Crafting the InfoSec Playbook

Chapter 4. A Data-Centric Approach to Security Monitoring

“Quickest way to find the needle... burn the haystack.”

Kareem Said

Effective security alarms are only useful when introduced with efficient, precise, and where possible, automated data analysis. This chapter describes fundamental building blocks to develop and implement a tailored security monitoring and response methodology. To that end, we’ll discuss:

• How to prepare and store your data

• How to give your operation authority and clarity with a solid logging policy

• What metadata is and why you should care about it

• How to develop and structure incident detection logic into your own playbook

Properly developing incident response methods and practices requires a solid plan and a foundational framework for every security incident response team. Finding security incidents and helpful clues to other nefarious behavior can be difficult. With no plans or framework in place, an incident response team can be immediately lost in a sea of data, or left with a dead end having no data (or no useful data) to analyze.

You could buy a bunch of expensive gear, point it all to a log management or a security incident and event management (SIEM) system, and let it automatically tell you what it knows. Some incident response teams may start this way, but unfortunately, many never evolve. Working only with what the SIEM tells you, versus what you have configured it to tell you based on your contextual data, will invariably fail. Truly ...