Perimeter
1/4/2013
03:40 PM
Wendy Nather
Wendy Nather
Commentary
Connect Directly
RSS
E-Mail
50%
50%

You Keep Using That Word ...

When monitoring doesn't mean what you think it does

I don't like to get all "me too" on a topic, but I really enjoyed the back and forth on Richard Bejtlich's blog as Bejtlich and commenters discussed what "monitoring" means. It's pretty clear that everyone's using the word, but they're differing on the purpose of the monitoring itself.

One of the use cases I see often is "monitoring for risk." Now, risk is a slippery word in and of itself, as the squabbling on risk analysis mailing lists can demonstrate. It should always be accompanied by the word "of" to describe what you mean by it. Is it the risk of not being compliant? Is it the risk of not having your systems configured the way you want them? Or is it the risk of a breach?

When you are "monitoring" something, it needs be a transitive verb that comes with an object as well as a purpose. You are monitoring the network to look for changes in routing configuration. Or you're monitoring your users to look for activities that appear unusual. You are monitoring your security program to make sure you are spending your budget on the right things.

Some other uses (or perhaps misuses) of the word "monitoring" can refer to checking continuously against a set of requirements to make sure they're still being met. This is where "monitoring systems for compliance" comes in. If you are monitoring business processes to make sure they are being completed, or monitoring a vulnerability list to see whether new entries apply to your software, then that's different from monitoring system performance so that you can respond to latency or crashes.

The one thing that really bugs me is the conflation of "monitoring for compliance" with "monitoring for effectiveness." You may be scanning your systems to see whether they are all configured the way you want them to be (or the way you last left them), and you may scan them to see whether they have new vulnerabilities. But that's not the same as measuring the effectiveness of your controls -- as in, whether they are actually preventing or detecting intrusions. You may be 100 percent compliant with your intended controls -- but if their control levels are set to "stupid," then they're not going to stop an attack. And if your controls are set to be as restrictive as possible, but they're still getting bypassed in another way, then they're ineffective.

This, by the way, is also the difference between an audit and a penetration test, which is why compliance does not equal security. One tests the state of controls, and the other tests the results.

So I can certainly see how it can be frustrating to have a purported monitoring program in place that is checking for some things, but not others. Monitoring your program to see whether you are monitoring for intrusions is not only meta enough to make my teeth hurt, it's also saying nothing about how well you're doing it or whether you're already compromised. It's the difference between having syslog running (as required by a checklist), collecting those logs (check), collecting enough of them over the right period of time (check), actually reading them often enough to catch something, and understanding what you're reading. I'd even add "being able to act on that understanding" because monitoring without response capability is pretty useless.

Next time you're tempted to talk about "monitoring risk," try to do so without using either of those words. It may end up taking more sentences to describe what you mean, but it'll probably be clearer in the end. And talk about it in terms of purpose: why you are doing it, and what you are supposed to get out of it. That should differentiate the goals of compliance and effectiveness.

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy. Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.