What are the common system monitoring risks and pitfalls and how do you avoid or mitigate them?

1 NIST SP 800-137

NIST SP 800-137 is a publication by the National Institute of Standards and Technology (NIST) that provides a comprehensive framework for continuous security monitoring of information systems and environments of operation. It defines the objectives, processes, and activities of security monitoring, and provides guidance on how to select, implement, and analyze security monitoring tools and data. NIST SP 800-137 can help you establish a consistent and effective security monitoring program that aligns with your organizational goals, policies, and risk tolerance.

2 ISO/IEC 27035

ISO/IEC 27035 is an international standard that defines the principles and processes for information security incident management. It covers the entire lifecycle of incident response, from preparation and detection to analysis, containment, eradication, recovery, and improvement. ISO/IEC 27035 can help you develop a robust and consistent incident response plan that minimizes the impact and recurrence of security incidents, and ensures compliance with legal and regulatory requirements.

3 CIS Controls

CIS Controls are a set of best practices for securing information systems and data, developed by the Center for Internet Security (CIS). They are based on the consensus of experts from various sectors and domains, and are updated regularly to reflect the evolving threat landscape. CIS Controls cover 20 key areas of security, such as inventory and control of hardware and software, configuration management, vulnerability management, malware defense, email and web browser protection, data protection, and incident response. CIS Controls can help you prioritize and implement the most effective security measures for your system, and benchmark your performance against industry standards.

4 Common Risks and Pitfalls

Security monitoring can come with its own set of risks and pitfalls, so system administrators must be conscious of them and take the necessary steps to avoid or minimize them. For instance, they must have the right skills, training, and awareness to carry out security monitoring tasks, as well as follow the policies and procedures that govern them. Additionally, it is important to communicate and collaborate with other stakeholders such as management, users, auditors, and vendors in order to ensure security monitoring meets the business needs and expectations. Moreover, security monitoring should not be a replacement for basic security hygiene such as patching, hardening, backup, and encryption. System administrators should also verify that their security monitoring tools and data are reliable, accurate, and up-to-date. Finally, security monitoring is an ongoing process that requires adaptation as the system environment changes. System administrators should monitor changes such as new applications, devices, users or threats to adjust their security monitoring strategy accordingly. They should also review and evaluate their security monitoring results to improve their security practices and policies.