Chapter 19. Monitoring and Assessment Security monitoring and assessment is the process of keeping tabs on the security status of the Windows Server 2003 system(s). Because it focuses on what is normal, it can also help you determine what is abnormal and then help you distinguish between failures and security incidents. Because security is dependent not just on security technologies but also on the availability and proper operation of components, security monitoring and assessment focuses on monitoring those components. The argument could be made that all network, operating system, and application operation can impact security, but security monitoring should concentrate on those items most likely to cause security problems. Security monitoring therefore concentrates on services such as Active Directory and DNS and on irregularities in any operations. Security monitoring is part intrusion detection, and part simply making sure that all security processes and processes that security depends on are functioning. Monitoring may use information collected via many tools including data from the event logs, results of diagnostic utilities, performance monitoring tools, network monitors, and third-party monitoring tools. Do not make the mistake of assuming that connecting a network monitor and digesting packets is the only monitoring and assessment you must do. Instead, take these steps:Establish baselines for normal operationMonitor servicesMonitor active directoryUse live and archival data to detect intrusionEstablish incident response procedures
|