>> Hi everybody. Let's go
ahead and pick up with risk monitoring.
Risk monitoring is all about the
>> fact that no matter how
>> much you put into planning, risks still materialize.
We're going to need to continue to evaluate
and watch for risk in a number of ways.
The first way is to look for care eyes.
Key risk indicators.
These are also known as triggers.
Triggers indicate that a risk event
is likely to materialize.
For example, if I am concerned about a denial of
service attack and I put
my mitigation strategies in place,
I'll also monitor the network.
If I see network traffic escalating and
network utilization is at 70 percent and going up,
then I'll see that as a key risk indicator.
It tells me that regardless
of what I've done for mitigation,
there's still something going on.
For this type of scenario,
I would plan to monitor the network
>> and establish that if
>> network utilization exceeds 50 percent
for more than five minutes consecutively,
then that is something I want to be alerted to.
That's what a key risk indicator is.
It's an alarm or an early warning system.
Care eyes need to be determined early.
These are things you would add in your risk register.
You would add what you are looking for as
an indicator of the risk you are documenting.
You want to be as proactive as you
can and be preventative.
But you also want an alarm that will tell you when
your risk is going to materialize anyway.
Other things you can do to monitor for
risk are to review your logs.
You want to do it proactively.
Often you only look at your logs after an event.
But we find that if we've been
looking at our logs ahead of time,
we could have seen signs that something was
happening before the actual event.
So log review is important.
Also, we can use intrusion detection and
protection systems, IDPS.
You should monitor them and be wary of false positives,
but also false negatives.
We want to make sure our intrusion
detection systems are tuned properly.
We'll talk more about those later.
Another way to monitor for risk is
to use honeypots and honeynets.
These are devices that are decoys.
They're set aside to look like a vulnerable system,
but instead they contain
detective software that monitors when an attacker does.
Their purpose is distraction,
but also detection of an attack.
Finally, you want to keep in
good communication with your incident response team.
Monitor what they are seeing and use
that as an indicator of a risk that might occur.