Monitoring and Auditing Flashcards
Network traffic is analyzed for predetermined attack patterns
Signature-based
A baseline is established and any network traffic that is outside of the
baseline is evaluated
Anomoly-based
Activity is evaluated based on the previous behavior of applications,
executables, and the operating system in comparison to the current
activity of the system
Behavior Based
Process of measuring changes in networking, hardware, software, and
applications
Baselining
Documenting and reporting on the changes in a baseline
Baseline Reporting
Risk level to which a system or other technology element is exposed
Security Posture
Network adapter is able to capture all of the packets on the network,
regardless of the destination MAC address of the frames carrying them
Promiscuous Mode
Network adapter can only capture the packets directly addressed to itself
Non-promiscuous Mode
One or more switch ports are configured to forward all of their packets to
another port on the switch
Port Mirroring
A physical device that allows you to intercept the traffic between
two points on the network
Network Tap
A TCP/IP protocol that aids in monitoring network-attached devices and
computers
Simple Network Management Protocol (SNMP)
Computers and other network-attached devices monitored through the
use of agents by a network management system
Managed Devices
Software that is loaded on a managed device to redirect information to
the network management system
Agents
Software running on one or more servers to control the monitoring of
network-attached devices and computers
Network Management System (NMS)
Version of SNMP that provides integrity, authentication, and encryption
of the messages being sent over the network
SNMP v3
A technical assessment conducted on applications, systems, or networks
Auditing
Data files that contain the accounting and audit trail for actions
performed by a user on a computer or network
Logs
Logs the events such as successful and unsuccessful user logins to
the system
Security Logs
Logs the events such as a system shutdown and driver failures
System Logs
Logs the events for the operating system and third-party
applications
Application Logs
A standardized format used for computer message logging that
allows for the separation of the software that generates
messages, the system that stores them, and the software that
reports and analyzes them
SYSLOG
Actions taken to ensure the proper creation and storage of a log file, such
as the proper configuration, saving, back up, security, and encryption of
the log files
Log File Maintenance
When a maximum log size is reached, the system can begin overwriting
the oldest events in the log files to make room
Overwrite Events
Technology like a DVD-R that allows data to be written only once but
read unlimited times
Write Once Read Many (WORM)
A solution that provides real-time or near-real-time analysis of security
alerts generated by network hardware and applications
SIEM
A market-leading big data information gathering and analysis tool that
can import machine-generated data via a connector or visibility add-on
Splunk
Collection of free and open-source SIEM tools that provides storage,
search, and analysis functions
* Elasticsearch (query/analytics)
* Logstash (log collection/normalization)
* Kibana (visualization)
* Beats (endpoint collection agents)
ELK/Elastic Stack
A SIEM log management and analytics software that can be used for
compliance reporting for legislation and regulations like HIPPA, SOX, and
PCI DSS
ArcSight
A SIEM log management, analytics, and compliance reporting
platform created by IBM
QRadar
An open-source SIEM with an enterprise version focused on compliance
and supporting IT operations and DevOps
Graylog
A protocol enabling different appliances and software applications to
transmit logs or event records to a central server
Syslog
A class of security tools that facilitates incident response, threat hunting,
and security configuration by orchestrating automated runbooks and
delivering data enrichment
SOAR Security Orchestration, Automation, and Response (SOAR)
A security information and event monitoring system with an integrated
SOAR
Next Gen SIEM
A checklist of actions to perform to detect and respond to a specific type
of incident
Playbook
An automated version of a playbook that leaves clearly defined
interaction points for human analysis
Runbook
