Episode Details
Back to Episodes
Course 46 - CompTIA Cybersecurity Analyst | Episode 23: Monitoring and Securing Host, Network, and Application Events
Published 10 hours ago
Description
Comprehensive Monitoring and Threat Detection Across Networks, Hosts, and ApplicationsEpisode OverviewThis episode presents a practical approach to monitoring, diagnosing, and securing enterprise IT environments across three interconnected layers: network infrastructure, server hosts, and application services. It explores how security teams establish baselines, identify abnormal behavior, investigate events and logs, and respond to threats across Windows and Linux systems.The episode connects network-level visibility with host and application monitoring to demonstrate how seemingly isolated anomalies can be correlated into meaningful security findings.Key Topics Covered1. Network Monitoring, Probes, and Perimeter Defense
- DoS vs. DDoS: Understand the distinction between single-source and distributed denial-of-service attacks and examine defensive measures such as rate limiting, firewall controls, traffic filtering, and IPS capabilities.
- Rogue Hardware Detection: Identify unauthorized wired devices through network discovery, switch information, physical inspections, and analysis of unexpected traffic patterns.
- Wireless Security: Use wireless site surveys and monitoring to identify unauthorized access points and potential evil-twin scenarios.
- Port and Network Access Control: Explore controls such as 802.1X, NAC, and switch port-security mechanisms to restrict unauthorized devices and improve endpoint visibility.
- Network Anomaly Detection: Establish normal traffic patterns and investigate unexpected connections, protocol usage, bandwidth consumption, or communication destinations.
- Resource Monitoring: Track CPU, memory, disk, and process activity to identify resource exhaustion, software failures, memory leaks, and potentially malicious activity.
- Windows Monitoring:
- Resource Monitor (Resmon): Examine real-time CPU, memory, disk, and network activity.
- Performance Monitor (Perfmon): Collect and analyze performance counters, including those from remote systems when properly configured.
- Linux Command-Line Monitoring:
- ps — inspect running processes and resource usage.
- top — monitor processes and system resources in real time.
- df — check filesystem capacity and utilization.
- w — review logged-in users and their current activity.
- Software Management: Examine centralized software deployment and control mechanisms, including the security trade-offs between application allowlisting and blocklisting.
- Authentication and Security Logs: Correlate login events, privilege changes, account activity, and other security events to identify suspicious behavior such as unauthorized administrative access.
- Windows Services: Verify service status using tools such as services.msc and sc, and investigate unexpected service creation, modification, or termination.
- Linux Services: Examine service states using tools appropriate to the Linux distribution and service manager, such as systemctl on systemd-based systems.
- Log Analysis:
- Windows: Use Event Viewer to investigate system, application, authentication, and security events.
- Linux: Examine relevant logs under /var/log and use utilities such as tail to monitor changing log files.
- Behavioral Baselining: Establish expected service and application behavior so that unusual outbound communications, unexpected processes, abnormal output, or unauthorized account creation can be detected.
- Host-Based Prevention: Explore the role of HIPS and related endpoint security controls in detecting and preventing suspicious host activity.