Continuous monitoring of the organisation’s information and communications technology estate represents the operational intelligence function whose quality determines whether the security programme knows what is happening within its governed environment at the moment when the knowledge is most actionable or discovers what happened after the consequences whose prevention the earlier discovery would have enabled have already been created. The Security Consulting function must advise on the monitoring architecture as one of the most strategically consequential security investments available to the organisation, because the monitoring capability whose quality enables the detection of the security incident in its early stages and the rapid response whose initiation the detection triggers creates the fundamental difference between the contained incident and the catastrophic breach that the detection delay allows to develop into the full-scale compromise whose remediation cost the early detection’s investment would have been a fraction of.
The monitoring programme must be understood by the Security Consulting function and communicated to the business leadership not as the passive recording of events that have already occurred but as the active security intelligence function whose real-time analysis of the ICT environment’s current state creates the situational awareness that the security operations team requires to identify the threats developing within the environment before they achieve the objectives that the adversary’s attack chain is designed to accomplish. The adversary who can operate within the organisation’s environment without the detection whose absence the monitoring gap creates has the unlimited time and the uninhibited movement that the successful attack’s completion requires, while the adversary whose activities the monitoring detects within the hours or the days of their occurrence faces the containment whose interruption of the attack chain the timely response enables.
Developing the Monitoring Framework #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
