Introduction

This chapter covers the fourth objective in Domain 4.0, Security Operations of the CompTIA Security+ exam.

In this chapter, we will examine monitoring computing resources, paying particular attention to the system, appliances, and network security infrastructure. We’ll further explore alert activities, including log aggregation, alerting, scanning, reporting, and archiving, as well as response and remediation. The final sections will consider tools such as SCAP, SIEM, SNMP, and the Data Loss Prevention (DLP) tool that monitors the flow of data running through our network.

This chapter will give you an overview of why companies rely on these processes to keep their environments safe and ensure you are prepared to successfully answer all exam questions related to these concepts for your certification.

Note

A full breakdown of Exam Objective 4.4 will be provided at the end of the chapter.

Monitoring Computing Resources

Security alerting and monitoring is a proactive approach to safeguarding digital assets and sensitive information, and involves the continuous observation and analysis of various aspects of a computing environment to identify and respond to potential security threats in real time.

The goal is to minimize the risk of data breaches, unauthorized access, and system vulnerabilities by regularly and closely reviewing the following:

• Log files: Log files are text files that reside on every device, recording events as they happen. They contain a wealth of information about system events, errors, user interactions, and security incidents, acting as an audit trail by which an event can be tracked. They therefore serve as a valuable resource for troubleshooting, anomaly detection, and security breach prevention. An example log file can be found in Figure 17.1:

Figure 17.1: Log file

As you can see, this log file shows...

Activities

In the ever-evolving world of cybersecurity, effective defense strategies are paramount. Cyber threats are becoming more sophisticated, and staying ahead of malicious actors requires a well-orchestrated approach. Five core activities form the backbone of cybersecurity operations: log aggregation, alerting, scanning, reporting, and archiving. In this section, we’ll explore each of these activities and their indispensable roles in securing digital landscapes:

• Log aggregation: Log aggregation is the process of collecting and centralizing logs from various sources within an organization’s IT infrastructure. Logs are records of events and activities that occur on systems, networks, and applications. These logs are invaluable for security teams as they provide real-time insight into what is happening within the environment. Log aggregation enables security professionals to correlate events, detect anomalies, and identify potential security breaches. Security...

Alert Response and Remediation/Validation

Alert response and remediation/validation encompass more than just threat detection. They also serve as the alarm system for the Security Operations Center (SOC), prompting them to take necessary measures to prevent potential attacks. This section delves into the topics of quarantine and alert tuning, shedding light on their significance and key components:

• Quarantine: Quarantine is a proactive security measure that involves isolating potentially compromised systems or devices from the network to prevent them from further infecting or compromising other network assets. Quarantine can be applied to endpoints, servers, or network segments, and it’s often used in response to alerts indicating potential malware infections or suspicious activity. Key factors of quarantine include the following:
  • Automated response: Security tools can be configured to automatically quarantine systems when specific conditions or alerts are triggered.
  • Manual...

Tools

Tools are required for the security of an organization as the different types of threats emerge. In the following section, we are going to look at some tools that are essential for cybersecurity analysts. The Security Content Automation Protocol (SCAP) framework is particularly essential for ensuring that computers and networks are not only compliant but also aim to adhere to the highest standards of security configurations. By implementing SCAP, organizations can significantly streamline their vulnerability management processes, leading to a more secure and resilient IT infrastructure.

Security Content Automation Protocol (SCAP)

SCAP is a framework that enables compatible vulnerability scanners to assess whether a computer adheres to a predefined configuration baseline. Further information on SCAP can be found at https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/xccdf.

SCAP employs a range of components to carry out this task, with some...

Summary

This chapter covered monitoring and alerting methods and their importance to network security. This included tools such as SIEM systems, vulnerability scanners (which use the CIS Benchmarks as well as monitoring the network for missing patches and software flaws to keep their servers secure), SNMP (which provides states and reports of network devices), and DLP tools, which prevent PII and sensitive data from leaving the network.

The knowledge gained in this chapter will prepare you to answer any questions relating to Exam Objective 4.4 in your CompTIA Security+ certification exam.

The next chapter of the book is Chapter 18, Given a scenario, modify enterprise capabilities to enhance security.

Exam Objectives 4.4

Explain security alerting and monitoring concepts and tools.

• Monitoring computing resources: Continuously observing and analyzing the performance and status of computing resources
  • Systems: In the context of monitoring, this refers to overseeing the operations and performance of individual components
  • Applications: Tracking the performance, availability, and usage of software programs
  • Infrastructure: Monitoring of the hardware, software, networks, and facilities required for IT operations
  • Activities: Observation and analysis of actions or events occurring within a computing environment
• Log aggregation: Collecting and consolidating log data from multiple sources
  • Alerting: Notifications or alarms in response to events
  • Scanning: Examining networks, systems, or applications to identify security weaknesses
  • Reporting: Creating and disseminating summaries of alerts and scans
  • Archiving: Storing historical data securely
  • Alert response and remediation/validation: Reacting...

Chapter Review Questions

The following questions are designed to check that you have understood the information in the chapter. For a realistic practice exam, please check the practice resources in our exclusive online study tools (refer to Chapter 29, Accessing the online practice resources for instructions to unlock them). The answers and explanations to these questions can be found via this link

1. Your antivirus software scans a file and reports that it is free from malware. However, upon closer examination, it is discovered that the file does, in fact, contain a previously unknown malware variant. What type of result does this scenario represent?
   1. True positive
   2. False positive
   3. True negative
   4. False negative
2. Your organization is integrating a new system into its existing network and wants to ensure that the new system is secure before putting it into operation to protect the network and sensitive data. What is the MOST IMPORTANT security measure to take before putting the new...