Monitoring Security Performance: Methods And Record-Keeping

Security performance monitoring is a critical aspect of any organization's cybersecurity strategy, involving the continuous observation and analysis of security events within a system.

Security log management

Effective security log management involves the generation, transmission, storage, analysis, and disposal of security log data, ensuring its confidentiality, integrity, and availability. Organisations that fail to implement proper log management leave themselves vulnerable to attacks and non-compliance with various laws and standards, such as the Federal Information Security Modernization Act, ISO 27001, HIPAA, Sarbanes-Oxley Act, and PCI DSS.

One of the challenges of security log management is the vast volume of data generated by modern IT systems. Organisations must normalise log data, converting it into a uniform format to facilitate easy searching, comparison, and readability. Additionally, the systems used to store logs must be highly secure, with tightly controlled access, and capable of handling large amounts of data without impacting system performance.

To ensure effective security log management, organisations should capture critical events such as authentication successes and failures, access control successes and failures, session activity, changes in user privileges, processes starting or stopping, configuration changes, software installations or deletions, device attachments or detachments, system or application errors and alerts, and alerts from security controls.

To maintain the integrity of log data, organisations should implement measures such as using synchronised system clocks to ensure accurate timestamps, recording logs locally and on a remote server, and utilising write-once media or dedicated log servers to prevent unauthorised modifications.

By following best practices and utilising security log analysers, organisations can improve their security posture, detect and respond to threats, and ensure compliance with relevant laws and regulations.

Threat detection

One key method of threat detection is network detection and response (NDR). NDR utilises artificial intelligence (AI), machine learning (ML), and other advanced techniques to monitor network infrastructure and detect suspicious traffic. By analysing network traffic patterns and behaviours, NDR can identify potential threats and anomalies. Tools like Cisco Stealthwatch employ NDR to detect and respond to threats in real time, using machine learning to automatically generate alerts.

Endpoint detection and response (EDR) is another essential tool in threat detection. EDR solutions continuously monitor and collect data from endpoints, executing rules-based automated responses. By focusing on the environment's perimeters, EDR helps protect against potential threats.

Extended detection and response (XDR) offers a more comprehensive solution, detecting and remediating threats across secure endpoints, networks, emails, cloud workloads, and more. XDR prioritises alerts and efficiently coordinates responses, ensuring a swift and targeted reaction to potential threats.

Email threat detection is a vital component of XDR, provisioned as a standalone solution or integrated feature. By monitoring inbound, outbound, and internal messages, email threat detection uncovers, quarantines, and contains threats, ensuring that this common vector for attacks is secured.

Additionally, vulnerability management plays a crucial role in threat detection. This process involves identifying, monitoring, investigating, prioritising, and remediating known and unknown vulnerabilities in IT systems and infrastructure. By proactively addressing these weaknesses, organisations can significantly reduce the potential impact of cyberattacks.

Organisations can also benefit from managed detection and response (MDR) services offered by security vendors. MDR leverages human investigation, advanced threat intelligence, and integrated security tools to monitor, identify, and contain threats. This outsourced approach ensures dedicated focus and expertise in threat detection and response.

Verification of security controls

Security Control Validation

Security Control Validation (SCV) is a continuous security assessment approach that plays a pivotal role in improving an organisation's security posture. SCV evaluates the effectiveness of an organisation's prevention and detection layer solutions against external threats, helping to identify and address gaps. This approach uses automated and continuous simulations of real-world attack scenarios to validate the performance of security controls. By conducting breach and attack simulations, organisations can assess how well their security measures respond to threats within a controlled environment. SCV ensures that security controls are functioning as intended, provide adequate protection, and conform to established security requirements.

Testing Standard Security Controls

Standard software security controls should be regularly tested to ensure they operate as expected. This includes testing for authentication, access control, input validation, encoding, escaping data, and encryption controls. These tests can be conducted manually or with tools each time the application changes its use of the controls. Techniques such as feature toggles and A/B testing can be employed to gradually expose new features to broader audiences as they are sufficiently validated.

Integration of Security Requirements into Test Scenarios

To validate security requirements, it is essential to identify and implement a set of security test cases based on the specified testing objectives. These test cases should be derived from the security requirements created as part of the "Security Requirements" security practice. Examples of positive requirements that can be validated through testing include account lockout after a certain number of failed login attempts and minimum password requirements. By recreating testing conditions and running predefined tests, organisations can show the results as pass or fail conditions.

Regression Testing for Bug Fixes

It is important to write and automate regression tests for identified and fixed bugs to ensure they do not re-emerge in future releases. Security unit tests should dynamically verify that components function as expected and validate proper implementation of code changes. Developers should build a generic security test suite that includes positive and negative requirements for security controls such as identity, authentication, access control, input validation, and auditing and logging.

Security Functional Tests

Security functional tests focus on the functionality of security controls at the software component level, such as functions, methods, or classes. For example, a test case could assess input and output validation by checking variable sanitation and boundary checks for variables.

Breach and Attack Simulation (BAS) Platforms

BAS platforms are a critical tool for Security Control Validation exercises. These platforms provide a comprehensive, automated solution for simulating various cyber-attack scenarios in real-time. BAS tools enable continuous and on-demand assessments, providing an up-to-date security score for the organisation. They integrate with other security solutions, such as SIEM and SOAR systems, to enhance security intelligence and response capabilities. By simulating tactics, techniques, and procedures used by adversaries, BAS platforms help identify vulnerabilities and prioritise remediation efforts.

Exposure of bugs

Security monitoring is a critical aspect of maintaining the security and integrity of computer systems and networks. One of its primary purposes is to expose bugs and vulnerabilities within a system. Here are some key points about how security monitoring helps in the exposure of bugs:

• Security monitoring tools are designed for the continuous observation and analysis of security events within a system. This involves collecting and assessing security-relevant event data, such as audit logs, network security monitoring, and environmental data. By scrutinizing this data, security professionals can identify potential bugs and vulnerabilities.
• Security bugs are essentially software bugs that can be exploited to gain unauthorized access or privileges within a computer system. They introduce security vulnerabilities by compromising various aspects, such as user authentication, access rights authorization, and data confidentiality.
• Security monitoring has proven effective in identifying previously unknown vulnerabilities and security bugs. This is often achieved by triggering monitoring rules and subsequently reviewing them against the monitoring record to identify discrepancies or anomalies.
• To facilitate the exposure of bugs, security monitoring should be implemented as a feedback loop within the system. This involves collecting and analyzing multiple sets of information, such as knowledge about the infrastructure, event data, and security rules, to guide automated analysis and provide insights for improvement.
• The effectiveness of security monitoring relies on the integrity and completeness of the event data. Insecure or corrupted monitoring data can lead to unreliable results. Therefore, strong assurance and appropriate security controls are essential for all aspects of the monitoring process, including data collection, transmission, analysis, and archiving.
• Security monitoring should be continuously enhanced to address the evolving demands of complex cloud computing solutions. Greater automation is likely to be required for tuning analysis functions to keep up with the rapidly changing landscape of cyber threats.

Security monitoring mechanisms

Security monitoring tools, such as Security Information and Event Management (SIEM) systems, play a crucial role in aggregating and analysing log data from multiple sources. These tools enable security analysts and managers to filter through vast amounts of event data, identifying and focusing on the most relevant events. SIEM systems can detect deviations from established baselines, generate alerts, and activate additional security mechanisms.

The process of security log management includes the generation, transmission, storage, analysis, and disposal of security log data, ensuring its confidentiality, integrity, and availability. Log files provide an audit trail, allowing organisations to monitor activity, identify policy violations, detect unusual activity, and investigate security incidents.

To ensure the effectiveness of security monitoring mechanisms, organisations should implement best practices such as capturing specific security events, including relevant information in log entries, implementing log rules, ensuring log integrity, and utilising dedicated logging tools. Additionally, it is important to give extra scrutiny to administrator and system operator activities due to their elevated privileges.

Frequently asked questions