97 Things Every Information Security Professional Should Know

Chapter 30. Knowing Normal

Gyle dela Cruz

If you work in the blue team or cyber defense side of information security, you will inevitably be involved in doing some investigations. It could involve network intrusion or malware infections. No matter what type of investigations you do, an understanding of what is normal will form a significant aspect of your work. Protecting the triad of confidentiality, integrity, and availability forms the basic tenets of InfoSec. Keeping the information confidential, accurate, and available is the norm we aspire to.

You will need to know what normal looks like when it comes to network protocols, computer operations, application behavior, and even the traffic flow in your corporate environment. An attack will affect what is normal. Think of the attack as the anomaly in your setup. All detection tools rely on having specifications on what is considered unusual or not normal. Think of the signatures or rules from your IPS (intrusion prevention system) and anti-malware platforms that will alert upon a match on malicious activity.

Having a set of baseline information helps us understand what is normal. For example, there are standards written for the implementation of a network protocol. Common attack tools will subvert the standards. Having the capability to look at a packet capture and understand the flow of traffic will lead you to find indicators ...