-: We've already mentioned the word baselining
several times throughout the course,
but now we're going to take some time to formally define it
and explore that concept a bit more
because it's really important in the world of monitoring.
First, what is a baselining process?
Well, it's a process of measuring changes
in networking, hardware, software, or applications.
If we know what the baseline is, what is normal,
we can then see what is abnormal.
Now, baselining our network is really important
because it's going to define what normal is.
By defining what normal is,
it allows us to monitor for changes
and report on those changes
whenever we find something that's anomalous or abnormal.
This brings us to the concept of baseline reporting.
Baseline reporting is the process
of documenting and reporting on the changes
that you find in a baseline.
So if I said that this computer was a Windows 10 machine
with these five apps on it,
and now you find that there are six apps,
that is something we'd have to report
because it's outside the normal baseline.
We also have a baseline for the system that we create
as part of our security posture.
Now a security posture is basically the risk level
to which a system or other technology element
is going to be exposed.
This type of baselining is usually tied up
in the concept of configuration management,
and the patch levels that we use,
and the programs we install,
and the way we configure our devices
all are down in an effort to meet a certain risk level
we want to meet or a certain security posture.
If it's a server and we want to have it as a low-risk server,
we're going to have to make sure everything is fully updated
and we control specifically every application,
every port, and every configuration item inside that server.
Now if I'm dealing with your mobile phone,
I may be willing to accept a higher risk level,
and I don't care if you're
going to install Angry Birds on it or not.
That might be something that I'm going to allow to happen,
and even though that might put me in a higher risk level,
that's okay because it matches the security posture
for that particular device.
Now this lesson was called Performance Baselining,
why is that?
Well, it's because performance baselining
is one of the most common types of monitoring
that you're going to find in your organization.
With performance baselining,
we're really focused on operations and functionality.
So, it's not as much of a security issue
in most organizations.
We're looking at how much are the processors being used?
How much is the network bandwidth being used?
How much disk space is being used?
All of that stuff is performance baselining.
But, in security, it's also important
to look at this stuff.
Why is that?
Well, if you start seeing a processor
that's being overtaxed and it's using a lot of resources,
it may be not that here's an additional load coming in,
but it may be that you have malware on that machine.
That's something that's going to be an indicator
that you would then investigate.
So again, having that normal baseline
and then seeing what is abnormal,
what are those spikes?
That is where we're going to investigate
and go, why are we seeing those spikes?
So as you can see here on the screen,
this technician has his finger on one of those spikes,
and we would look at that time of day
and go, why is there a spike in network traffic?
Is somebody trying to steal our files?
If that spike happened at three in the morning,
I would want to know why.
If it happened at noon, I can probably guess why.
People are sitting at their desk and playing on Facebook
because it's lunch time.
So again, looking into those things that are anomalous
and outside the normal band
will allow you to figure out what is normal,
what is not, and what is a security risk
and what is not.
Now to do performance monitoring,
you can do this lots of different ways.
One of the ways that most people use
is a tool called Performance Monitor.
It's a tool in Windows that you can use
to monitor the performance
of an individual server or workstation.
You can check things like
the processing power being utilized,
the amount of memory being utilized,
the amount of disk space,
the network utilization, and other things like that.
You can also set it up to create reports for you
and then get those off and compare those in the future.
Now, to get this tool, you're going to use Perfmon.exe,
which is the Windows program for the performance monitor.
If you go to a command prompt
and type in Perfmon and hit enter,
it will bring up the performance monitor
and you can see how your system is currently performing.
Now the performance monitor and other tools
will allow you to also create reports,
as I mentioned before.
This is useful to go back and analyze the details afterwards
to see what was going wrong,
but it's not going to be useful in real time.
Instead, you need to set up proper alerts
and notifications so you get an instant notification
to an administrator when some predefined thresholds
are breached by the system.
For example, you might say that anytime
the server starts going over 80% utilization,
the administrator should be notified.
Or, anytime the network utilization goes over 95%.
Whatever those thresholds are in your organization,
you're going to have to define that.
But once you have those set,
you can then figure out what it is,
and you're going to be notified
so you can look into those things
that become anomalous events
to figure out if it's an issue
or if it's normal operations.
(electronic tones)