00:00:27,210 --> 00:00:29,760 Alerts can be categorized into four main types, 17 00:00:29,760 --> 00:00:32,369 true positive false positive, true negative, 18 00:00:32,369 --> 00:00:33,690 and false negative. 19 00:00:33,690 --> 00:00:35,550 A true positive refers to an alert 20 00:00:35,550 --> 00:00:38,310 that correctly identifies a legitimate issue or threat. 21 00:00:38,310 --> 00:00:41,160 False positives are an alert that indicates incorrectly 22 00:00:41,160 --> 00:00:42,120 the presence of a threat 23 00:00:42,120 --> 00:00:44,550 or issue when there really isn't one there. 24 00:00:44,550 --> 00:00:46,170 A true negative is good to note 25 00:00:46,170 --> 00:00:47,760 that there is an absence of an alert 26 00:00:47,760 --> 00:00:49,980 when there is indeed no issue or threat. 27 00:00:49,980 --> 00:00:51,900 This means the system correctly recognized 28 00:00:51,900 --> 00:00:54,090 that you are safe in this situation. 29 00:00:54,090 --> 00:00:55,830 Now, a false negative, on the other hand, 30 00:00:55,830 --> 00:00:57,750 is when the system fails to create an alert 31 00:00:57,750 --> 00:00:59,880 when there is a real issue or threat there, 32 00:00:59,880 --> 00:01:01,920 and essentially this means the system missed it 33 00:01:01,920 --> 00:01:03,750 or overlooked that genuine problem. 34 00:01:03,750 --> 00:01:05,580 And this is actually going to be a big problem for you 35 00:01:05,580 --> 00:01:06,750 because now you have a threat 36 00:01:06,750 --> 00:01:08,520 and you don't even realize it's there. 37 00:01:08,520 --> 00:01:11,130 Now, the whole goal in effectively alerting our systems 38 00:01:11,130 --> 00:01:13,140 is to maximize our true positives 39 00:01:13,140 --> 00:01:15,240 while minimizing our false positives. 40 00:01:15,240 --> 00:01:17,280 This way, we can avoid alert fatigue 41 00:01:17,280 --> 00:01:18,570 among our security personnel 42 00:01:18,570 --> 00:01:19,560 and make sure we're catching 43 00:01:19,560 --> 00:01:21,720 all the bad things happening on our network. 44 00:01:21,720 --> 00:01:23,160 Now, monitoring, on the other hand, 45 00:01:23,160 --> 00:01:24,930 is going to involve the continuous observation 46 00:01:24,930 --> 00:01:27,300 of a system or network to detect anomalies, 47 00:01:27,300 --> 00:01:29,790 intrusions, and other potential security threats. 48 00:01:29,790 --> 00:01:31,290 This is a proactive approach 49 00:01:31,290 --> 00:01:33,510 to identifying and mitigating security incidents 50 00:01:33,510 --> 00:01:35,190 before they can cause significant damage 51 00:01:35,190 --> 00:01:36,780 to our systems or networks. 52 00:01:36,780 --> 00:01:39,570 Monitoring can also be performed in several different ways. 53 00:01:39,570 --> 00:01:41,760 It's usually going to be separate into two types, 54 00:01:41,760 --> 00:01:44,220 automated monitoring and manual monitoring. 55 00:01:44,220 --> 00:01:46,740 Automated monitoring is going to involve using software tools 56 00:01:46,740 --> 00:01:49,200 to automatically scan and analyze our network logs, 57 00:01:49,200 --> 00:01:51,030 our system logs, our network traffic, 58 00:01:51,030 --> 00:01:53,880 and other data for signs of malicious activity. 59 00:01:53,880 --> 00:01:55,440 Manual monitoring, on the other hand, 60 00:01:55,440 --> 00:01:57,090 is going to use human personnel 61 00:01:57,090 --> 00:01:59,490 to actively review and analyze our system data 62 00:01:59,490 --> 00:02:01,710 to detect potential security issues. 63 00:02:01,710 --> 00:02:03,000 Now, these monitoring systems 64 00:02:03,000 --> 00:02:04,950 also incorporate alerting mechanisms 65 00:02:04,950 --> 00:02:06,510 to notify security personnel 66 00:02:06,510 --> 00:02:09,060 if a potential security incident was detected. 67 00:02:09,060 --> 00:02:10,710 Now, in this section of the course, 68 00:02:10,710 --> 00:02:12,570 we're going to be focused on domain 4, 69 00:02:12,570 --> 00:02:15,180 and specifically objective 4.4. 70 00:02:15,180 --> 00:02:18,030 Objective 4.4 states that you must be able to explain 71 00:02:18,030 --> 00:02:20,910 security alerting and monitoring concepts and tools. 72 00:02:20,910 --> 00:02:23,880 So, we'll begin by covering monitoring resources. 73 00:02:23,880 --> 00:02:26,460 and here, we'll be doing an overview of monitoring systems, 74 00:02:26,460 --> 00:02:28,350 applications, and infrastructure. 75 00:02:28,350 --> 00:02:30,930 As we just mentioned, monitoring is an integral part 76 00:02:30,930 --> 00:02:32,610 when it comes to maintaining the integrity, 77 00:02:32,610 --> 00:02:35,430 confidentiality, and availability of our systems. 78 00:02:35,430 --> 00:02:37,050 Next, we'll jump into a discussion 79 00:02:37,050 --> 00:02:39,030 on alerting and monitoring activities, 80 00:02:39,030 --> 00:02:40,800 and this includes log aggregation, 81 00:02:40,800 --> 00:02:42,870 alerting, scanning, reporting, 82 00:02:42,870 --> 00:02:46,320 archiving, and alert response and remediation or validation. 83 00:02:46,320 --> 00:02:48,000 Then, we're going to be talking all about 84 00:02:48,000 --> 00:02:51,480 the Simple Network Management Protocol known as SNMP. 85 00:02:51,480 --> 00:02:54,240 Now, the Simple Network Management Protocol, or SNMP, 86 00:02:54,240 --> 00:02:56,940 is a widely used protocol in network management systems 87 00:02:56,940 --> 00:02:59,460 that's used for monitoring and managing network devices. 88 00:02:59,460 --> 00:03:01,620 These devices can include things like routers, 89 00:03:01,620 --> 00:03:03,690 and switches, and servers, and workstations, 90 00:03:03,690 --> 00:03:06,120 and printers, and modems, and much more. 91 00:03:06,120 --> 00:03:07,710 We're also going to spend a little bit of time here 92 00:03:07,710 --> 00:03:10,170 discussing SNMP, SNMP traps, 93 00:03:10,170 --> 00:03:12,600 and how they're used to set up and collect data. 94 00:03:12,600 --> 00:03:14,310 After that, we're going to be discussing 95 00:03:14,310 --> 00:03:16,830 the security information and event management system 96 00:03:16,830 --> 00:03:18,270 known as a SIEM. 97 00:03:18,270 --> 00:03:21,000 Now a SIEM is a set of integrated management technologies 98 00:03:21,000 --> 00:03:22,290 that provides a holistic view 99 00:03:22,290 --> 00:03:24,600 of your organization's information security. 100 00:03:24,600 --> 00:03:26,820 By using a SIEM, we're going to be able to collectively 101 00:03:26,820 --> 00:03:28,260 aggregate all of our log data 102 00:03:28,260 --> 00:03:30,810 generated throughout the entire organization's network, 103 00:03:30,810 --> 00:03:32,880 including all of its technology infrastructure 104 00:03:32,880 --> 00:03:34,710 from its host systems and applications 105 00:03:34,710 --> 00:03:37,050 all the way out to its network and security devices, 106 00:03:37,050 --> 00:03:39,990 including things like firewalls and antivirus software. 107 00:03:39,990 --> 00:03:42,270 Then, we're going to be able to take all that data together 108 00:03:42,270 --> 00:03:44,700 and look through it to figure out what does it have 109 00:03:44,700 --> 00:03:46,380 and what do we need to be alerting on 110 00:03:46,380 --> 00:03:47,760 based on what we're seeing? 111 00:03:47,760 --> 00:03:49,170 These SIEMs also are going to use 112 00:03:49,170 --> 00:03:50,460 two different types of monitoring, 113 00:03:50,460 --> 00:03:53,010 one is agent-based and the other is agentless monitoring, 114 00:03:53,010 --> 00:03:54,750 and we'll talk about both of those. 115 00:03:54,750 --> 00:03:57,420 Next, we're going to discuss data from security tools 116 00:03:57,420 --> 00:03:58,740 and we'll be talking about the collection of data 117 00:03:58,740 --> 00:04:02,190 from different sources like antivirus, DLP systems, 118 00:04:02,190 --> 00:04:03,780 network intrusion detection systems, 119 00:04:03,780 --> 00:04:05,520 network intrusion prevention systems, 120 00:04:05,520 --> 00:04:07,440 firewalls and vulnerability scanners, 121 00:04:07,440 --> 00:04:10,140 and how all this data can be consolidated within our SIEM 122 00:04:10,140 --> 00:04:12,120 for us to be able to analyze and review. 123 00:04:12,120 --> 00:04:13,020 Then, we'll take a look 124 00:04:13,020 --> 00:04:16,200 at the Security Content Automation Protocol known as SCAP. 125 00:04:16,200 --> 00:04:18,420 Now, the Security Content Automation Protocol 126 00:04:18,420 --> 00:04:20,430 is a method to use for specific standards 127 00:04:20,430 --> 00:04:22,350 to enable automated vulnerability management, 128 00:04:22,350 --> 00:04:24,630 measurement, and policy compliance evaluation 129 00:04:24,630 --> 00:04:25,860 of your systems that are deployed 130 00:04:25,860 --> 00:04:28,050 across your organization's network. 131 00:04:28,050 --> 00:04:30,843 After that, we're going to dive into network traffic flows. 132 00:04:30,843 --> 00:04:32,490 Now, a network traffic flow, 133 00:04:32,490 --> 00:04:34,470 often simply referred to as a flow, 134 00:04:34,470 --> 00:04:37,140 is a sequence of packets from a source to a destination, 135 00:04:37,140 --> 00:04:40,080 which may be identified by a unique set of identifiers, 136 00:04:40,080 --> 00:04:41,580 like the source IP address, 137 00:04:41,580 --> 00:04:44,010 the destination IP address, the source port number, 138 00:04:44,010 --> 00:04:46,890 the destination port number, and the protocol being used. 139 00:04:46,890 --> 00:04:49,290 Now, understanding traffic flows is really important. 140 00:04:49,290 --> 00:04:51,090 And by analyzing these traffic flows, 141 00:04:51,090 --> 00:04:52,200 you're going to be able to gain insights 142 00:04:52,200 --> 00:04:53,820 into the patterns of network usage 143 00:04:53,820 --> 00:04:56,430 and be able to identify bottlenecks or abnormalities 144 00:04:56,430 --> 00:04:59,370 as well as assisting to detect potential security threats. 145 00:04:59,370 --> 00:05:01,020 Next, we're going to cover a concept 146 00:05:01,020 --> 00:05:04,740 known as the single pane of glass, or SPOG. 147 00:05:04,740 --> 00:05:06,180 Now, a single pane of glass 148 00:05:06,180 --> 00:05:08,100 is used in information technology management 149 00:05:08,100 --> 00:05:09,840 to describe a system that consolidate data 150 00:05:09,840 --> 00:05:11,310 from lots of different sources 151 00:05:11,310 --> 00:05:13,650 into a completely unified display. 152 00:05:13,650 --> 00:05:15,840 Our goal here is to provide our system administrators 153 00:05:15,840 --> 00:05:17,910 with a comprehensive view of all the information 154 00:05:17,910 --> 00:05:20,190 they need to make decisions to monitor the status 155 00:05:20,190 --> 00:05:22,560 and to manage the operations of their networks. 156 00:05:22,560 --> 00:05:24,330 And finally, we're going to take a short quiz 157 00:05:24,330 --> 00:05:26,280 to see what you learned during this section of the course, 158 00:05:26,280 --> 00:05:28,080 and review each of those quiz questions fully 159 00:05:28,080 --> 00:05:30,990 to ensure you can explain each answer and why it was right. 160 00:05:30,990 --> 00:05:32,700 So, let's start exploring the world 161 00:05:32,700 --> 00:05:35,483 of alerting and monitoring in this section of the course.