The Cyber Security Handbook – Prepare for, respond to and recover from cyber attacks

CHAPTER 13: IDENTIFY AND DETECT

Develop a system to identify anomalies that may signify an incident through automated, continual security monitoring, with manual follow-ups.

Effective security is about managing your risks, monitoring them to make sure they are acceptable and taking appropriate action if not. Importantly, it is not about eliminating all risk and achieving absolute security, as the trade-offs that approach would require – not having an online presence, for instance – are simply too great. However, an acceptable risk is still a risk. Even with a preventive measure in place, that measure might fail, or that measure may have been implemented to only reduce the impact and not necessarily to prevent the risk from materialising. Furthermore, ...