Detecting a security incident is not the easiest thing to do.
These incidents take many shapes and forms.
They may have a different amount of detail.
They may attacked different kinds of systems.
You're never quite certain exactly where
the incident is going to come from.
One of the challenges we have is that our networks
are constantly under attack.
If you're connected to the internet
there's automated processes, bots, worms,
and people maliciously trying to gain access to your systems.
So the question really is, of this traffic, how much of it
is a legitimate threat, and how much of it
is going to be stopped by the existing systems
that we have in place?
It's multiple layers of security that we
have to spread across every part of our infrastructure,
and it really requires some specialized knowledge and tools
to be able to accomplish that.
It would be really great if we could identify
that an incident was going to occur before it actually
did occur.
And one way to do that is to look
at different pieces of our network
to understand where these changes,
or significant precursors, may be happening.
One place to gather of these precursors
is in something like a Web server log.
You can look at what people are hitting your web server,
and you can also see when different devices,
or different scripts, may be running automated vulnerability
checks against your servers, and this may give you
a heads up at somebody's trying to gain access
into your systems.
Another precursor may be the very common
monthly announcements vulnerabilities.
Microsoft, for instance, announces vulnerabilities,
and almost immediately, you see the bad guys
trying to take advantage of these open holes
in your operating systems, before you
have a chance to patch them.
So you may see an increase in the number of people trying
to use those vulnerabilities, against the servers
that you already have in place.
And some precursors may be very obvious.
The bad guys might contact you directly and say,
that you need to pay them a certain amount of money,
or they're going to hit devices with a massive denial
of service attack.
In this particular case you have a decision
to make on whether you pay them their money,
or you protect your systems against these kinds
of security incidents.
There's a number of things that you
can monitor to see if an attacker might be under way.
This obviously is going to be important,
because the sooner we can stop the attack,
the less damage is going to be occurring in your network.
One way is to look for things like buffer overflow attempts.
Which is a very common way to take advantage of bad software
in an application or an operating system.
You can look to intrusion prevention systems
to provide you with information about things like buffer
overflows, because they tend to have signatures that
are specifically designed to look for these on the network
and inside of an operating system.
On the devices themselves you can constantly
update your anti-virus and your anti-malware signatures,
so that they may also identify malicious software that
may try to execute in the operating system itself.
In those cases the software also generally contacts you,
so you'll have an idea of where these particular attack
vectors are coming from.
It's also very common in your file servers,
where the operating system files,
in the documents don't change very often
to lock them down and then monitor the files.
That way if somebody does gain access into the operating
system and they try to modify what exists,
you'll be notified that somebody's
made a change to these files that normally would never
be changing.
And another way to look for any type of security incidents
that may be occurring is to look at your network traffic.
Network tends to be very predictable day, after, day,
after, day.
If there are any significant changes, or things deviate,
from what is normal it may be indicative
of an ongoing problem.
Hopefully, these precursors, and these active indicators,
of a security incident can help you
get a better idea of what might be
happening in your environment.