- [Instructor] Continuous security monitoring approaches
take security monitoring to the next level.
Instead of simply focusing on the periodic review of logs
for unusual activity, they conduct this analysis
in real time, and can even take action
in response to suspicious events.
Here's a more formal definition
of continuous monitoring from NIST.
Information security continuous monitoring
is maintaining ongoing awareness of information security,
vulnerabilities, and threats to support
organizational risk management decisions.
As with many other information security activities,
NIST provides a framework for developing
a continuous approach to security monitoring.
They begin with three core characteristics
of a continuous monitoring program.
They should map to an organizations risk tolerance.
You need to make sure that the continuous monitoring
activities you undertake are appropriate
for your environment.
Security is an ever changing field,
and businesses evolve as needs change.
Continuous security monitoring programs
must adapt to these ongoing needs.
And management must play an active role
in continuous monitoring activities,
providing leadership and resources.
Around these core principals, we have six steps
of the continuous monitoring process given to us by NIST.
First, we define a continuous monitoring strategy
based upon risk tolerance that maintains clear visibility
into assets, vulnerabilities, threats, and business impact.
Second, we establish a monitoring program
by outlining the metrics we're going to use
and the frequency at which we're going
to monitor and assess our security.
Third, we implement the program by collecting the metrics,
performing the assessments, and building reports.
These tasks should be as automated as possible.
Next we analyze and report findings from collected data.
Then we move on to the fifth step,
responding to those findings by mitigating,
avoiding, transferring, or accepting the risk.
And then finally, we review and update
the monitoring program.
Adjusting our monitoring strategy and maturing
our measurement capabilities.
As you perform security data analytics, you will need
to aggregate and correlate data
from a wide variety of sources.
As I discussed in an earlier video,
you can use security information and event management
systems to assist with this task.
In some cases, you will want to perform a simple
point in time analysis looking at the data
immediately surrounding a specific event.
That's very helpful when
conducting an incident investigation.
Continuous monitoring approaches require the use
of other techniques that correlate data across time.
Anomaly analysis looks for data points that stand out
from the rest of the data as clear outliers.
You might look at this chart of bandwidth utilization
and notice that there was some unusual activity
around January 13th when inbound network traffic
represented by the red line spiked
for what looks like an entire day.
Those data points only stand out
when you compare it to the rest of the data set.
This type of anomaly analysis
is also known as heuristic analysis.
Trend analysis looks for historical changes over time.
For example, you might look at this data on the number
of account compromises that occurred in an organization
over the course of a year.
Clearly, there's an interesting trend here.
The number of compromises was typically somewhere in
the 20's until the fall when it suddenly plummeted.
This might have been due to the implementation of
a new security control or some other reason.
If you don't have an explanation readily available,
something like this would clearly merit an investigation.
Behavioral analysis looks at the activity of users
and identifies suspicious actions.
This might be done using signatures or heuristic analysis.
For example, you could apply heuristic anomaly analysis
to user login times to learn that I normally login
to my computer around 8:00 AM each weekday.
If I suddenly log in at 3:00 AM,
that's a behavioral anomaly that merits investigation.
Finally, availability analysis provides technology
leaders with key information about the performance
of their systems against service level agreements.
Availability analysis depends upon monitoring systems
that continuously monitor system status
and detect periods of downtime.
Continuous security monitoring is an important activity
that provides cyber security experts with real time insight
into the security and performance of technology resources.