-: In this section of the course,
we're going to be discussing monitoring and auditing.
Let's begin with monitoring first.
When we talk about monitoring,
one of the main jobs of security analyst,
is to really monitor the network.
We're like detectives, we're trying to route out anything
that doesn't appear quite right.
And this can be done manually or through an automated means.
When we do this to an automated means,
it's done through one of three methods.
It's either signature-based, anomaly-based
or behavior-based.
Now, when we talk about signature-based monitoring,
this is where your network traffic is analyzed
for predetermined attack patterns.
And so if I said,
every time you see somebody walk through the door
who is five foot eight with brown hair
and whose name is Jason, that's a signature.
So you would stop me at the door
because I met that criteria.
That's the idea with the signature-based attack.
The second type is know as anomaly-based.
Now when we do anomaly-based monitoring,
we have to create a baseline of what normal is first.
And once we established the baseline,
then we can look at any other network traffic
that starts following outside that baseline
for further evaluation.
So let's say you decided to park your car on my street,
and you start watching all the traffic that goes by,
and normally you see a lot of people leave for work
between 7 a.m and 9 a.m
but, one time you saw people not leave until noon.
You'd go, "hmm, that's out of the ordinary."
Normally that person leaves their house before nine,
and so that's outside the normal
and we're going to look into that further.
It's an anomaly, it's outside of the baseline.
The third type we have is what's known as behavior-based.
Behavior-based is an activity that's going to be evaluated
based on previous behaviors of the applications,
the executables and the operating system in comparison
to the current activity of the system.
Now the problem with behavior-based analysis
or behavior-based monitoring is that it tends
to result in a lot of false positives
because there's a large number of applications
and lots of different relationships
between those applications.
If you think about your computer,
how many different applications are installed?
And how many ways do they talk to each other?
You probably have Word, and PowerPoint, and Excel
and Chrome, and Firefox and maybe Outlook.
And probably 50 or 60 other applications.
For you to be able to create a good baseline
for all those applications would take time.
And because that's usually not done well,
behavior-based tends to be a lot of false positives
because people don't configure it properly to begin with.
The one that has the least false positives
is signature-based.
Anomaly-based has a little bit more
and then behavior-based has a lot more.
So that's the three types of methods we can use,
and these methods don't have to be used in isolation.
Often times, in an intrusion detection
or intrusion prevention system,
we're actually going to combine them into a hybrid approach.
So maybe I'm going to use anomaly-based detection
and signature-based detection,
and that give me two different ways of capturing traffic
for further analysis.
Now, that's the beginning of this section.
Now that we've got the basics covered of monitoring,
let's dive a little bit deeper in the next lesson.