Network management and monitoring tools

In this section, we will look at some of the challenges that need to be considered when managing an enterprise network. In particular, we must protect networking services and equipment from unauthorized changes and ensure traffic can flow across our networks.

Alert definitions and rule writing

It is important that rules used by our advanced network protection devices do not cause unnecessary blockages or allow our networks to be overwhelmed by unwanted/malicious traffic. If rules are implemented poorly, then we may see a high number of false positives, meaning the traffic is benign (non-threatening). False negatives will mean the traffic was considered harmless when in fact it is malicious.

Tuning alert thresholds is an important step. An example could be auditing for anomalous file access to a storage device containing a mixture of data with different classification labels. You want to log all read and write access to customer records with an alert being generated for Move or Copy actions. However, if you set this rule up for all data directories, including non-sensitive data, then you may be overwhelmed by unnecessary alerts.

Eventually, your SOC staff will experience alert fatigue, meaning they may well dismiss important security events.