Practical Monitoring

Chapter 10. Security Monitoring

Security monitoring is a different beast than you’re familiar with if you’re coming from an infrastructure or application background. When it comes to monitoring an infrastructure, you’re instrumenting things that already exist. For example, your web servers already emit health and metrics data, and it’s a simple matter to store them and set up any necessary alerts. However, when it comes to security, many people find that the infrastructure and application weren’t built with security in mind. There are no existing hooks to use, leaving many engineers in the unfortunate position of having to bolt on security after the fact—not fun.

In some cases, there are entire classes of problems that no one solved for. As an example, how are you going to detect different DDoS signatures if you have no DDoS protection in place to begin with? As a result, unlike previous chapters, this chapter will straddle the line between how to build basic security and how to monitor it. There will be plenty of security approaches and tools I either gloss over or fail to mention—security monitoring is a specialized field unto itself and one that I cannot possibly do justice to in such a short chapter. If you find yourself interested in security monitoring and want to go deeper, I have found Richard Bejtlich’s The Practice of Network Security Monitoring (No Starch Press, 2013) to be invaluable.

Security is a matter of assessing threat and risk and deciding on compromises. Think ...