Insufficient Monitoring
Insufficient monitoring is the lack of real-time detection and alerting for security events and anomalies, letting attacks go unnoticed for long periods.
Purpose
To understand security monitoring requirements and defenses; the core of security operations and detection-response.
Mechanism
Flaws include no SIEM, no anomaly detection, no alert thresholds, no breach detection. Defenses: SIEM log centralization, UEBA behavior analysis, IDS/IPS, alert runbooks, MTTR targets.
Use cases
- SIEM deployment
- Threat detection
- Security operations