登录查看更多内容

How do you monitor data security incidents in your network?

由人工智能和领英社区提供技术支持

Data security incidents are events that compromise the confidentiality, integrity, or availability of your network data. They can be caused by malicious actors, human errors, system failures, or natural disasters. If you want to protect your network from data breaches, data loss, or data corruption, you need to monitor data security incidents effectively. In this article, you will learn how to do that in four steps: define your data security policies, implement data security controls, collect and analyze data security logs, and respond to data security incidents.

此文章中的业界达人

由社区从 9 条内容中精选。了解更多

1 Define your data security policies

Before you can monitor data security incidents, you need to define your data security policies. These are the rules and standards that govern how you classify, handle, store, and protect your network data. Your data security policies should align with your business objectives, legal requirements, and industry best practices. They should also specify the roles and responsibilities of your network users, administrators, and managers. You should document your data security policies and communicate them clearly to your network stakeholders.

添加您的观点

Brian Hackney, CISSP

Director, AI & Data Security
(已编辑)
举报内容
Some people follow STOP signs because it's the safe thing to do.. others because it's the law. Then there are those who will only stop because they fear reprisal, while others that make their decision at the stop sign itself (i.e., no cop, no stop).. and still others that will run the stop sign regardless of circumstance. Awareness (the law) is effective for the first three; Deterrence (cop/camera) the fourth; and, Monitoring & response (cop/camera), prevention (road guard), & forensics (detectives) for the fifth. Road guards are effective, but don't scale & can create traffic, while cameras carry privacy limitations. Therefore, if your approach is layered, you can achieve feasible & scalable enforcement for all your stop signs. ;-)

已翻译

赞
Andy J.

Cyber & IT Mgmt. | Transformation | Projects | Enterprise Architect | ACA, IT Audit & GRC
举报内容
Define what the business considers to be an incident. Then see what your data sources look like ( native O365 Bus Premium reporting is good) and then start to organically build your KPI dashboard.

已翻译

赞
Sergio Barbieri

Freelance - Senior software engineer
举报内容
The best preventional task is a full assessment made with BIA-Business Impact Analysis and RA-Risk analysis. With these data we know the Risk level and the potential impact on data. Even if this cannot help in Incident analysis, the second task is a regular EH-Ethical hacking/VA/PT in order to be aware of the vulnerabilities.

已翻译

赞

2 Implement data security controls

Once you have your data security policies in place, you need to implement data security controls. These are the measures and tools that you use to enforce your data security policies and prevent or detect data security incidents. Data security controls can be classified into three types: physical, technical, and administrative. Physical controls are the locks, doors, cameras, and alarms that protect your network hardware and devices. Technical controls are the firewalls, encryption, authentication, and antivirus that protect your network software and data. Administrative controls are the policies, procedures, training, and audits that ensure your network compliance and awareness.

添加您的观点

Sergio Castro

Knowledge Operations Director
举报内容
One recommendation is to manage the implementation and maintenance of your controls using a Kanban board. In this way, each control has an owner, and you can always see what the implementation or update status it is in. Use the cards as the focus of communication for your team.

已翻译

赞
Subhajit Saha

Security Engineer | Penetration Testing | Offensive Security & AppSec programs in Startups
举报内容
In the context of monitoring data security incidents, automation plays an imperative role. When considering the myriad ways our network data can be compromised, from malicious actors to natural disasters, response time is paramount. By integrating attack surface management with tools like Slack, you can achieve instantaneous alerts. A dedicated Slack bot can pinpoint and communicate breaches, human errors, or system failures in real-time. This not only aids in immediate corrective actions but bridges communication gaps, ensuring everyone is on the same page when it comes to safeguarding data integrity.

已翻译

赞

3 Collect and analyze data security logs

To monitor data security incidents, you need to collect and analyze data security logs. These are the records of the activities and events that occur on your network. Data security logs can provide you with valuable information about the source, nature, impact, and frequency of data security incidents. You can collect data security logs from various sources, such as routers, switches, servers, applications, and endpoints. You can use data security tools, such as SIEM (Security Information and Event Management), to aggregate, correlate, and analyze data security logs. You can also use data security metrics, such as KPIs (Key Performance Indicators), to measure and evaluate your data security performance.

添加您的观点

Roshaan Tariq
举报内容
Additionally automation tools like SOAR (Security, Orchestration l, Automation & Response) can also be used to improve the efficiency of security controls. SOAR can help you to intelligently investigate the security incidents and take an automated response in order to minimize the impact of the threat. At the same time, it alerts the Cyber Security or SOC (Security Operation Center) Team about the threat.

已翻译

赞
Sergio Barbieri

Freelance - Senior software engineer
举报内容
From a security point of view, the performance is out-of-scope. Speaking of logs, the procedures must define in advance the contents (4 "W": Who, When, Where, What), location (NOT in the same application DB), time retention policy (on-line/off-line), access control, data protection if the logs have personal data. Following, the logs can be analyzed using SIEM tools based on rules shared with the business responsibles of the application. Last-but-not-the-least: the SIEM results MUST be viewed and analyzed frequently in order to identify critical actions and act remediation tasks.

已翻译

赞

4 Respond to data security incidents

Finally, you need to respond to data security incidents promptly and effectively. You need to have a data security incident response plan that defines the steps and actions that you take to contain, eradicate, recover, and learn from data security incidents. Your data security incident response plan should include the following elements: a data security incident response team, a data security incident response process, a data security incident response communication strategy, and a data security incident response improvement plan. You should test and update your data security incident response plan regularly to ensure its readiness and effectiveness.

添加您的观点

Kenny Boyce
举报内容
One thing you also need to do is be prepared for cyber incidents in your supply chain. We live in such a digitally connected world that it’s just as likely a supplier cyber incident will create a cyber exposure to your own organisation. That could be loss of your data, technical contagion into your systems, legal and regulatory issues, loss of vital service etc. All of these exposures mean you need to prepare for cyber incidents in the supply chain as well as within your own digital landscape.

已翻译

赞
Kianoosh Mostaghimi

CISO | Cybersecurity Advisor | CISM | AI-Cybersecurity |NIS2 | DORA | GRC | Risk Assessment
举报内容
Don't forget the well functioningBusiness continuity management. - Get an overview of which risks and vulnerabilities affect your business - Get track and control over your critical dependencies for reduced risk of third-party impact - Establish long-term working methods for effective incident and crisis management - Achieve organizational resilience through continuity planning and outage management

已翻译

赞

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Information Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you monitor data security incidents in your network?

1

2

3

4

5

1 Define your data security policies

2 Implement data security controls

3 Collect and analyze data security logs

4 Respond to data security incidents

5 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

更多Information Security相关文章

更多相关阅读内容

How do you monitor data security incidents in your network?

1

2

3

4

5

1 Define your data security policies

2 Implement data security controls

3 Collect and analyze data security logs

4 Respond to data security incidents

5 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

查看其他技能