In this lesson,
we'll be discussing alerting and monitoring activities.
Now alerting and monitoring activities play a big role
in maintaining system health by ensuring optimal performance
and protecting against many potential threats.
Alerting and monitoring utilizes a wide range of activities
including log aggregation, alerting, scanning, reporting,
archiving, alert response and remediation or validation.
Now first we have log aggregation.
Log aggregation is the process
of collecting and consolidating log data
from various sources into a centralized location.
The log aggregation process is going to help
with the analysis and troubleshooting of system issues,
security incidents, and performance problems.
This can be used for multiple purposes,
including troubleshooting,
performance monitoring, security analysis, and compliance.
Now since aggregated logs can provide a holistic view
of what's happening across various systems and applications,
they can make it much easier for us
to identify and troubleshoot issues
by helping us to correlate events across different systems
or network logs to pinpoint the root cause
of a given problem or incident.
Consolidated log data can also provide us
with valuable insights into our system's performance.
By aggregating logs,
you can monitor performance trends over time,
identify your bottlenecks,
and make informed decisions about your resource allocations.
Logs are also useful in terms
of conducting a security analysis
because our logs often combine data about security events
like failed login attempts, changes to user privileges,
and suspicious network connections.
By aggregating and analyzing all this log data,
you can detect security incidents, investigate breaches,
and gather evidence for forensic analysis.
Another use for log aggregation
is to meet your organization's compliance requirements.
Now many laws and regulations like GDPR and HIPAA
require your business to maintain a comprehensive set
of logs for certain regulated activities.
Now log aggregation can help businesses
meet these requirements
by ensuring that all of your necessary log data
is being collected and stored in a centralized location
that can be easily reviewed by auditors
during a compliance audit.
Second, we have alerting.
Now alerting involves setting up notifications
to inform relevant stakeholders
when specific events or conditions occur.
Alerting can be triggered based on predefined thresholds
or anomalies that can be delivered via various channels
like email, text messages, and push notifications.
Alerting is also important in helping
to ensure that issue resolution, incident detection,
and compliance is occurring within your organization.
By using alerts, your team can proactively address issues
before they escalate into more significant problems.
For example, if a server CPU utilization
exceeds a certain threshold, an alert might be triggered
that allows your team to investigate it
and then resolve that issue before it impacts
your system's overall performance or availability.
Alerts can also be set up
to notify security teams of potential security incidents.
For example, multiple failed login attempts
or unusual data access patterns could trigger alerts
which can then enable a faster investigation
and response to occur.
Also, some laws and regulations
do require the immediate notification of specific events
like a data breach to governmental agencies.
If you implement alerting mechanisms,
you can be assured that you're meeting those requirements
in order to maintain your regulatory compliance.
Third, we have scanning.
Now scanning involves regularly examining your systems,
networks, or applications to identify vulnerabilities,
configuration issues, or other potential problems.
The scanning process is crucial
for maintaining system health
to ensure that your systems are operating
within optimal performance standards
and are safeguard against potential threats.
Now scanning typically involves the use
of a specialized tool or service
like Nessus, OpenVAS, or Qualys
to perform various types of scans
including vulnerability scans, configuration scans,
and code scans.
A vulnerability scan checks for known vulnerabilities
in your systems, networks, or applications
by comparing your system's current state
against a database of known vulnerabilities,
that's known as the CVE
or Common Vulnerabilities and Exposures
and this is a database provided by the MITRE Corporation
that you can find at cve.mitre.org.
For example, a security team might use
a vulnerability scanning tool
like Nessus or OpenVAS to perform a vulnerability scan
of their entire network.
These scans will identify any unpatched software,
misconfigured services, or other potential vulnerabilities
that could be exploited by a threat actor
so that your system administrators
can then mitigate these vulnerabilities
by patching those systems, reconfiguring them,
or putting in place some other forms of mitigations,
like installing a web application firewall
if that's appropriate.
Now a configuration scan on the other hand
is going to be used to check for misconfigurations
that could impact your system performance or security
by comparing the system's configuration
against best practice guidelines
or specific compliance standards.
A configuration scan
will focus on detecting misconfigurations
that have the potential
to affect system performance or security.
By conducting a configuration scan,
organizations can proactively identify
and rectify any deviations
from their recommended settings,
while ensuring that their systems
not only operate efficiently,
but they also adhere to security and compliance standards.
This preventative measure will definitely help
to maintain a robust and secure IT environment
and it helps to minimize the risk of vulnerabilities
and performance issues that stem from configuration errors.
For example, if an organization is striving
to maintain a secure and compliant network environment,
they might choose to employ a configuration scanning tool
like CIS-CAT to conduct periodic scans of their systems
and network devices.
These types of scans
will evaluate your system configurations
against recognized benchmarks
like the Center for Internet Securities, CIS Controls,
or other industry specific compliance frameworks
like PCI DSS that's used with credit card processing.
Any discrepancy discovered during the scan
such as an open port, weak access controls,
or non-compliant settings are then going to be flagged
for attention and remediation.
Then your system administrators
can take their proactive steps
to rectify all these misconfigurations
and to ensure the network remains aligned
with the industry best practices
and regulatory requirements
in order to bolster your security posture
and compliance status.
A code scan will check the source code of an application
for potential issues
such as security vulnerabilities or coding errors.
This is often done as part of a software development process
to catch and fix issues early.
Code scans can be completed
using either static code analysis
or dynamic code analysis techniques as well.
For example, if you're working
as part of a software development team
that's creating a new web application,
you might want to perform a code scan
to ensure the application security and functionality
is working as you designed.
Now you and your team can employ static code analysis tools
like Fortify or SonarQube to examine the application
source code thoroughly on your behalf.
If the tool identifies a potential security vulnerability
during its scan, such as an SQL injection point,
cross-site scripting vulnerabilities,
or coding errors like unsanitized
or uninitialized variables or resource leaks,
these issues can quickly be addressed
during your development process
to reduce the likelihood of a future security breach.
This helps to prevent future issues
while also ensuring a more robust
and reliable application is going to be deployed
into your production environment.
Additionally, dynamic code analysis techniques
such as penetration testing
can complement your static analysis
by evaluating the application's behavior
while it's running to uncover any vulnerabilities
that may not be apparent
when you're conducting a purely static review
of the source code.
Fourth, we have reporting.
Now reporting involves generating summaries
or detailed reports
based on the collected and analyzed data.
These reports can provide insight into system performance,
security incidents, compliance status, and other aspects.
For example, a compliance officer might use a tool
like Splunk or Sumo Logic to generate reports
to help demonstrate the organization's compliance
with data protection regulations.
These reports can be used to satisfy regulatory requirements
and to identify areas for continuous improvement as well.
Fifth, we have archiving.
Archiving involves storing data
for long retention periods or for future reference
including all of your organization's log data,
performance data, incident data,
and other types of important data
that you may have collected over time.
For example, a cybersecurity professional
could use a tool like Amazon S3
or Google Cloud storage to archive its older log data.
This archive data can be used for further analysis,
troubleshooting, auditing, or compliance purposes
if it's needed.
Depending on various laws and regulations,
you may or may not be required to maintain an archive
of all of your data for a certain period of time.
HIPAA or the Health Insurance Portability
and Accountability Act is going to require you
to maintain all of your data for six years
to prove compliance.
So if you're working in a healthcare related field,
you may want to move your data
into either hot or cold storage
inside of a cloud environment,
so that way you'll be able to meet
this regulatory requirement
or you'll be responsible for maintaining
all of that in your on-premise data center as well.
Sixth, we have alert response and remediation or validation.
Now once an alert or scan identifies
a potential vulnerability or incident,
we have to begin the process of managing
and resolving those identified issues
as part of our overall alerting and monitoring activities.
This involves taking appropriate actions
in response to alerts,
ensuring that the identified issues
have been effectively addressed.
Now the first step in the response and remediation
or validation process involves taking appropriate actions
in response to a received alert.
This response can include investigating the issue,
escalating it to the appropriate team,
or initiating a predefined response procedure.
For example, if a network engineer receives an alert
about a network outage
and they respond by investigating the issue
and identifying the cause of the outage,
they have completed this step of the process.
Then we need to begin the remediation or validation process
which helps to determine the specific response
based on the nature of the alert
and the organization's incident response procedures.
When we talk about remediation,
we're really talking about the steps
used to resolve the identified issues or vulnerabilities,
which could include things
like patching outdated software, reconfiguring services,
or modifying an application's source code.
Now validation on the other hand involves verifying
that the remediation you implemented was actually successful
and has effectively addressed
the given vulnerability or issue.
So for example, if an alert notified a security analyst
that a missing software patch was not installed
and this represents a known vulnerability
on a Windows domain controller, this is considered an alert.
Now the security analyst might respond to this alert
by installing a security update
to patch this known vulnerability.
This is the remediation portion of this process.
Now the security analyst
also needs to run a vulnerability scan
on that domain controller again to validate
that the patch was successfully installed
and that the threat that vulnerability represents
has been fully eliminated from this server.
Now when your security analyst respond to a given alert,
you may also find that they're going to use two other actions
known as quarantining or alert tuning.
Now a common remediation step
might involve quarantining a system
or file that's suspected to be malicious.
Quarantining involves isolating a system,
network or application to prevent the spread of a threat
and limit its potential impact.
For example, if a workstation is suspected
to be infected with malware,
the security team might quarantine this workstation
by logically isolating it from the rest of the network
while the security team investigates the issue further
and then undertakes the rest
of the organization's incident response procedures
on this suspected malicious workstation.
This prevents the malware from spreading to other systems
while the team is working to remove that infection
which is why we quarantine it.
Now alert tuning on the other hand,
is a form of remediation
where we're going to adjust the alert parameters
to reduce errors, false positives,
and to improve the overall relevance
of the alerts being generated by a given system.
Alert tuning can also involve changing the thresholds
that trigger an alert,
adjusting the conditions that define an alert,
or modifying the alert delivery methods.
For example, a system administrator
might be receiving too many alerts
about a minor CPU utilization spike
that really doesn't impact
your system's overall performance.
So to reduce the excessive noise being created
by all these alerts,
the system administrator could retune that alert
to only trigger when the system's CPU utilization
exceeds a higher threshold or remains high
for at least 30 or 60 seconds or longer
to reduce the amount of alerts being generated
by this system.
So remember, log aggregation is used to collect
and consolidate log data from various sources
into a centralized location.
Alerting is going to be used to set up notifications
to inform relevant stakeholders
when specific events or conditions are occurring.
Scanning involves conducting regular examinations
of your systems, networks,
or applications to identify vulnerabilities,
configuration issues, or other potential problems.
Reporting is going to be used to generate summaries
or detailed reports
based on the collected and analyzed data.
Archiving is used to store data
for long-term retention periods
and for future reference.
Alert response involves taking the appropriate actions
in response to received alerts.
Remediation and validation is going to be used
to take the steps necessary to resolve identified issues
or vulnerabilities, and verify that your remediation efforts
were actually successful.
Now it's important to always conduct proper alerting
and monitoring activities
in order to maintain your system's overall health
and ensure it's optimal performance
while still safeguarding your organization
against potential threats.
So keep this in mind.