Inside the Security Mind: Making the Tough Decisions

Logging and Monitoring

To maintain the Rule of the Three-Fold Process, logging and monitoring should be implemented in objects all across the environment. This includes objects like servers, routers, and applications, as well as physical areas. Having a firewall go unmonitored is exactly the same as parking a locked car in a dark alley with no one around. Every security device has a weakness, and if an attacker goes unnoticed, the attack will eventually be successful. The unwatched thief will eventually find a way into your car, and the unwatched hacker will eventually find a way into your networks and systems.

What to Log

Earlier we discussed the concept of creating stillness, which should be reviewed for logging purposes. It is extremely important ...