-
security audit
an independent review and examination of a system's records and activities to determine the adequacy of system controls, ensure compliacne with established security policy and procedures, detect breaches in security services , and recommend any changes that are indicated for countermeasures
-
security audit trail
a chronological record of system activities that is sufficient to enable the reconstruction and examination of the sequence of environments and activities surrounding or leading to an operation, procedure, or event in a security-relevant transaction from inception to final results
-
event discriminator
logic embedded into the software of the system that monitors system activity and detects security-related events that it has been configured to detect
-
audit recorder
for each recorded event the event discriminator transmits the information to _______ , often in the form of a message or by recording the event
-
alarm processor
takes some action based on the alarm (which is auditable)
-
security audit trail
stores a formatted record of each event created by the audit recorder
-
audit analyzer
based on a pattern of activity, may define new auditable events which are sent to the audit recorder and may generate an alarm
-
audit archiver
a software module that periodically extracts records from the audit trail to create a permanent archive of auditable events
-
archives
a permanent store of security-related events on a system
-
audit provider
an application and/or user interface to the audit trail
-
audit trail examiner
an application or user who examines the audit trail and the audit archives for historical trends, for computer forensic purposes, and for other analysis
-
security reports
human-readable reports prepared by the audit trail examiner
-
audit trail collector
a module on a centralized system that collects audit trail records from other systems and creates a combined audit trail
-
audit dispatcher
a module that transmits the audit trail records from its local system to the centralized audit trail collector
-
audit trail collector
audit dispatcher
two additional logical components needed for a distributed auditing service
-
event discriminator
audit recorder
alarm processor
security audit trail
audit analyzer
audit archiver
archives
audit provider
audit trail examiner
security reports
key elements of a Security Audit and Alarms Model
-
data generation
event selection
event storage
automatic response
audit analysis
audit review
six major areas of security auditing functions
-
data generation
identifies the level of auditing, enumerates the types of auditable events, and identifies the minimum set of audit-related information provided
-
event selection
inclusion or exclusion of events from the auditable set that helps to avoid the creation of an unwieldy audit trail
-
event storage
creation and maintenance of the secure audit trail - includes measures to provide availability and to prevent loss of data from the audit trail
-
automatic response
defines reactions taken following detection of events that are indicative of a potential security violation
-
audit analysis
provided via automated mechanisms to analyze system activity and audit data in search of security violations - uses anomaly detection and attack heuristics
-
audit review
as available to authorized users to assist in audit data review - may include a selectable review function, and may be restricted to authorized users
-
system-level audit trails
application-level audit trails
user-level audit trails
physical access audit trails
categories for audit trail design
-
system event log
applications event log
security event log
three types of Windows event logs
-
system event log
used by applications running under system service accounts (installed system services), drivers, or a component or application that has events that relate to the health of the computer system
-
application event log
events for all user-level applications - is not secured, and is open to any applications
-
security event log
the Windows Audit Log - for exclusive use of the Windows Local Security Authority
-
interposable libraries
dynamic binary rewriting
two approaches to collecting audit data from applications
-
after an event
periodic review
real-time audit analysis
timing options of when an audit trail analysis is to be done
-
basic alerting - software gives indication that an event has occurred
baselining - normal vs. unusual events
windowing - detection of events within a set of parameters
correlation - seeks for relationships among events
four major approaches to data analysis
-
thresholding
a form of baseline analysis - the identification of data that exceed a particular baseline value - used to identify events, such as refused connections
-
windowing
detection of events within a given set of parameters, such as within a given time period or outside a given time period
-
Security Information and Event Management system
SIEM
-
Security Information Management system
SIM
|
|