Intrusion Remediation Plan for Data Security

If your enterprise suffers a security breach and you’re forced to activate your intrusion remediation plan, your system log is likely to be your first destination to try to trace the path of where things went wrong. In too many instances, IT discovers that logs are either not adequate or they were not being sufficiently monitored to be able to detect the signs of an impending breach.

Many attacks can be prevented if logs and monitoring are prioritized. Nearly all breaches occur because logging and monitoring are not at levels that will detect an intruder probing around the system, looking for vulnerability.

Testing for security weakness

It’s important to work through some test probes to see where your system is weak and have someone monitoring those tests to cross-reference whether every probe is detectable in your system by your logging. This helps you identify areas where you’re likely to experience a breach.

Likely areas of vulnerability

There are particular areas where a lack of logging and monitoring can be especially problematic, including:

• Login abnormalities such as failed login attempts, and other auditable events such as high-value transactions
• Errors or warnings that are not logged or that provide information that is not actionable or is unclearly communicated
• Logs of critical information are overlooked during the implementation of a new solution, leaving entire systems without logging or monitoring
• The local-only storage of logs, which allows intruders to edit them and remove any evidence of their activity
• Certain applications may not have the built-in logging or alert systems that the enterprise is accustomed to, and so the application may have no safeguard against a breach

Putting prevention measures in place

Your intrusion remediation plan requires a few key actions to ensure that data is protected by safeguards.

1. Make sure login information and validation failures are logged in a way that is easily readable so that personnel can readily identify any unusual or suspicious activity.
2. The log format must be accessible and created in a way that is usable for the administrators responsible for monitoring it.
3. Any high-value transaction should have an auditable trail that will alert administrators to any kind of deletion or tampering with the data transmission.
4. There must be a policy developed to ensure a systematic response to suspicious activity discovered in the monitoring process.

Creating a comprehensive intrusion remediation plan must include specific guidelines around logging and monitoring. To get started with securing your enterprise against a breach, contact us at BlackPoint It Services.