Respond
In Chapter 6, we learned about the Detect function. The Detect function is all about how we detect adverse events within our environment. We first began to discuss detection across the network. These included detections of our networking protocols such as BGP for routing or VRRP for our device failovers. We also discussed why encrypting these protocols is important along with the possibility of isolating the communications across out-of-band networks.
In the last chapter, we also talked about the need for logging and developing rules to detect adverse events. This included the need to push all of your logs to a SIEM tool for analysis. However, analysis is only as good as the rules used to detect these events.
Once we have configured all our IT resources to send their logs to a logging tool, and analyzed the results, we must do something about it. Thresholds need to be created in order to determine the severity of the event that was detected. We also need to develop policies...
