WIXLIB

Cyber Security Monitoring and Logging Guide Learn how to carry out cyber security logging and monitoring in a more effective manner – leveraging industrybest practice Understand the key concepts of cyber security monitoring and logging (eg. drivers, definitions, approaches).This guide builds on a similar report produced by CREST to help organisations prepare forcyber security incidents, respond to them effectively and follow them up in an appropriatemanner. That report, together with a summary of CREST activities can be found at:http://www.crest-approved.orgProject researchThe research project included: Performing desktop research on many different sources of information Conducting telephone interviews with key stakeholders, such as CREST members and clients Undertaking site visits to expert organisations running Security Operation Centres (SOC) on behalf of their clients Analysing results from 66 organisations to a detailed project questionnaire Running 2 large workshops where experts in cyber security response services from more than 30 organisationsdetermined the scope of the project, validated the findings of this Guide and provided additional specialist material Working with the authors of the Effective Log Management report produced by the CPNI and Context.Profile of respondents to requirements surveyA survey was conducted, primarily aimed at consumer organisations, to help determine project requirements.66 responses were received in total, from a wide range of types and sizes of organisation, as shown in thechart below.In which of the following market sectors does this part of yourorganisation operate?GovernmentITOtherUtilities (eg gas, wateror telecoms)InsuranceOther tailPharmaceuticals05101520High level analysis of the profile of respondents revealed that: Over half of them were either large or very large The number of gateways (eg. web or email) into organisations was well spread from less than 5 to more than500, 40% having between 11 and 100 One third of them had over 100 servers, another third over a thousand More than 40% had over 5,000 client computers Nearly 45% had over 1,000 smart phones/tablets, with nearly 20% having more than 5,000.Key: Respondents gave an answer to most questions (some were free format text), with responses rangingfrom 1 (Very Low) to 5 (Very High). Results are presented as charts or tables throughout this Guide, typicallyshowing the average rating across all respondents (eg. 3.29 out of 5).9

Part 2Setting the sceneCyber Security Monitoring and Logging GuideOverviewCreative, talented and aggressive attackers continue to drive the threat world into new areas. The cyber security threatlandscape continues to evolve, with new and innovative attack methods being able to adapt to their chosen targetenvironment(s).Cyber security incidents – including sophisticated cyber security attacks - can and do occur in many different ways. Therisks to your organisation from cyber security incidents are real, with cyber security attacks now regularly causing significantdamage to the performance and reputation of many different organisations.One of the main ways you can deal with suspected or actual cyber security incidents is to record cyber security-related events,monitor them on a continual basis, and investigate suspected cyber security breaches thoroughly, remediating any issues.However, many organisations have vastly insufficient logging, archiving, correlation and simulation capabilities. This is oftenbecause of a range of significant challenges face them when it comes to implementing an appropriate cyber security monitoring and logging capability. Your organisation may therefore need practical guidance to help with monitoring the relevantevents on your systems and networks for signs of a cyber security attack.Defining a cyber security incidentThere are many types of incident that could be classified as a cyber security incident, ranging from serious cyber securityattacks and major organised cybercrime, through hacktivism and basic malware attacks, to internal misuse of systems andsoftware malfunction.However, project research has revealed that there is no one common definition of a cyber security incident. The two mostcommon (and somewhat polarised) sets of understanding – as shown in Figure 3 below - are either that cyber securityincidents are no different from traditional information (or IT) security incidents – or that they are solely cyber securityattacks.Traditional information(or IT) security incidents are: Small-time criminalsCyber security attacks Individuals or groups just‘having fun’ Serious organised crime Localised or communityHacktivists Insiders State-sponsored attackCYBERSECURITYINCIDENTS Extremist groupsFigure 3: Different types of cyber security incidentsThe main difference between the myriad types of cyber security incident appears to lie in the source of the incident (eg.a minor criminal compared to a major organised crime syndicate), rather than the type of incident (eg. hacking, malwareor social engineering). Therefore, it may be useful to define cyber security incidents based on the type of attacker, theircapability and intent.At one end of the spectrum come basic cyber security incidents, such as minor crime, localised disruption and theft.At the other end we can see major organised crime, widespread disruption, critical damage to national infrastructureand even warfare.10

Cyber Security Monitoring and Logging Guide!Capability and intent is what makes both detecting and responding to attacksfrom well-resourced organised crime/state-sponsored attackers different and moredifficult than ‘traditional’ incidents.The main focus of this Guide is to help you monitor indicators of possible cyber security attacks, but it will also beuseful for monitoring traditional information (or IT) security incidents.Details about how to prepare for, respond to and follow up cyber security incidentscan be found in the CREST Cyber Security Incident Response Guide, available fromCREST at http:// www.crest-approved.orgTypical phases in a cyber security attackCyber criminals innovate just as business does and the potential rewards for them grow as business use of cyberspacegrows. They have access to powerful, evolving capabilities which they use to identify, attack and exploit carefullychosen targets. They also have well-developed marketplaces for buying and selling tools and expertise to executesophisticated attacks.!Well-resourced attackers, sufficiently motivated by their target, will often innovateand evolve their methods during a single attack, trying different techniques untilsomething works. Evolution and innovation in ‘traditional’ attacks happens moreslowly, with new techniques evolving over time between waves of attack.For example, in traditional attacks, new variants of malware are released withinweeks/months (after many systems have been patched/AV protected). In contrast, insome state-sponsored attacks, the attackers re-compile their malware several times aday to overcome responsive actions taken.When looking at a cyber security attack in more detail there are often a number of phases that attackers willundertake, which can sometimes take place over a long period of time. An example of the basic componentsof such a phased approach is outlined in Figure 4 on the following page, together with some of the commoncountermeasures for each phase.11

Cyber Security Monitoring and Logging Guide123Carry out reconnaissance Identify target Look for vulnerabilitiesCountermeasures Monitoring (and logging) Situational awareness CollaborationAttack target Exploit vulnerabilities Defeat remaining controls Solid architectural system design Standard controls Penetration testingAchieve objective Disruption of systems Extraction (eg of money, IPR orconfidential data) Manipulation (eg adding, changing ordeleting key information Cyber security incident response Business continuity and disasterrecovery plans Cyber security insuranceFigure 4: Typical phases in a cyber security attackWhen dealing with a sophisticated cyber security attack, it is important to address all stages carried out by an attacker, bethey cybercriminals, extremists or state-sponsored agents. However, many organisations do little or nothing before phase 2(or even phase 3) of an attack, often because they do not have the awareness, resources or technical skills to tackle issuesduring the reconnaissance stage.!A great deal of monitoring and logging activity is not undertaken until phase 2 oreven phase 3 of an attack. Furthermore, phase 2 is often broken down into multiplesub-stages that can take place over minutes, hours or months.Key value from monitoring at this stage is to detect potential security incidents asearly as possible and before phase 3.Addressing the first phase is critically important and involves a number of preventative measures, scenario developmentand rehearsal; and the need for extensive collaboration. It is also one of the main focuses of cyber security monitoring andlogging, which is explored in the remainder of the Guide.Monitoring indicators of compromise (which can identify potential cyber securityincidents) are covered in Part 5 Cyber security monitoring process.12

Cyber Security Monitoring and Logging GuideMain cyber security monitoring and logging challengesLog files and alerts generated by IT systems often provide a vital audit trail to identify the cause of cyber securitybreaches and can also be used to proactively detect security incidents or suspicious activity that could lead to a cybersecurity incident.“You can’t just add things to current security monitoring and logging solutions, you need to bakethem into the development or implementation processes”However, respondents to the Project Survey reported that there were many cyber security monitoring and loggingchallenges facing them (most of which can be addressed using this Guide), as shown in the chart below.What level of challenge does your organisation face in being able to:Have the right tools, systems or knowledge to investigate cybersecurity incidents?Identify critical interdependencies between systems, networks andinformation flows?Define ‘normal’ system and network behaviour?Set clear goals for your cyber security monitoring andlogging capability?Work out how threats to your critical assets can best be monitored?Analyse cyber security threats and associated vulnerabilities?Identify the benefits of cyber security monitoring and logging?Deal with legal difficulties across borders?Define what your critical assets are, where they are and who isresponsible for them?Gain a good understanding of network infrastructure, includingcyber ‘touch points’?Take a risk-based approach to your cyber securitymonitoring and logging?Deploy other complimentary technical controls (eg patching andmalware protection)?2.62.72.82.93.03.13.23.33.43.5Cyber security monitoring and logging maturityThere was a big variation in the level of maturity respondents to the Project Survey believed that their organisationshave for different cyber security monitoring and logging activities.What level of maturity does your organisation have for the following cyber security monitoring andlogging activities?Very lowLowMediumHighVery highLogging all necessary cyber security related events9%12%30%21%23%Collating and analysing logs12%18%30%17%21%Using threat intelligence14%9%35%21%15%Identifying suspected (or actual) cyber security incidents8%14%32%20%21%Responding to cyber security incidents6%12%38%20%21%Respondents showed greater maturity in cyber security monitoring and logging than in the identification andanalysis of unusual events – which is the focus of this project.13

Cyber Security Monitoring and Logging Guide!Many respondents seemed to believe that their organisation was more mature in cybersecurity monitoring and logging than their responses to the rest of the Project Surveywould indicate, showing that there is still a strong need for awareness in this area.Standards and guidelinesThere are many standards that specify (or allude to) requirements for cyber security logging (but very few about cybersecurity monitoring), which include: 10 Steps to Cyber Security and the Cyber Security Essentials from CESG ISO 27002 - Section 12.1 Logging and Monitoring PCI DSS V3.1, particularly:o Part 10. Track and monitor all access to network resources and cardholder datao Part 11. Regularly test security systems and processes The SANS 20 Critical Controls for Effective Cyber Security Defence particularly:o Control 14 – Event logging The NIST 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems andOrganizations as part of a directive from the Federal Information Security Management Act (FISMA).“Being fully compliant with standards is still likely t

1. Develop a cyber security monitoring and logging plan 2. Carry out prerequisites for cyber security monitoring and logging 3. Identify sources of potential indicators of compromise 4. Design your cyber security monitoring and logging capability 5. Build or buy suitable cyber