1
00:00:00,050 --> 00:00:00,960
In this lesson,

2
00:00:00,960 --> 00:00:02,550
we're going to cover the different types of data

3
00:00:02,550 --> 00:00:04,530
gained from your security tools.

4
00:00:04,530 --> 00:00:05,460
In cybersecurity,

5
00:00:05,460 --> 00:00:07,050
we use a wide variety of tools

6
00:00:07,050 --> 00:00:08,640
to safeguard our digital assets,

7
00:00:08,640 --> 00:00:10,230
including antivirus software,

8
00:00:10,230 --> 00:00:11,730
data loss prevention systems,

9
00:00:11,730 --> 00:00:13,410
network intrusion detection systems,

10
00:00:13,410 --> 00:00:15,030
network intrusion prevention systems,

11
00:00:15,030 --> 00:00:15,863
firewalls,

12
00:00:15,863 --> 00:00:16,950
vulnerability scanners,

13
00:00:16,950 --> 00:00:18,690
and others to generate a lot of logs,

14
00:00:18,690 --> 00:00:20,010
events, and incident data

15
00:00:20,010 --> 00:00:21,690
for our analysts to be able to look at

16
00:00:21,690 --> 00:00:23,400
as cybersecurity professionals.

17
00:00:23,400 --> 00:00:25,770
Now, this data, when consolidated and analyzed,

18
00:00:25,770 --> 00:00:27,270
can provide invaluable insights

19
00:00:27,270 --> 00:00:30,000
into the security posture of our organizations.

20
00:00:30,000 --> 00:00:31,980
Usually, we're going to rely on a SIEM,

21
00:00:31,980 --> 00:00:34,530
or a security information and event management system,

22
00:00:34,530 --> 00:00:37,140
to serve as that centralized hub for the consolidation

23
00:00:37,140 --> 00:00:38,670
to be able to provide us with a holistic view

24
00:00:38,670 --> 00:00:40,920
of our organization's security landscape.

25
00:00:40,920 --> 00:00:42,570
Let's take a look at the different types of data

26
00:00:42,570 --> 00:00:44,370
that we can receive from our various security tools

27
00:00:44,370 --> 00:00:45,900
inside of our SIEM.

28
00:00:45,900 --> 00:00:48,360
Now, first, we have antivirus software.

29
00:00:48,360 --> 00:00:50,910
Antivirus software is a fundamental security tool

30
00:00:50,910 --> 00:00:52,620
that protects systems against malware,

31
00:00:52,620 --> 00:00:54,960
including viruses, worms, trojans,

32
00:00:54,960 --> 00:00:56,670
ransomware, and spyware.

33
00:00:56,670 --> 00:00:58,560
The data generated by antivirus software

34
00:00:58,560 --> 00:01:00,030
such as malware detection logs,

35
00:01:00,030 --> 00:01:01,680
system scans and updates

36
00:01:01,680 --> 00:01:02,850
can all be sent to a SIEM

37
00:01:02,850 --> 00:01:04,500
for aggregation and correlation

38
00:01:04,500 --> 00:01:07,410
within all of our other systems and device logs.

39
00:01:07,410 --> 00:01:09,360
Now, this data can then be used to provide insights

40
00:01:09,360 --> 00:01:10,590
into potential security threats

41
00:01:10,590 --> 00:01:13,140
and the overall health of all of your systems.

42
00:01:13,140 --> 00:01:13,980
For example,

43
00:01:13,980 --> 00:01:16,230
if a particular system is consistently reporting

44
00:01:16,230 --> 00:01:17,670
that's infected with malware,

45
00:01:17,670 --> 00:01:18,990
this may be a small issue

46
00:01:18,990 --> 00:01:21,000
or an indication of a larger attack

47
00:01:21,000 --> 00:01:23,280
being executed by a given threat actor.

48
00:01:23,280 --> 00:01:25,440
By setting the malware alert data to our SIEM,

49
00:01:25,440 --> 00:01:27,030
our security teams can identify

50
00:01:27,030 --> 00:01:28,770
and address this issue more proactively

51
00:01:28,770 --> 00:01:30,300
by checking the rest of your systems

52
00:01:30,300 --> 00:01:31,980
to determine if the malware infection is spreading

53
00:01:31,980 --> 00:01:34,080
across multiple systems, across your network,

54
00:01:34,080 --> 00:01:36,000
or if it's isolated to this one server

55
00:01:36,000 --> 00:01:37,530
that you're suspecting.

56
00:01:37,530 --> 00:01:40,350
Now, second, we have data loss prevention systems.

57
00:01:40,350 --> 00:01:43,260
Data loss prevention systems, known as DLP systems,

58
00:01:43,260 --> 00:01:45,390
are used to monitor and control data endpoints,

59
00:01:45,390 --> 00:01:46,223
network traffic,

60
00:01:46,223 --> 00:01:47,850
and data stored in the cloud

61
00:01:47,850 --> 00:01:50,370
to prevent potential data breaches from occurring.

62
00:01:50,370 --> 00:01:52,080
These data loss prevention systems

63
00:01:52,080 --> 00:01:54,480
can also generate data about potential data leaks,

64
00:01:54,480 --> 00:01:55,440
policy violations,

65
00:01:55,440 --> 00:01:57,660
and other suspicious user activities.

66
00:01:57,660 --> 00:02:00,210
For example, a DLP system might flag an attempt

67
00:02:00,210 --> 00:02:01,920
to send sensitive company information

68
00:02:01,920 --> 00:02:04,080
like a list of all of your organization's client names,

69
00:02:04,080 --> 00:02:05,520
phone numbers, and emails

70
00:02:05,520 --> 00:02:08,250
by email to somebody outside of your organization.

71
00:02:08,250 --> 00:02:10,259
This data about this potential incident

72
00:02:10,259 --> 00:02:11,760
could also be sent to your SIEM

73
00:02:11,760 --> 00:02:12,660
so that the security team

74
00:02:12,660 --> 00:02:14,340
is alerted to the potential data leak,

75
00:02:14,340 --> 00:02:16,830
and this enables them to perform timely corrective actions

76
00:02:16,830 --> 00:02:18,840
to hopefully prevent this from occurring.

77
00:02:18,840 --> 00:02:21,450
Third, we have network intrusion detection systems

78
00:02:21,450 --> 00:02:23,640
and network intrusion prevention systems.

79
00:02:23,640 --> 00:02:26,580
Now, network intrusion detection systems, known as NIDS,

80
00:02:26,580 --> 00:02:29,460
or network intrusion prevention system, known as NIPS,

81
00:02:29,460 --> 00:02:31,110
are used to monitor network traffic

82
00:02:31,110 --> 00:02:33,510
to detect or prevent malicious activities.

83
00:02:33,510 --> 00:02:36,540
NIDS are used to passively identify any potential threats

84
00:02:36,540 --> 00:02:39,120
and generate alerts when they're being detected.

85
00:02:39,120 --> 00:02:40,440
A NIPS, on the other hand,

86
00:02:40,440 --> 00:02:41,910
is going to be used to proactively block

87
00:02:41,910 --> 00:02:43,320
or prevent these potential threats

88
00:02:43,320 --> 00:02:45,780
from accessing your network in the first place.

89
00:02:45,780 --> 00:02:47,820
Now, data from both our NIDS and NIPS,

90
00:02:47,820 --> 00:02:49,080
including detected threats,

91
00:02:49,080 --> 00:02:51,030
block traffic and network anomalies,

92
00:02:51,030 --> 00:02:52,920
can also be sent to your organization SIEM

93
00:02:52,920 --> 00:02:55,050
for correlation and aggregation.

94
00:02:55,050 --> 00:02:56,760
This type of data can help to identify

95
00:02:56,760 --> 00:02:58,230
patterns of malicious activity,

96
00:02:58,230 --> 00:02:59,670
potential security vulnerabilities,

97
00:02:59,670 --> 00:03:00,600
and the effectiveness

98
00:03:00,600 --> 00:03:03,300
of your organization's intrusion prevention measures.

99
00:03:03,300 --> 00:03:05,220
Fourth, we have firewalls.

100
00:03:05,220 --> 00:03:06,690
Now, firewalls serve as a barrier

101
00:03:06,690 --> 00:03:08,370
between a trusted internal network

102
00:03:08,370 --> 00:03:10,440
and an untrusted external network.

103
00:03:10,440 --> 00:03:11,910
Firewalls are going to be used to filter

104
00:03:11,910 --> 00:03:13,740
incoming and outgoing network traffic

105
00:03:13,740 --> 00:03:16,140
based upon predetermined sets of security rules,

106
00:03:16,140 --> 00:03:19,500
which we call access control lists or ACLs.

107
00:03:19,500 --> 00:03:21,510
Firewalls can generate logs that contain data

108
00:03:21,510 --> 00:03:23,220
about allowed and blocked traffic,

109
00:03:23,220 --> 00:03:25,920
rule changes, and any detected potential threats.

110
00:03:25,920 --> 00:03:27,900
By sending our firewall data to our SIEM,

111
00:03:27,900 --> 00:03:30,630
our organization can monitor its network perimeter security

112
00:03:30,630 --> 00:03:32,970
and identify any potential intrusion attempts

113
00:03:32,970 --> 00:03:34,050
because we can use this

114
00:03:34,050 --> 00:03:36,510
as part of our overall security posture.

115
00:03:36,510 --> 00:03:37,860
Now, for example, let's say

116
00:03:37,860 --> 00:03:39,780
that you see somebody who's pinging your web server

117
00:03:39,780 --> 00:03:41,250
by checking if any ports are open

118
00:03:41,250 --> 00:03:44,370
between port 0 and port 1023.

119
00:03:44,370 --> 00:03:45,960
Now, this would show up as a port scan

120
00:03:45,960 --> 00:03:47,730
that's being conducted against our server,

121
00:03:47,730 --> 00:03:48,900
and this could be an indication

122
00:03:48,900 --> 00:03:50,220
that a threat actor is performing

123
00:03:50,220 --> 00:03:51,390
some kind of reconnaissance

124
00:03:51,390 --> 00:03:53,040
against your organizational systems,

125
00:03:53,040 --> 00:03:55,170
and you would see that by checking these firewall logs

126
00:03:55,170 --> 00:03:56,760
inside of your SIEM.

127
00:03:56,760 --> 00:03:57,690
Fifth and finally,

128
00:03:57,690 --> 00:03:59,490
we have vulnerability scanners.

129
00:03:59,490 --> 00:04:01,410
Now, vulnerability scanners are tools that are used

130
00:04:01,410 --> 00:04:03,630
to identify security weaknesses in a system,

131
00:04:03,630 --> 00:04:05,310
including missing security patches,

132
00:04:05,310 --> 00:04:06,330
incorrect configurations,

133
00:04:06,330 --> 00:04:08,490
and other types of known vulnerabilities.

134
00:04:08,490 --> 00:04:10,290
A vulnerability scanner can generate data

135
00:04:10,290 --> 00:04:11,850
about identified vulnerabilities,

136
00:04:11,850 --> 00:04:12,683
their severity,

137
00:04:12,683 --> 00:04:14,760
and recommended remediation steps.

138
00:04:14,760 --> 00:04:16,950
By integrating all this data into your SIEM,

139
00:04:16,950 --> 00:04:18,420
your organization can prioritize

140
00:04:18,420 --> 00:04:20,160
your vulnerability remediation efforts

141
00:04:20,160 --> 00:04:22,170
based on the severity and potential impact

142
00:04:22,170 --> 00:04:24,030
of that given vulnerability.

143
00:04:24,030 --> 00:04:26,010
Additionally, we can also use this kind of data

144
00:04:26,010 --> 00:04:28,020
to track our organization's remediation progress

145
00:04:28,020 --> 00:04:29,490
and verify the effectiveness

146
00:04:29,490 --> 00:04:31,890
of the remediation steps that we are performing.

147
00:04:31,890 --> 00:04:33,720
So remember, by consolidating data

148
00:04:33,720 --> 00:04:35,070
from these diverse security tools

149
00:04:35,070 --> 00:04:36,660
into a centralized SIEM,

150
00:04:36,660 --> 00:04:38,760
our organizations can get a comprehensive view

151
00:04:38,760 --> 00:04:40,380
of our security posture.

152
00:04:40,380 --> 00:04:42,600
Data can be gathered from our antivirus software,

153
00:04:42,600 --> 00:04:43,860
data loss prevention systems,

154
00:04:43,860 --> 00:04:45,540
network intrusion detection systems,

155
00:04:45,540 --> 00:04:47,220
network intrusion prevention systems,

156
00:04:47,220 --> 00:04:48,053
firewalls,

157
00:04:48,053 --> 00:04:49,020
vulnerability scanners,

158
00:04:49,020 --> 00:04:51,360
and many others to generate a lot of logs,

159
00:04:51,360 --> 00:04:52,770
events, and incident data

160
00:04:52,770 --> 00:04:55,980
that we can then analyze as cybersecurity professionals.

161
00:04:55,980 --> 00:04:57,390
This helps us proactively identify

162
00:04:57,390 --> 00:04:59,190
and address any potential security threats

163
00:04:59,190 --> 00:05:01,740
and ensure our organization remains well-protected.