Computer Security Handbook, Fifth Edition

INTRODUCTION TO PART V

DETECTING SECURITY BREACHES

No matter how well we implement security mechanisms, we are facing human opponents who may counter our best efforts until we can respond appropriately. How do security and network administrators find out if there has been a breach of security? How can they evaluate their own defenses before they are penetrated? This part includes chapters on:

• 52. Application Controls. Application-software security and logging
• 53. Monitoring and Control Systems. System logging and data reduction methods
• 54. Security Audits, Standards, and Inspections. Measuring compliance with explicit policies and with industry standards
• 55. Cyber Investigation. Organizing effective digital forensic studies of observed or suspected security breaches, for internal use, and for cooperation with law enforcement