- Introduction
- Determining What Constitutes Normal System Behavior
- Why Characterization Is Important
- 1: Document and Verify Characterization Trust Assumptions
- 2: Characterize Typical Network Traffic and Performance
- 3: Characterize the Expected System Configuration and Performance
- 4: Characterize Expected Process and User Behavior
- 5: Characterize Expected File and Directory Information
- 6: Generate an Inventory of System Hardware
- 7: Recognize the Iterative Nature of Data Collection and Characterization
- 8: Protect Characterization Information, Authoritative Reference Data, and Hardware Inventory to Ensure Their Integrity
- 9: Policy Considerations
Why Characterization Is Important
Characterization is important because it arms the administrator with valuable knowledge about the system. After completing characterization, an administrator knows all of the following:
Expected changes in files and directories and the operating system
Expected processes, when they are run and by whom, and what resources they consume
Expected network traffic consumed and produced
Expected hardware inventory on the system
The following sections explain step by step how to perform characterization for your system.