Even if you take all available precautions, there’s still a chance your system will be compromised by a new or unknown attack. To give yourself the best chance of spotting these attacks, you should be well positioned to detect compromise.
4.1 Collect all relevant security events and logs
Having the right data is essential. This is true whether you want to be well prepared for analysis in event of a breach, or if you want to detect potential and actual compromises in real-time.
As well as collecting logs and capturing relevant events, you should ensure that the integrity of your logs would be maintained in event of a breach.
The attacker should not be able to cover their tracks.
4.2 Design simple communication flows between components
A well thought-out design, with clearly defined and tightly constrained communication between components, can simplify security analysis and enable you to identify when something is amiss. Components attempting to communicate in ways which are not part of your design can be a strong indication of compromise. Configure your monitoring tools to detect these indicators and automatically raise alerts.
4.3 Detect malware command and control communications
Watch for attempts by compromised components to contact their command and control infrastructure. This can be achieved by allow listing external domains, or addresses that are acceptable for data egress. Attempts to reach other domains should be prevented and reviewed.
4.4 Make monitoring independent of the system being monitored
This ensures that if the system being monitored is compromised, the attacker will have no visibility of whether the breach has been detected.
The same principle holds true for cyber-physical control systems (such as industrial control systems), where telemetry and control channels should be kept independent if it is critical to know how a system is behaving, irrespective of an attacker's actions.
4.5 Make it difficult for attackers to detect security rules through external testing
If user activity causes one of your security rules to trigger, ensure you only give the minimum user feedback necessary.
This makes it more difficult for an attacker to understand your security logic when trying to map out your defences.
4.6 Understand 'normal' and detect the abnormal
Knowing how your systems normally operate means that unexpected behaviour can be recognised.
In addition to designing simple communication flows between components, it can be useful to monitor network load, storage I/O, compute performance, or transaction activity, to help you understand when your system is behaving abnormally.
Whilst this information is useful for optimising system operations, it could also provide potential indications that an attacker is attempting to compromise your systems, or that a breach has occurred. Ensure that anyone monitoring your systems knows what 'normal' should look like.
