Tag: Detect

There are network anomaly detection technologies to alert abnormal network traffic of potential cyberattack. The pre-requisite is let the technology learn the current network traffic pattern as baseline profile. Then anything outside this profile boundary will be treated as anomalies and triggers alert. It is a great technology - no signature or definition update for zero TCO maintenance. All are self-sustained. However, the key question is how long should the technology acquire the correct baseline profile? Some vendors claim just one or two weeks suffices. Really? Even with 80/20 rule, such short duration shall generate many false alerts that eventually affecting confidence. Realistically, duration in a year for setting up the baseline profile deems necessary to fully cover the normal traffic. After all, human perception especially senior management is important for successful deployment. A KPI dashboard shall provide visibility of the value of the technology. Last but not the least, network anomalies detection is just one layer of defense. We should strengthen...

Earlier, I talked about network anomaly detection. It is the kind of technology based on the past activities to predict if your network is healthy and normal. Key considerations to evaluate for deployment: The "past" activities must be correctly understood by the technology in the first place as the baseline reference Using a typical life cycle management concept, the algorithm must be intelligent enough to manage the entire suite of new, change, delete use cases of network traffic without too much false negative nor false positive Predict "new" traffic deviated from the baseline with different severity level per intention Whether the algorithm is equipped with deep packet inspection (or even better with machine learning capability) to inspect expected connections with different payload from baseline Report missing traffic from baseline that could be sign of malfunctioned field device(s) to the host or controller Challenges are: Competency and capability of the deployment team to understand your environment Criteria to sign off as project completion from...

In cyber world, logging is fundamental to track electronic activities for problem shooting or digital forensics. With device proliferation especially in the IoT domain, substantial logging volume is generated making log review a hard time. The SIEM (Security Information Event Management) technology has surfaced to relax this tedious task.  It consolidates and associates event logs and picks out "interesting" scenarios for automated action or human alert. The challenges are: What types (or level, e.g. brief, detail, info, warning, critical) of logging are available and required: platform, infrastructure, application ... Context of log data: time of day, time zone, IP address, user identities, machine names, machine address ... How to ships the logs from different network zones to the central SIEM without breaking network zoning Clock source to sync across all these network zones Algorithm of event correlation (human define or machine learning) Criteria to automate alert with confidence (false negative or false positive will ruin the trust) Most importantly, logging must comply with...