Implementing Recon Monitoring and Detection Systems
The longer an organization takes to discover that its network infrastructure and systems are compromised, the more time adversaries spend in their network compromising additional systems to expand their foothold within the victim’s network. Implementing and working with network security tools helps Security Operation Centers (SOCs) and Digital Forensic and Incident Response (DFIR) teams to effectively monitor network traffic, detect potential threats, and provide real-time alerts for faster response times, containment, and eradication of threats.
In this chapter, you will learn the fundamentals of using Wireshark to perform packet analysis as an ethical hacker. Additionally, you will learn how to deploy and use Security Onion to monitor a network and detect suspicious activities to further determine whether it’s a security event or an incident within your organization.
In this chapter, we will cover the following...
