- Introduction
- Determining What Constitutes Normal System Behavior
- Why Characterization Is Important
- 1: Document and Verify Characterization Trust Assumptions
- 2: Characterize Typical Network Traffic and Performance
- 3: Characterize the Expected System Configuration and Performance
- 4: Characterize Expected Process and User Behavior
- 5: Characterize Expected File and Directory Information
- 6: Generate an Inventory of System Hardware
- 7: Recognize the Iterative Nature of Data Collection and Characterization
- 8: Protect Characterization Information, Authoritative Reference Data, and Hardware Inventory to Ensure Their Integrity
- 9: Policy Considerations
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Determining What Constitutes Normal System Behavior
Capturing accurate, reliable, and complete system characterizations when systems are first configured—and periodically as they evolve—establishes a benchmark for normal system behavior. The information that needs to be captured includes a known, expected state for all systems, including network traffic, system and network performance, processes, users, files and directories, and hardware. Other information to be characterized includes past behavior derived from system logs and monitoring tools, which is available once systems have been operational for some period of time. This trusted record is periodically compared against the currently executing system to learn whether something has changed. If it has, the administrator uses the information to judge whether the change is acceptable and expected.