All
right, let's take a look at Module 17, which is going to deal with network
traffic monitoring, which is going to be is a bit of an extension of our
discussion for Module 16, where we talked about network troubleshooting.
So a couple of the topics we saw in the previous module are going to come back,
and you'll have a little bit more in depth lab, especially on tools like Wireshark.
All right, so network traffic monitoring.
First and foremost, network monitoring
is a retrospective security approach that involves monitoring a network for abnormal
activities, performance issues, bandwidth issues, etc.
So monitoring is capturing packets, real time, post mortem, but you're actually
monitoring live data flows through the network.
And the reason you're doing that would be for purposes like forensics, performance
issues, bandwidth issues, detecting malicious activity, etc.
So primarily network monitoring tools like Wireshark, you're not going to necessarily
be sitting in front of that console watching it real time.
We're going to be having some analysis
engine that's going to alert us when we see suspicious activity.
So that's where the IDS, IPS comes in.
So IDS, IPS, from our earlier discussions, really are at the most basic form of
packet logger, and then they analyze those packets that they capture.
Network monitoring is an integral part of
security, demanding tasks within the network security operations organizations.
Continuous network monitoring analysis are required for effective threat detection,
but you're not necessarily going to be capturing and archiving everything.
That'd be a tremendous amount of data.
The need for network monitoring.
Even with security tools in place, attackers find ways around it.
That's what they do.
It's a constant cat and mouse game.
We learn about how the attackers work, we detect them, they find more creative ways
to bypass our detection mechanisms, and the wheel goes round and round.
We talk about threat hunting as a great
example of intrusions that have already bypassed security perimeter.
We've got our front guards at the front gate.
If they get bypassed, we still need to do internal monitoring.
Kind of enough said there.
Security tools generally use signature based detection techniques.
We've talked about the problems with signature based detection.
You have to tell the system specifically what to look for, which means we have to
have seen it before, we have to practically plan for it, and we can't
possibly hope to have signatures for absolutely everything.
That's again why anomaly and heuristics, AI machine learning are valuable.
Security tools are generally not designed to identify behavioral anomalies or unable
to detect activities of attackers initiated before and during an attack.
Anomalies are a great mechanism conceptually.
If something abnormal is happening, it should be investigated.
It may or may not be malicious, but
anomaly is a variation from normal baseline.
So if something malicious is happening,
chances are it doesn't happen every day, it doesn't show in sampling sets or
intervals, and anything that's anomalistic should be investigated.
Now, again, we've already talked about false positives and false negatives and
all that fun stuff in fine tuning your systems for anomaly detection.
Our advantages of network monitoring.
Understanding how data flows in a network, optimize network performance, avoiding
bandwidth bottlenecks, detecting signs of malicious activity, finding unnecessary
and vulnerable applications, and investigating security breaches.
And again, that's just the short list.