Security Monitoring

Index

A note on the digital index

A link in an index entry is displayed as the section title in which that entry appears. Because some sections have multiple index markers, it is not unusual for an entry to have several links to the same section. Clicking on any link will take you directly to the place in the text in which the marker appears.

A

access controls, Access controls, Policy 2: Allowed access

enumeration for security monitoring, Access controls

policies, minimum for security monitoring, Policy 2: Allowed access

access_log files (Apache), Application Logging

account access, detection of, Example: ISO 17799 monitoring

ACLs (access control lists), Identifying infected hosts participating in botnets, Event Collection Methods, Event Collection Impact, Network ACL logs, Packet Analysis and Alerting

blocking connection from offending IP address, Packet Analysis and Alerting

creating for botnet virus IRC command and control server, Identifying infected hosts participating in botnets

limiting negative impacts of ACL logging on systems, Event Collection Impact

logs, push method of event collection, Event Collection Methods

network ACL logs, Network ACL logs

administrative privileges, monitoring for Oracle database, Monitor administrative privileges

administrator user IDs, Administrator user IDs

aggregate bandwidth, Analyze

alert level, Event Collection Impact

alerts, Example: COBIT configuration control monitoring, Network IDS, Packet Analysis and Alerting, Blanco’s Security Alert Sources, Monitor ...