Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Establish Baselines

You cannot determine which events require investigation as possible security incidents unless you know what is normal. Thus, the first step in detecting abnormality is establishing a baseline. If you know what is ordinary for your organization, it is easier to spot the unusual. For example, do you know how many logon failure events in the event log of a domain controller constitutes ordinary forgetfulness or error on the part of your users? Users will forget passwords and enter them incorrectly, so there will be failed logon events in the logs. If you know how many logon failures are typical, you won't be alarmed to see them but will correctly identify a sudden rise in logon failures as something to investigate immediately. If you have no idea what is normal, you might see a few events as a problem, or count large numbers of events as normal operations. The number of normal failed logons for a specific DC in your system is not a number that can be determined by examining some statistic recorded by another organization. Baselines for event log activity are not the only statistic to consider, either. Do you know the average time it takes to fully replicate changes to the Active Directory across your enterprise? Are spikes in network utilization normal for a specific day of the week, month, time of day, or do they represent a spreading worm?

Many of these baselines may be tracked already as part of network operations. From a security perspective, your job may be simply to help interpret the variations. A number of resources can help, including a web sites such as the Information Technology Professionals Resource Center (ITPRC), which lists and describes products and provides whitepapers on network monitoring at http://www.itprc.com/nms.

Other operations, such as monitoring Active Directory and Group Policy operation and interpreting Windows logs, may not be addressed by traditional network monitoring products and networking staff. They are addressed by a growing number of third-party and Microsoft products, such as Microsoft Operations Manager (MOM). The suitability of any specific product for your network is not within the scope of this book; understanding what to monitor and how to use built-in or resource kit tools is.

NOTE: Resource on Intrusion Detection

Using network monitors for intrusion detection and forensics is beyond the scope of this book. A good resource is The Tao of Network Security Monitoring: Beyond Intrusion Detection by Richard Bejtlich (Addison-Wesley, 2004). This book provides detailed analysis of network traffic captured using free and commercial network monitors.