Engineering Trustworthy Systems: Get Cybersecurity Design Right the First Time

CHAPTER

15   Detection Strategy

Overview

•   15.1 Detect in Depth and Breadth

•   15.1.1 Breadth: Network Expanse

•   15.1.2 Depth: Network Expanse

•   15.1.3 Breadth: Attack Space

•   15.1.4 Depth: Attack Space

•   15.2 Herd the Adversary to Defender’s Advantage

•   15.3 Attack Epidemiology

•   15.4 Detection Honeypots

•   15.5 Refining Detection

•   15.5.1 Running Alerts to Ground

•   15.5.2 Learning More About an Attack

•   15.6 Enhancing Attack Signal and Reducing Background Noise

•   15.6.1 Reducing the Noise Floor

•   15.6.2 Boosting Attack Signal

•   15.6.3 Lowering the Alert Threshold

Learning Objectives

•   Define detection in depth and breadth along two dimensions—network expanse and attack space coverage.

•   Describe how to engineer ...