Section 23 Monitoring and Auditing Flashcards
Network traffic is analyzed for predetermined attack patterns.
Signature Based
A baseline is established and any network traffic that is outside of the baseline is evaluated.
Anomaly Based
Activity is evaluated based on the pervious behavior of applications, executables, and the operating system in comparison to the current activity of the system.
Behavior Based
Process of measuring changes in networking, hardware, software, and appliances.
Baselining
Documenting and reporting on the changes in a baseline.
Baseline Reporting
Risk level to which a system or other technology element is exposed.
Security Posture
Network adapter is able to capture all of the packets on the network regardless of the destination MAC address of the frames carrying them.
Promiscuous Mode
Network adapter can only capture the packets addressed to itself directly.
Non-Promiscuous Mode
One or more switch ports are configured to forward all of their packets to another port on the switch.
Port Mirroring
A physical device that allows you to intercept the traffic between two points on the network.
Network Tap
A TCP/IP protocol that aids in monitoring network attached devices and computers.
Simple Network Management Protocol (SNMP)
Computers and other network attached devices monitored through the use of agents by a network management system.
Managed Devices
Software that is loaded on a managed device to redirect information to the network management system.
Agents
Software run on one or more servers to control the monitoring of network attached devices and computers.
Network Management System (NMS)
Version of SNMP that provides integrity, authentication, and encryption of the messages being sent over the network.
SNMPv3
Data files that contain the accounting and audit trail for actions performed by a user on the computer or network.
Logs
Logs the events such as successful and unsuccessful user logons to the system.
Security Logs
Logs the events for the operating system and third party applications to consolidate all the logs into a single repository, you can use SYSLOG.
Application Logs
A standardized format used for computer message logging that allows for the separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them.
SYSLOG
Actions taken to ensure the proper creation and storage of a log file, such as the proper configuration, saving, backing up, securing, and encrypting of the log files.
Log File Maintenance
When a maximum log size is reached, the system can begin overwriting the oldest events in the log files to make room.
Overwrite Events
Technology like a DVD-R that allows data to be written only once but read unlimited times.
Write Once Read Many (WORM)
A solution that provides real time or near real time analysis of security alerts generated by network hardware and applications.
SIEM
A market leading big data information gathering and analysis tool that can import machine generated data via a connector or visibility add on.
Splunk
Collection of free and open source SIEM tools that provides storage, search, and analysis functions.
ELK/Elastic Stack
A SIEM log management and analytics software that can be used for compliance reporting for legislation and regulations like HIPPA, SOX, and PCI DSS.
Arc Sight
A SIEM log management, analytics, and compliance reporting platform created by IBM.
QRadar
A SIEM solution originally developed by Alien Vault, now owned by AT&T, and rebranded as AT&T cybersecurity.
Alien Vault and OSSIM (Open Source Security Information Mangement)
An open source SIEM with an enterprise version focused on compliance and supporting IT operations and DevOps.
Graylog
A class of security tools that facilitates incident response, threat hunting, and security configuration by orchestrating automated runbooks and delivering data enrichment.
Security Orchestration, Automation, and Response (SOAR)
A security information and event monitoring system with an integrated SOAR.
Nextgen SIEM
A checklist of actions to perform to detect and respond to a specific type of incident
Playbook
An automated version of a playbook that leaves clearly defined interaction points for human analysis.
Runbook
