-: Server and Host Event.
So, in addition to looking at your network side,
you also want to look at your servers and your hosts.
And one of the ways we do that is by system monitoring.
This is where you're gonna be looking at the processor,
the CPU, the memory and the drive space.
The CPU attacks are usually gonna occur
as a result of a DoS or malicious software.
Memory, on the other hand, is gonna be monitored
by the OS and based on given thresholds,
it's gonna report issues.
There might be things like memory leaks,
and this occurs when programs don't release
the memory after being terminated.
So when you open up Microsoft Word, for instance,
and you're done with it and you close it,
and it may have use a gigabyte of RAM while it was open,
when you close it,
it may now be using 10 or 20 megabytes of RAM.
And all those little leaks add up,
and eventually will take over your system
and can crash it.
All this memory gets used up, the system crashes,
and when the system is re-started, it releases the memory.
Now this may not be such a big deal on your host,
but if you start doing this on a server,
this can actually cause an outage.
And so some attacks will actually just work
on leaking the memory, using some malicious software,
to cause a server crash.
Now some of the other tools you can use here,
when we start talking about Windows.
It has some built-in tools.
And so if you're using a Windows server,
you can use resmon or Resource Monitor.
This is a built-in tool for monitoring,
and it's gonna tell you how much CPU, memory,
disk space and network utilization is in use.
It does provide both textual information,
as well as a graphical version.
Now, the next one we have is perfmon,
or Performance Monitoring.
This is a built-in tool by Windows, again,
used for monitoring, but it will
actually support collections from remote systems, as well.
So you, as an administrator, or an analyst,
can query those remote systems, get the information back,
and then track it in a singular place.
Now if you're dealing with a Linux system,
which a lot of our servers are,
there's four commands I want you to be aware of.
There's ps, top, df and w.
Now ps is all about processes.
It's gonna give you your CPU and memory utilization,
and the process information that is associated
with that particular CPU and memory utilization.
So if there is a single process that's really pegging high
and using a lot of your resources,
you can kill it by identifying it with ps.
Now, top is like ps, but it's gonna give you information
by sorting this into top usage.
So it becomes very easy to see which process
is sucking up your resources.
Again, if you have a malicious piece of software,
it generally is gonna start eating up
a lot of your resources,
so this is a great way to identify it.
Df is all about disk space.
It's gonna give you your disk usage and tell you
what is being used and how much free space you have,
as well as giving you some format commands.
And then w, it's all about users,
and it's gonna tell you which accounts are logged on
to the system and who ran which processes.
So again, going back to if I find a malicious process
using something with top, finding it's using a lot
of resources, I can then cross-reference that
with w to figure out who started that process,
and then figure out who's been infected.
And that is how I can identify who has been malicious
on this Windows system, or this Linux system, excuse me.
Now, we are in unsupported software.
When we look at malware, we're talking
about malicious software and unsupported software.
Those are two separate categories,
but they're both bad for our networks.
So to prevent them,
we want to use centralized management tools
to conduct inventories installs.
This way we can push out software that is authorized
on our network that we're gonna support,
and ensure that other software isn't being pushed out there.
We want to control this tightly
and have the system administrators doing it.
You can also use antivirus and antimalware tools,
because by scanning systems you can find malware
and get rid of it.
And if it is some unsupported software,
some of our tools we can do blacklisting of software.
So for instance, we don't want
to support peer-to-peer download softwares like Torrentz.
We can blacklist that piece of software.
And then, if we want to go to the opposite direction
of blacklisting what is known bad,
we can go to allowing only what is known good.
And we do that through application whitelisting.
This is much more effective than blacklisting,
because with blacklisting somebody can just install
a different piece of software that conducts the same role,
but with application whitelisting,
only those things that are specifically approved
will be allowed to be installed and run on the network.
And you can protect this using
a host intrusion protection system to ensure
that only the things that are allowed
will be allowed in the whitelist,
and Windows 10 actually does have
an application whitelisting feature, as well.
So if you're using Windows 10 as your host operating system,
that is useful, as well.
Now, we have unauthorized access, changes and privileges.
And this is all about users and their permissions.
So if we have users and permissions,
they are getting very complex,
especially with large networks and large numbers of systems.
How do you ensure that only the right users
are using the right things?
Well, one of the ways we can do that
is through a SIEM or a SIM,
which is a centralized management tool suite,
that can help us correlate those logs for analysis.
All of these logs, like authentication logs,
user creation logs, system logs, application logs
and security event logs, all can be put together
to determine is somebody using the wrong privileges
in the wrong areas,
so we can identify those malicious accounts.
We also want to be carefully controlling
who has administrative access
and who has privileged user access.
And we can actually do periodic checks to see
that that group is the right people that we have authorized.