Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

اینجــــا یک کتابخانه دیجیتالی است

با بیش از 100000 منبع الکترونیکی رایگان به زبان فارسی ، عربی و انگلیسی

Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] - نسخه متنی

Roberta Bragg

| نمايش فراداده ، افزودن یک نقد و بررسی
افزودن به کتابخانه شخصی
ارسال به دوستان
جستجو در متن کتاب
بیشتر
تنظیمات قلم

فونت

اندازه قلم

+ - پیش فرض

حالت نمایش

روز نیمروز شب
جستجو در لغت نامه
بیشتر
لیست موضوعات
توضیحات
افزودن یادداشت جدید







Chapter 19. Monitoring and Assessment


Security monitoring and assessment is the process of keeping tabs on the security status of the Windows Server 2003 system(s). Because it focuses on what is normal, it can also help you determine what is abnormal and then help you distinguish between failures and security incidents. Because security is dependent not just on security technologies but also on the availability and proper operation of components, security monitoring and assessment focuses on monitoring those components. The argument could be made that all network, operating system, and application operation can impact security, but security monitoring should concentrate on those items most likely to cause security problems. Security monitoring therefore concentrates on services such as Active Directory and DNS and on irregularities in any operations. Security monitoring is part intrusion detection, and part simply making sure that all security processes and processes that security depends on are functioning. Monitoring may use information collected via many tools including data from the event logs, results of diagnostic utilities, performance monitoring tools, network monitors, and third-party monitoring tools. Do not make the mistake of assuming that connecting a network monitor and digesting packets is the only monitoring and assessment you must do. Instead, take these steps:

Establish baselines for normal operation

Monitor services

Monitor active directory

Use live and archival data to detect intrusion

Establish incident response procedures



/ 194