[Autogenerated] we're going to skip over pan testing, right?
And talk about the other two requirements in
requirement and are two search requirements.
So IDE s and file integrity want to right,
a za ancestor again, these error, these error,
these error detective controls there because it's not IOPS and ideas.
So tell me what you look at when you go to do an assessment.
Sure.
So when I look at something like intrusion detection,
right, it could be network or host based,
Right?
Right.
Uh, you know, when it's network based, write the requirements,
talk about, you know, at the perimeter and a critical points.
So I want to see where is the sensor looking for intrusions, right.
Uh, and then how is that?
How is that being managed?
Right, if it's a physical device, right,
which is increasingly sort of not the case,
but still, every now and again, how is that device being managed?
Right?
How is it getting, you know, signature updates or or things like that, right.
How is how is it configured to watch for,
uh, you know, potential adverse traffic?
Right?
And if that's being managed by a third-party,
maybe then my client doesn't have much visibility of the devices is a black box,
right?
Uh,
but then I want I want to see something from the
service provider that's offering that, you know,
showing me something about how it's how it's how it's working,
right.
But you gotta test it.
Try and you're going to try and be an intruder and see if it detects.
So I'm not going to necessarily expressly do that in
the course of my assessment work, right?
I may say, Show me, you know,
like with your pen test look like from an intrusion detection standpoint,
right?
And maybe the ideas was white listing the pen testing effort.
Um, you know,
or or white listing some vulnerability scans just so
it doesn't generate a lot of noise.
But But there there's very often some opportunity to say here,
with some event that's already happened,
that I don't have to do create that should have yielded some
some output from your intrusion detection,
You know, show me what you got because you're testing requirements.
Just examine configurations.
Basic Muslim, right.
Well and again, what do you do when you get an alert?
Right.
How do you respond to a potential intrusion And,
you know,
if you can't have you can't show me that you've got some meaningful process
there that you've got some intelligence behind how to respond,
You know that we have a problem.
Thin.
So Right, so which is the final one?
So this is interesting.
I mean, the PC I language sort of updated.
It used to say file integrity monitoring expressly.
And now it has changed detection, right?
So e conventional film still qualifies is change detection.
So if you've been doing that all along, Okay, Carry on.
Uh, there are potentially other ways to approach that.
If you're looking for change detection,
maybe that's like some sort of application white listing or something like that
to say I only allow these things to work the way they were.
Maybe not application white listing and its conventional sense,
but, uh, some sort of restrictive capacity on important files,
right?
To prevent them from being modified.
Now, the common struggle is here.
I see a lot of organizations use, you know,
a handful of relatively popular tools, Uh,
very often just sort of installing it and then not even looking at,
like, the configuration file, right.
And if it's not focused on what's important.
Not just for your organization, but for that host.
Right then you sort of missed the boat, right?
Uh, if it's a Web server, right, you should be.
You should be looking specifically at the Web server
binaries at the Web server configuration file,
Uh, at at, you know, the web content of static content stuff,
right?
The JavaScript, you know, or whatever other stuff that you put their,
uh, you know, to make that web server do its job.
Because if we think about the recent breach of a big airlines
exactly how they have been looking at those JavaScript files
IT that would have been detected, throw it away,
it would have.
But what I read about that particular incident was that they had a
third-party essentially crawling there website and doing def SSHD
off site content over periods of time, right?
And so that that third-party found a change in the site, right?
You know,
a tiny little 11 line bit of JavaScript that was that was different from from
the last time they scanned it and they looked at it and said,
That's not right.
I actually think now for that JavaScript attack.
You need internal thin.
You also need some that's not understand,
which is external external change detection.
Well,
and so I think you could You could make the argument that that
sort of service was providing change detection?
Absolutely.
For that website.
Now,
that kind of external service isn't necessarily going to be
providing changed section for your hosts.
That error not exposed to the internet.
So you know that won't that won't do it for your
necessarily your whole environment.
But if you're saying, hey,
I've got a service like that that goes and crawls on my
site content every day and then gifts looking for
variances and then alerts me on those.
Sure.
Yes, do that.
Absolutely.
Do that.
Do that as well As have something internet, right?
Right.
And then particularly for your internal hosts.
Right.
Then you need some other kind of change detection mechanism.
But I think if you if you're not thinking about what this is intended to do,
right and you're not tuning it, you're missing a lot of important stuff.
Yeah, I mean, from my perspective, I recently employed film somewhere,
but the film was brilliant because it also did
requirement to for us eso the film.
The film had the CSS hardened builds loaded into it.
So it checked that'll the house work correctly
configured against the CSS building, showed us showed us where it wasn't right.
And then every time the CSS bill gets updated,
the fin till tells us you're running out of sync.
Now,
with CSS hardened built So it was doing fine integrity monitoring
on harden build monitoring at the same time.
So we got double the money, double the benefits for same money, right?
And there's some utilities that will do essentially file integrity,
checking and also essentially host based,
you know, hits.
Yeah, right.
So, yeah,
you can deploy one tool and maybe cover a couple of
different requirements that way.
Eso Yeah.
There's a lot of benefit to like thinking about how to make the best use of
your tools a za necessity Come back with second year.
What do you What are you looking for?
To make sure that film is working properly?
What I what I have found is again They always You know,
that guy that was watching the store sort of left okay.
And we didn't replace that person.
So the FIM administrator, right?
Right.
Or the person dealing with the alerts, right?
Or, you know, again, they're not bothering to configure it appropriately.
And then they have, you know, 70 more hosts than it did last time.
And they just dropped the stock config.
I tell my client I harp on this a lot because I see this as a as a regular,
sort of falling down kind of point.
I tell my clients,
start thinking about categories of device that merit
different configuration types.
You know, we have web servers.
So here's how we do integrity checking for web servers,
right-click database service.
Here's how we do integrity checking for database services.
We have other kinds of house.
Okay, so we do that right.
And you know, most of my clients error to roll my eyes like,
you know, show me where in the DSS It says those words exactly.
Right.
And e mean it doesn't, but come on, use your head right