In the previous chapter, we discussed the security assessment for every release. In this chapter, we will cover threat inspection and intelligence. This chapter focuses on how to identify and prevent known and unknown security threats, such as backdoors and injection attacks, using various kinds of log correlation. We will introduce the logs that are needed, how those logs are connected, and the potential symptoms of attacks. Some open source threat detection will be introduced. Finally, we will introduce how to build your own in-house threat intelligence system.
We will cover the following topics in this chapter:
- Unknown threat detection
- Indicators of compromises
- Security analysis using big data frameworks
