Monitoring, Detection, and Response: The Watchers That Make Defence Possible
In the last post we arrived at the central discipline of modern security: defence in depth, built on the assumption that no single wall holds, that breaches will happen, and that the job is to contain them when they do. But read that carefully and you will notice a promise we made and did not yet keep. To contain a breach, you have to know it is happening. And knowing is not automatic. An…
The foundation of modern security is defence in depth, recognizing that no single safeguard can prevent breaches. The critical flaw lies in detecting these breaches in time, as an attacker inside a network does not issue notifications. This gap underscores the importance of visibility, which is the core focus of this post. All defensive measures are rendered useless if nobody is monitoring the network.
Two primary sources provide the raw data for monitoring: logs and traffic monitoring. Logs are the network's memory, recording system activities like user logins, connections, errors, and accessed resources. Though scattered across numerous devices, logs offer the richest source of information about network events when collected and analyzed.
Traffic monitoring involves observing data flows across the network, including data sources, ports, volumes, and patterns. This offers a live view of the network's behavior, contrasting with the historical record provided by logs. However, raw data from these sources is overwhelming; it must be distilled into a baseline representing the normal network behavior, including traffic volumes, connection patterns, login times, and system activities.
This baseline is crucial because deviations from it signal potential anomalies, such as attacks. Without a baseline, even significant irregularities would be indistinguishable from normal fluctuations.
Once a baseline is established, monitoring can effectively identify abnormal activities. This leads to detection and subsequent response. Intrusion Detection Systems (IDS) focus on alerting when anomalies are detected, but their alerts require human intervention to determine and respond to threats, potentially leaving a window of vulnerability.
Intrusion Prevention Systems (IPS), on the other hand, can automatically block detected threats in real time, eliminating the delay between detection and mitigation. However, an IPS's automatic actions also pose significant risks. False positives, where legitimate traffic is mistakenly flagged as malicious, can disrupt services and user access.
Moreover, an IPS integrated into the network's traffic flow can inadvertently cause network-wide outages if misconfigured, highlighting the need for careful deployment and calibration of IPS systems. Effective monitoring and detection systems are essential for recognizing and responding to attacks, turning seemingly invisible threats into visible patterns that can be managed and neutralized.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
