Detecting Suspicious and Malicious Activity on Your Network

It’s a virtual certainty today that an organization will face security incidents. Technology constantly shifts, evolves, and expands attack surfaces, while threat actors adapt and escalate the threat landscape. Cybersecurity is an ongoing struggle to deal with changes from both sides of that equation. The question is, how can you detect suspicious activity quickly and respond effectively to avoid or minimize potential damage?

There are a variety of tools designed with this purpose in mind including Intrusion Detection System (IDS), Intrusion Prevention System (IPS), Data Loss Prevention (DLP), Security Incident and Event Management (SIEM), and Network Behavior Anomaly Detection (NBAD). Some are evolutions or enhancements of other tools; others are narrowly focused on specific types of behavior or malicious activity. By utilizing these network security tools, organizations can identify and respond to suspicious or malicious threat actors within their networks quickly. They serve as early warning signs, alerting the security operations center (SOC) team to potential threats and execute an effective response. Using a combination of these tools empowers SOC members to detect unauthorized access attempts, monitor network traffic patterns, prevent data breaches, and analyze log data for threat patterns and anomalies.

In this blog, we’ll go into detail on what each of these network security tools does. To make it easier to visualize, an analogy of protecting a home will demonstrate the purpose of each tool in our infrastructure.

Network Security Tools Overview

IDS

IDS, considered by many as the pioneering tool of the set, holds a significant role in the cybersecurity landscape. An IDS monitors vulnerabilities in a system and analyzes activity on the network to search for indicators of compromise and correlated signatures of known threats. There are two main types of IDS: Network Intrusion Detection System (NIDS) monitors an entire subnet at the network level, while Host Intrusion Detection System (HIDS) protects an individual host system. While IDS plays a crucial role in detecting and notifying of suspicious or malicious activities, it does not possess the capability to prevent or mitigate threat actors. Its primary role is raising awareness and generating alerts — responsibility falls on the SOC team to take the appropriate actions.

IDS acts like a vigilant security camera system installed around your home. Its purpose is to monitor all the areas of the home, looking for unusual or suspicious activity. For example, if someone attempts to pick the door locks or tamper with windows, the IDS will notify you or a security guard to the intrusion.

IPS

IPS is an evolution of IDS. While sharing similarities with an IDS in terms of functionality and capabilities, IPS introduces an additional step. It provides the means to not only detect but also take proactive measures such as blocking or isolating a host to prevent an attack from occurring. IPS serves as the first bridge crossing over from detection into response. The value of IPS lies in being proactive to take action upon detection. Due to real-time, response-based actions, the window of opportunity for a threat activation is minimized or altogether mitigated before they can cause serious harm.

IPS goes one step further from our original cameras. This would equate to installing a proactive security system with the ability to lock doors, detect motion, and trigger sound-based alarms to ward off intruders. The IPS goal is to lock down and prevent access into the home from ever happening in the first place.

DLP

For most organizations, the most important thing is to safeguard data. Data is also the primary target of most attacks — whether it’s customer bank or credit card information, sensitive personal data of employees, or confidential intellectual property and corporate data. Data Loss Prevention — sometimes referred to as Data Leak Prevention — emerged as a specialized discipline within cybersecurity that focuses specifically on securing data. The goal of the discipline is to ensure sensitive or confidential data retains integrity and remains confidential throughout its lifecycle.

Generally, DLP can enforce data-handling policies depending on how data is tagged or classified. By appropriately tagging or classifying data, organizations can implement policies that govern its transmission, access, usage, and storage. DLP tools provide the means to enforce these policies to ensure that data is handled based on predefined security guidelines. As a secondary layer of defense, DLP can deploy algorithms and pattern-matching techniques to automatically detect sensitive information, such as credit card numbers or Social Security numbers based on predefined data formats. Deploying DLP tools enables organizations to establish a firm data protection framework and safeguard critical information.

Picture DLP as our secure lockbox or safe where you keep your most valuable possessions or sensitive documents. The safe ensures these items are securely stored and protected from theft or accidental loss. Everything within the safe is cataloged and access to the safe only is provided to the home’s residents. Further, enforcement of access to the safe is secured by using multiple methods to open the safe such as biometric data and lockbox pin which only is given to the home’s residents.

SIEM

SIEM tools act as a central hub, collecting and analyzing security event logs and data from non-consolidated sources across your infrastructure. By consolidating these diverse log sets, SIEM provides a centralized point of view of the organizations logs. With a more centralized view comes more efficient monitoring, correlation, and analysis of security incidents and events. At its core, SIEM detects for potential incidents and events in real time. Through continuous monitoring of network activity, SIEM uses correlation signatures, analytics, and threat intel to identify patterns, threats, and indicators of compromise. As incidents are detected, SIEM tools promptly alert the SOC team to take appropriate action. SIEM builds on the concepts of IDS and expands by integrating far more log sources than solely host and network-based logs.

SIEM would be like a home security smart application on our phone. It integrates with the other aforementioned security devices such as the cameras, security system and safes and monitors the data coming from these devices. This provides us with real-time insight into the actual state and security of the home. Any unusual activity or movement from any of the tools employed and our smart app would trigger alerts for us to take action.

NBAD

One way to identify suspicious or malicious activity is to simply look for out-of-the-ordinary activity. Through continuous analysis of network patterns, NBAD aims to identify any unusual or abnormal activities, events, or trends that may indicate potential security threats. As an evolution of traditional SIEM signature-based detection methods that rely on known indicators of compromise or threat signatures, NBAD proactively focuses on anomaly detection. This means it looks for deviations from an established baseline of normal network and user behavior, rather than for pre-defined signatures or patterns. By using this approach, NBAD can assist in identification of emerging threats and zero-day attacks where dependence on traditional signatures is ineffective due to the absence of known patterns or signatures. The traditional means of detection by NBAD tools is leveraging machine learning based algorithms, statistical analysis, and behavioral modeling built on baselines.

NBAD is the equivalent of taking all our devices above and swapping them out for smart devices. Our cameras now detect whether someone approaching the home is familiar or a resident through facial recognition. Safe access is only given to users who typically should have access to the contents inside and at set hours. Access outside typical hours or a resident who does not normally have access would violate the normal patterns of behavior. A baseline of typical home resident activities is created and any deviation, such as a door unlocked when no one is home or smart lights turning on/off during an unspecified time, triggers an event.

Take Action to Combat Malicious Activity

Each of these tools has its own pros and cons. The effectiveness of each tool generally is a function of how well it is implemented and configured. Ultimately, what is more important than the tool itself or the suspicious or malicious activity it detects is whether or not you have the right expertise and resources available to respond appropriately.

Properly configured network security tools are valuable for monitoring and analyzing an enormous volume of traffic in a rapidly changing hybrid or multi-cloud environment to sift through the noise and find the potentially malicious. But with any malicious network activity report, there are also inevitably false positives and potential threats that slip through. With a team of cybersecurity experts and the right solution on your side, such as Fortra’s Alert Logic Managed Detection and Response (MDR), you’ll have continuous monitoring of the output of your network security tools to determine which alerts require action and know what immediate steps you need to take to prevent or contain the threat.