Security Monitoring & Incident Detection Flashcards

What is the primary purpose of security monitoring?

Answer: To identify and respond to security threats

The primary purpose of security monitoring is to continuously observe and analyze system activities, network traffic, and user behavior for anomalies and suspicious patterns. This real-time detection capability enables organizations to promptly identify and respond to potential security threats. By quickly addressing incidents, monitoring helps minimize their impact and protect critical assets from compromise.

Which tool is commonly used for network intrusion detection?

Answer: Snort

Snort is a widely recognized open-source network intrusion detection system (NIDS) that performs real-time traffic analysis and packet logging. It detects various attacks, such as buffer overflows and stealth port scans, by comparing network traffic against a defined set of rules. While firewalls and antivirus tools serve different security functions, Snort specifically excels at identifying and alerting on network intrusions.

Why is log analysis important for incident detection?

Answer: They assist in identifying suspicious activity

Log analysis is critical for incident detection because logs record chronological events and activities across systems, applications, and networks. By reviewing these records, security analysts can identify unusual patterns, unauthorized access attempts, system errors, or other indicators of compromise. This forensic evidence helps in understanding the scope of an incident and formulating an effective response, making it a cornerstone of security operations.

What is a SIEM system used for?

Answer: Centralized security monitoring and alerting

A Security Information and Event Management (SIEM) system is designed to centralize and correlate security event data from various sources across an organization's IT infrastructure. It provides real-time analysis of security alerts generated by network devices, servers, and applications. This enables comprehensive security monitoring, efficient threat detection, and streamlined compliance reporting from a single, integrated platform.

Which type of alert indicates a true security incident?

Answer: True positive

In security monitoring, a true positive alert accurately indicates that a genuine security incident or threat has occurred. This means the detection system correctly identified a malicious activity that warrants immediate investigation and response. Recognizing true positives is crucial for prioritizing alerts and effectively allocating resources to address real security risks, preventing potential damage.

Which protocol is commonly used for transmitting log messages?

Answer: Syslog

Syslog is a standard protocol commonly used for transmitting system log or event messages from various network devices and applications to a central server. This centralized collection and management of logs are crucial for security monitoring, auditing, and incident response. It provides a consolidated view of system activities, making it easier to detect and analyze security events across an entire infrastructure.

What is the function of anomaly-based detection?

Answer: It identifies unusual behavior

Anomaly-based detection systems establish a baseline of normal system or network behavior over time. They then continuously monitor for any deviations from this established baseline, flagging unusual activities as potential threats. This method is particularly effective at detecting novel or zero-day attacks that signature-based systems, which rely on known patterns, might otherwise miss.

Which method helps reduce false positives in monitoring systems?

Answer: Adjusting detection thresholds

False positives occur when a monitoring system incorrectly flags legitimate activity as a security threat, leading to alert fatigue and wasted resources. Adjusting detection thresholds involves fine-tuning the sensitivity of the system's rules and parameters. This helps to minimize irrelevant alerts while ensuring that true threats are still detected effectively, improving the overall efficiency of security operations.

Why is continuous monitoring important?

Answer: It allows real-time detection of security threats

Continuous monitoring is essential because cyber threats are dynamic and can emerge at any time, often without warning. By constantly observing and analyzing an organization's systems and networks, security teams can detect and respond to security incidents as they happen. This real-time visibility significantly reduces the window of opportunity for attackers and minimizes potential damage, enhancing overall security posture.