Continuous Monitoring Overview

Defined

Network Security Monitoring (NSM)

Continuous Security Monitoring (CSM)

Continuous Monitoring and the 20 Critical Security Controls

Network Security Monitoring (NSM)

Evolution of NSM

The NSM Toolbox

NIDS Design

Analysis Methodology

Understanding Data Sources

Full Packet Capture

Extracted Data

String Data

Flow Data

Transaction Data

Statistical Data

Alert Data

Tagged Data

Correlated Data

Cloud NSM

Practical NSM Issues

Cornerstone NSM

Service-Side and Client-Side Exploits

Identifying High-Entropy Strings

Tracking EXE Transfers

Identifying Command and Control (C2) Traffic

Tracking User Agents

C2 via HTTPS

Tracking Encryption Certificates

Security Architecture – Endpoint Protection

Anti-Malware

Host-based Firewall, Host-based IDS/IPS

Application Control, Application Virtualization

Privileged Accounts, Authentication, Monitoring, and UAC

Virtual Desktop Infrastructure

Browser Security

EMET and Defender Exploit Guard

Patching

Process

To Test or Not to Test

Microsoft

Third-Party

• Overview
  • Continuous Security Monitoring (CSM) vs. Continuous Diagnostics and Mitigation (CDM) vs. Information Security Continuous Monitoring (ISCM)
  • Cyberscope and SCAP
• Industry Best Practices
  • Continuous Monitoring and the 20 CIS Critical Security Controls
  • Australian Signals Directorate (ASD) Strategies to Mitigate Targeted Cyber Intrusions
• Winning CSM Techniques
• Maintaining Situational Awareness
• Host, Port, and Service Discovery
• Vulnerability Scanning
• Monitoring Patching
• Monitoring Applications

• Monitoring Service Logs

  • Detecting Malware via DNS logs
• Monitoring Change to Devices and Appliances
• Leveraging Proxy and Firewall Data
• Configuring Centralized Windows Event Log Collection

• Monitoring Critical Windows Events

  • Hands-on: Detecting Malware via Windows Event Logs
• Scripting and Automation
  • Importance of Automation
  • PowerShell
  • DeepBlueCLI
  • Hands-on: Detecting Malicious Registry Run Keys with PowerShell