3.3 Explain common scanning, monitoring and patching processes and summarize their expected outputs. Flashcards
Log management
Very diverse log sources
Usually sent via syslog
Massive storage requirement
Data rollup becomes important
Data graphing
Many different data sources
Usually managed through a SIEM
Graphing can require extensive resource utilization
Can use built-in graphs
Port scanning
Nmap Port scan Operating system scan Service scan Additional scripts
Nmap - Network mapper
Find and learn more about network devices
Port scan
Find devices and identify open ports
Operating system scan
Discover the OS without logging in to a device
Service scan
What service is available on a device? Name, version, details
Additional scripts
Nmap Scripting Engine (NSE) - extend capabilities, vulnerability scans
Vulnerability scanning
Usually minimally invasive Run a vulnerability scanner Identify systems and security devices Test from the outside and inside Gather as much information as possible
Vulnerability scan results
Lack of security controls
Misconfigurations
Real vulnerabilities
Patch management
Incredibly important
Service packs - All at once
Monthly updates
Emergency out-of-band updates
Protocol analyzers
Solve complex application issues
Gathers packets on the network
View traffic patterns
Large scale storage
Interface monitoring
Up or down
Alarming and alerting
Short-term and long-term reporting
Not focused on additional details
SIEM
Security Information and Event Management Security alerts Log aggregation and long-term storage Data correlation Forensic analysis
SNMP
Simple Network Management Protocol
Access should be very limited
