97 Things Every Information Security Professional Should Know

Chapter 63. Monitoring: You Can’t Defend Against What You Don’t See

Mitch B. Parker

When we think of ransomware and targeted attacks, the approach that has been commonly taken has been to focus on the initial infection vectors. This means checking for phishing emails, breached accounts, or vulnerabilities on exposed systems that connect to internal systems. We do not assume that they’re already in the network and moving around laterally to discover what exists without the use of malware. Many of the targeted attacks on health systems have leveraged this approach for maximum effectiveness and have made significant money for the ransomware gangs that employ it. With the lack of two-factor authentication in active enforced usage, security of partner systems, and the number of breached accounts and passwords on the internet, we need to assume breach and operate as if the adversaries are already present.

With financial systems, we must monitor them to ensure that people are not using their accounts to engage in improper behavior such as collusion. We also need to monitor them so that we can ensure that the proper controls are in place to protect financial systems integrity to American Institute of Certified Public Accountants (AICPA) standards. This is critical to provide assurances that the company has processes to look for and correct improper behavior, and that there is evidence ...