Detection capabilities
Since the current threat landscape is very dynamic and it changes rapidly, it requires detection systems that can quickly adjust to new attacks. The traditional detection systems that rely in manual fine-tuning of initial rules, fixed thresholds, and fixed baselines will most likely trigger too many false positives, and that's not sustainable for many organizations nowadays. When preparing to defend against attackers, the Blue Team must leverage a series of techniques that include:
- Data correlation from multiple data sources
- Profiling
- Behavior analytics
- Anomaly detection
- Activity evaluation
- Machine learning
It is important to emphasize that some of the traditional security controls, such as protocol analysis and signature-based anti-malware, still have their place in the line of defense, but primarily to combat legacy threats. You shouldn't uninstall your anti-malware software just because it doesn't have any...
