Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/4/2013
03:40 PM
Wendy Nather
Wendy Nather
Commentary
50%
50%

You Keep Using That Word ...

When monitoring doesn't mean what you think it does

I don't like to get all "me too" on a topic, but I really enjoyed the back and forth on Richard Bejtlich's blog as Bejtlich and commenters discussed what "monitoring" means. It's pretty clear that everyone's using the word, but they're differing on the purpose of the monitoring itself.

One of the use cases I see often is "monitoring for risk." Now, risk is a slippery word in and of itself, as the squabbling on risk analysis mailing lists can demonstrate. It should always be accompanied by the word "of" to describe what you mean by it. Is it the risk of not being compliant? Is it the risk of not having your systems configured the way you want them? Or is it the risk of a breach?

When you are "monitoring" something, it needs be a transitive verb that comes with an object as well as a purpose. You are monitoring the network to look for changes in routing configuration. Or you're monitoring your users to look for activities that appear unusual. You are monitoring your security program to make sure you are spending your budget on the right things.

Some other uses (or perhaps misuses) of the word "monitoring" can refer to checking continuously against a set of requirements to make sure they're still being met. This is where "monitoring systems for compliance" comes in. If you are monitoring business processes to make sure they are being completed, or monitoring a vulnerability list to see whether new entries apply to your software, then that's different from monitoring system performance so that you can respond to latency or crashes.

The one thing that really bugs me is the conflation of "monitoring for compliance" with "monitoring for effectiveness." You may be scanning your systems to see whether they are all configured the way you want them to be (or the way you last left them), and you may scan them to see whether they have new vulnerabilities. But that's not the same as measuring the effectiveness of your controls -- as in, whether they are actually preventing or detecting intrusions. You may be 100 percent compliant with your intended controls -- but if their control levels are set to "stupid," then they're not going to stop an attack. And if your controls are set to be as restrictive as possible, but they're still getting bypassed in another way, then they're ineffective.

This, by the way, is also the difference between an audit and a penetration test, which is why compliance does not equal security. One tests the state of controls, and the other tests the results.

So I can certainly see how it can be frustrating to have a purported monitoring program in place that is checking for some things, but not others. Monitoring your program to see whether you are monitoring for intrusions is not only meta enough to make my teeth hurt, it's also saying nothing about how well you're doing it or whether you're already compromised. It's the difference between having syslog running (as required by a checklist), collecting those logs (check), collecting enough of them over the right period of time (check), actually reading them often enough to catch something, and understanding what you're reading. I'd even add "being able to act on that understanding" because monitoring without response capability is pretty useless.

Next time you're tempted to talk about "monitoring risk," try to do so without using either of those words. It may end up taking more sentences to describe what you mean, but it'll probably be clearer in the end. And talk about it in terms of purpose: why you are doing it, and what you are supposed to get out of it. That should differentiate the goals of compliance and effectiveness.

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy. Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4931
PUBLISHED: 2021-02-24
IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages. IBM X-Force ID: 191747.
CVE-2020-11987
PUBLISHED: 2021-02-24
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2020-11988
PUBLISHED: 2021-02-24
Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
CVE-2021-21974
PUBLISHED: 2021-02-24
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in...
CVE-2021-22667
PUBLISHED: 2021-02-24
BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access and permit the execution of arbitrary code on the BB-ESWGP506-2SFP-T (versions 1.01.01 and prior).