Process Monitoring

Question 1

Log management

Answer 1

• Very diverse log sources
  
  • And quite large
• Usually sent via syslog
  
  • Stored in a large drive array
• Massive storage requirement
  
  • There’s never enough
• Data rollup becomes important
  
  • Take samples every minute
  • Keep 5-minute samples for 30 days
  • After 30 days, rollup to 1 hour sample times

Question 2

Data graphing

Answer 2

• Many different data sources
  
  • Raw logs
  • Summarized metadata
• Usually managed through a SIEM
  
  • Turn raw data into something visual
• Graphing can require extensive resource utilization
  
  • Churn through terabytes of data
• Can use built-in graphs
  
  • Or build custom reports

Question 3

Port scanning

Answer 3

• Nmap - Network mapper
  
  • Find and learn more about network devices
• Port scan
  
  • Find devices and identify open ports
• Operating system scan
  
  • Discover the OS without logging in to a device

• Service scan
• What service is available on a device? Name,
version, details

• Additional scripts
• Nmap Scripting Engine (NSE) - extend capabilities,
vulnerability scans

Question 4

Vulnerability scanning

Answer 4

• Usually minimally invasive
  
  • Unlike a penetration test
• Run a vulnerability scanner
  
  • Poke around and see what’s open

• Identify systems and security devices

• Test from the outside and inside
  
  • Don’t dismiss insider threats
• Gather as much information as possible
  
  • We’ll separate wheat from chaff later

Question 5

Vulnerability scan results

Answer 5

• Lack of security controls
  
  • No firewall, no anti-virus, no anti-spyware
• Misconfigurations
  
  • Open shares, guest access
• Real vulnerabilities
  
  • Especially newer ones
  • Occasionally the old ones

Question 6

Patch management

Answer 6

• Incredibly important
  
  • System stability, security fixes

• Service packs - All at once

• Monthly updates
  
  • Incremental (and important)
• Emergency out-of-band updates
  
  • Zero-day and important security discoveries

Question 7

Protocol analyzers

Answer 7

• Solve complex application issues
  
  • Get into the details
• Gathers packets on the network
  
  • Or in the air
  • Sometimes built into the device
• View traffic patterns
  
  • Identify unknown traffic
  • Verify packet filtering and security controls
• Large scale storage
  
  • Big data analytics