LESSON 3.4: Network Monit ns - International BSF

Introduction: The Watchful Eye

In Lessons 3.1, 3.2, and 3.3, we established the foundations of security architecture, examined network security controls, and analyzed secure remote access solutions. We explored firewalls, intrusion detection and prevention systems, and VPNs. However, even with strong perimeter defenses and secure remote access, threats can still penetrate the network. Financial institutions must continuously monitor their networks to detect and respond to threats in real-time.

Network Monitoring is the practice of continuously observing network traffic, systems, and applications to detect anomalies, threats, and performance issues. It is the foundation of the “Detect” function in the NIST CSF. A well-designed network monitoring capability provides:

Visibility: Understanding what is happening on the network at all times.
Detection: Identifying threats and anomalies.
Investigation: Providing data for incident investigation.
Response: Enabling rapid response to threats.

This lesson provides a comprehensive analysis of network monitoring and Security Information and Event Management (SIEM) for financial institutions. We begin by examining the Network Monitoring Components: sensors, collectors, analyzers, and dashboards. We derive the Network Monitoring Coverage Score: $C_{m o ni t or} = C_{o v er a g e} \times D_{e pt h} \times T_{im e l in ess}$ .

We then examine Security Information and Event Management (SIEM) , including log collection, correlation, alerting, and reporting. We derive the SIEM Effectiveness Score: $E_{S I EM} = C_{o ll ec t i o n} \times C_{orre l a t i o n} \times A_{l er t in g} \times R e p or t in g$ . We analyze the SIEM Use Cases for financial institutions.

We also examine Threat Detection Techniques, including signature-based detection, anomaly detection, and behavioral detection. We derive the Threat Detection Score: $D_{t h re a t} = S_{e n s i t i v i t y} \times S_{p ec i f i c i t y} \times T_{im e l in ess}$ .

By the end, you will have a complete understanding of network monitoring and SIEM, and be able to design and implement a comprehensive monitoring capability for a financial institution.

Learning Objectives

Upon completion of this lesson, you will be able to:

Analyze the Network Monitoring Components: sensors, collectors, analyzers, and dashboards.
Derive the Network Monitoring Coverage Score: $C_{m o ni t or} = C_{o v er a g e} \times D_{e pt h} \times T_{im e l in ess}$ .
Analyze Security Information and Event Management (SIEM) .
Derive the SIEM Effectiveness Score: $E_{S I EM} = C_{o ll ec t i o n} \times C_{orre l a t i o n} \times A_{l er t in g} \times R e p or t in g$ .
Analyze Threat Detection Techniques: signature-based, anomaly-based, and behavioral-based detection.
Derive the Threat Detection Score: $D_{t h re a t} = S_{e n s i t i v i t y} \times S_{p ec i f i c i t y} \times T_{im e l in ess}$ .
Design a network monitoring and SIEM solution for a financial institution.

Part 1: Network Monitoring Components

1.1 The Monitoring Architecture

The network monitoring architecture consists of four components:

$Monitoring = {Sensors, Collectors, Analyzers, Dashboards}$

1.2 The Four Components

Component	Description	Examples
Sensors	Capture and generate data	Network sensors, endpoint agents, application logs
Collectors	Aggregate and store data	SIEM collectors, log aggregators
Analyzers	Analyze data for threats	Correlation engines, anomaly detection
Dashboards	Visualize data and alerts	Security dashboards, alert consoles

1.3 The Network Monitoring Coverage Score

The Network Monitoring Coverage Score quantifies the effectiveness of network monitoring:

$C^{m o ni t or} = C^{o v er a g e} \times D^{e pt h} \times T^{im e l in ess}$

Where:

$C_{o v er a g e}$ is the Coverage Score (0-1)
$D_{e pt h}$ is the Depth Score (0-1)
$T_{im e l in ess}$ is the Timeliness Score (0-1)

Component	Description	Scoring Factors
Coverage (C)	Percentage of network monitored	Network segments, endpoints, applications
Depth (D)	Level of monitoring detail	Packet capture, flow data, logs
Timeliness (T)	Speed of detection	Latency between event and detection

Network Monitoring Architecture (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Sensors                                                              │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Network sensors (packet capture, flow data)                 │  │
|  │  • Endpoint agents (EDR, antivirus)                            │  │
|  │  • Application logs (web servers, databases)                   │  │
|  │  • Security devices (firewalls, IDS/IPS)                       │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Collectors                                                            │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • SIEM collectors                                            │  │
|  │  • Log aggregators                                             │  │
|  │  • Data lake storage                                           │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Analyzers                                                             │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Correlation engines                                         │  │
|  │  • Anomaly detection                                           │  │
|  │  • Threat intelligence                                         │  │
|  │  • User and entity behavior analytics (UEBA)                   │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Dashboards                                                            │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Security dashboards                                         │  │
|  │  • Alert consoles                                              │  │
|  │  • Reporting tools                                             │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 2: Security Information and Event Management (SIEM)

2.1 The SIEM Definition

SIEM is a security solution that provides real-time analysis of security alerts and logs from various sources.

$SIEM = {Collection, Correlation, Alerting, Reporting}$

2.2 The SIEM Components

Component	Description	Function
Collection	Collects logs from various sources	Log aggregation, normalization
Correlation	Correlates events across sources	Threat detection, pattern recognition
Alerting	Generates alerts for security events	Real-time notification, escalation
Reporting	Generates reports for compliance	Compliance reporting, incident investigation

2.3 The SIEM Effectiveness Score

The SIEM Effectiveness Score quantifies the effectiveness of a SIEM:

$E^{S I EM} = C^{o ll ec t i o n} \times C^{orre l a t i o n} \times A^{l er t in g} \times R e p or t in g$

Where:

$C_{o ll ec t i o n}$ is the Collection Score (0-1)
$C_{orre l a t i o n}$ is the Correlation Score (0-1)
$A_{l er t in g}$ is the Alerting Score (0-1)
$R e p or t in g$ is the Reporting Score (0-1)

Component	Description	Scoring Factors
Collection (C)	Coverage of log sources	Number of sources, types of logs
Correlation (C)	Effectiveness of correlation	Detection rate, false positive rate
Alerting (A)	Effectiveness of alerting	Alert quality, response time
Reporting (R)	Effectiveness of reporting	Compliance coverage, data quality

2.4 SIEM Use Cases for Financial Institutions

Use Case	Description	Examples
Threat Detection	Detecting known and unknown threats	Malware detection, intrusion detection
Compliance	Meeting regulatory requirements	GLBA, SOX, GDPR, NYDFS
Incident Investigation	Investigating security incidents	Log analysis, forensic investigation
Security Monitoring	Monitoring security posture	Dashboards, alerts, reporting

SIEM Architecture (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  Data Sources                                                         │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Firewalls                                                   │  │
|  │  • IDS/IPS                                                     │  │
|  │  • VPNs                                                        │  │
|  │  • Servers                                                     │  │
|  │  • Applications                                                │  │
|  │  • Cloud Services                                              │  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  SIEM Platform                                                       │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  ┌─────────────────────────────────────────────────────────────┐│  │
|  │  │  Log Collection & Normalization                             ││  │
|  │  │  • Agents, Syslog, API                                      ││  │
|  │  │  • Parsing, Normalization                                   ││  │
|  │  └─────────────────────────────────────────────────────────────┘│  │
|  │  ┌─────────────────────────────────────────────────────────────┐│  │
|  │  │  Event Correlation                                          ││  │
|  │  │  • Rules, Correlation Engines                              ││  │
|  │  │  • Threat Intelligence Integration                         ││  │
|  │  └─────────────────────────────────────────────────────────────┘│  │
|  │  ┌─────────────────────────────────────────────────────────────┐│  │
|  │  │  Alerting & Notification                                    ││  │
|  │  │  • Real-time Alerts                                        ││  │
|  │  │  • Escalation                                              ││  │
|  │  └─────────────────────────────────────────────────────────────┘│  │
|  │  ┌─────────────────────────────────────────────────────────────┐│  │
|  │  │  Reporting & Dashboards                                    ││  │
|  │  │  • Compliance Reports                                      ││  │
|  │  │  • Operational Dashboards                                  ││  │
|  │  └─────────────────────────────────────────────────────────────┘│  │
|  └────────────────────────┬────────────────────────────────────────┘  │
|                           │                                           |
|                           ▼                                           |
|  Outputs                                                              │
|  ┌─────────────────────────────────────────────────────────────────┐  │
|  │  • Alerts                                                      │  │
|  │  • Reports                                                     │  │
|  │  • Dashboards                                                  │  │
|  │  • Investigations                                              │  │
|  └─────────────────────────────────────────────────────────────────┘  │
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Part 3: Threat Detection Techniques

3.1 The Detection Methods

Threat detection techniques can be categorized into three types:

$Detection = {Signature-Based, Anomaly-Based, Behavioral}$

3.2 Signature-Based Detection

Definition: Signature-based detection matches known threat signatures.

$Signature-Based = {Signatures, Matching, Alerts}$

Advantages:

Advantage	Description
Accuracy	Low false positive rate
Speed	Fast detection
Simplicity	Easy to implement

Disadvantages:

Disadvantage	Description
Limited Coverage	Cannot detect unknown threats
Maintenance	Requires constant signature updates

3.3 Anomaly-Based Detection

Definition: Anomaly-based detection detects deviations from normal behavior.

$Anomaly-Based = {Baseline, Deviation, Alerts}$

Advantages:

Advantage	Description
Unknown Threat Detection	Can detect novel threats
Adaptability	Adapts to changing environment

Disadvantages:

Disadvantage	Description
False Positives	Higher false positive rate
Complexity	Requires baseline establishment

3.4 Behavioral Detection

Definition: Behavioral detection detects suspicious behavior patterns.

$Behavioral = {Behavior Patterns, Anomalies, Alerts}$

Advantages:

Advantage	Description
Contextual Understanding	Understands context of behavior
Advanced Threat Detection	Detects sophisticated attacks

Disadvantages:

Disadvantage	Description
Complexity	Requires advanced analytics
Data Requirements	Requires large amounts of data

3.5 The Threat Detection Score

The Threat Detection Score quantifies the effectiveness of threat detection:

$D^{t h re a t} = S^{e n s i t i v i t y} \times S^{p ec i f i c i t y} \times T^{im e l in ess}$

Where:

$S_{e n s i t i v i t y}$ is the Sensitivity Score (0-1)
$S_{p ec i f i c i t y}$ is the Specificity Score (0-1)
$T_{im e l in ess}$ is the Timeliness Score (0-1)

Component	Description	Scoring Factors
Sensitivity (S)	Detection rate	True positive rate
Specificity (S)	False positive rate	False positive rate
Timeliness (T)	Speed of detection	Detection latency

Threat Detection Techniques (Visual):
┌─────────────────────────────────────────────────────────────────────────┐
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Signature-Based Detection                                      ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Description: Matches known threat signatures                   ║  |
|  ║  Examples: Snort, Suricata, antivirus                          ║  |
|  ║  Advantages: Accurate, Fast                                    ║  |
|  ║  Disadvantages: Limited coverage, requires updates              ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Anomaly-Based Detection                                       ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Description: Detects deviations from normal behavior           ║  |
|  ║  Examples: Statistical models, machine learning                ║  |
|  ║  Advantages: Unknown threat detection, adaptable               ║  |
|  ║  Disadvantages: Higher false positives, complexity              ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
|  ╔═══════════════════════════════════════════════════════════════════╗  |
|  ║  Behavioral Detection                                          ║  |
|  ╠═══════════════════════════════════════════════════════════════════╣  |
|  ║  Description: Detects suspicious behavior patterns               ║  |
|  ║  Examples: UEBA, advanced threat detection                     ║  |
|  ║  Advantages: Contextual understanding, advanced detection      ║  |
|  ║  Disadvantages: Complexity, data requirements                   ║  |
|  ╚═══════════════════════════════════════════════════════════════════╝  |
|                                                                         |
└─────────────────────────────────────────────────────────────────────────┘

Certificate in Cybersecurity for Financial Institutions LESSON 3.4: Network Monit ns

Certificate in Cybersecurity for Financial Institutions

Introduction: The Watchful Eye

Learning Objectives

Part 1: Network Monitoring Components

1.1 The Monitoring Architecture

1.2 The Four Components

1.3 The Network Monitoring Coverage Score

Part 2: Security Information and Event Management (SIEM)

2.1 The SIEM Definition

2.2 The SIEM Components

2.3 The SIEM Effectiveness Score

2.4 SIEM Use Cases for Financial Institutions

Part 3: Threat Detection Techniques

3.1 The Detection Methods

3.2 Signature-Based Detection

3.3 Anomaly-Based Detection

3.4 Behavioral Detection

3.5 The Threat Detection Score

International BSF

START YOUR LEARNING JOURNEY