Monitoring & Auditing / Physical Security

System Monitoring vs. Auditing

Monitoring is continuous observation to detect issues or ensure compliance; auditing is a systematic review of logs or systems to verify standards and regulatory compliance.

Core Philosophy of Monitoring & Auditing

Designed under the assumption that system compromise is inevitable, aiming to identify information required during and after an incident.

Functional Order of Security Controls

Deterrence, Denial, Detection, and Delay.

Network Flow Data vs. IDS/IPS Logs

Flow logs capture session metadata (source, destination, port, service) without packet payloads; IDS/IPS logs focus on alerts and full packet-level inspection.

Fence Height Thresholds

3-4 feet deters casual trespassers; 6-7 feet deters most intruders; 8+ feet deters determined intruders.

Linux Server Critical Logs

/var/log/secure, /var/log/messages, and kernel logs.

Windows Standard Log Categories

Application, System, Security, and Setup.

Turnstiles vs. Mantraps

Turnstiles permit one person at a time in a one-way path; mantraps use double interlocking doors to immobilize and authenticate individuals.

Signature-Based vs. Heuristic/Anomaly Detection

Signature-based compares traffic against known malicious patterns; heuristic/anomaly-based establishes a normal baseline to flag unusual actions.

Lock Picking Tools and Roles

Tension wrenches apply rotational torque to hold pins at the shear line; picks manually lift individual pins.

Two Rules of Ethical Lock Picking

1) Always obtain explicit permission before picking; 2) Be aware of state and local laws regarding tool possession.

Auditing

A systematic review of logs, records, or systems to verify compliance with security policies, standards, and regulatory requirements.

Biometric Reader

An internal physical security control that authenticates individuals based on unique biological characteristics.

CCTV (Closed-Circuit Television)

Video surveillance cameras used as visible deterrents and detection tools for perimeter and internal security.

Critical Path Assets

Physical assets vital to an organization's operations, including data centers, network closets, POS terminals, offices, and laptops.

Delay

A functional security control phase focused on slowing down an adversary's progress once access has been attempted or gained.

Denial

A functional security control phase designed to physically block or prevent unauthorized entry into a facility or system.

Detection

A functional security control phase aimed at identifying unauthorized access attempts or system breaches in real time or post-incident.

Deterrence

A functional security control phase intended to discourage potential intruders from attempting a physical or digital compromise.

Driver Pin

The upper set of pins in a pin-tumbler lock resting above the key pins, pushed across the shear line by springs to prevent plug rotation.

Heuristic / Anomaly Monitoring

A monitoring approach that relies on an established baseline of normal behavior to detect abnormal or suspicious activities.

IDS / IPS

Intrusion Detection System / Intrusion Prevention System; security appliances that generate alerts and inspect traffic at the packet level.

Key Pin

The lower set of pins in a pin-tumbler lock that directly contact the key grooves to align at the shear line when the correct key is inserted.

Mantrap

A physical security enclosure featuring two interlocking doors where an individual is immobilized for authentication before entry.

Monitoring

The continuous observation of systems and activities to detect security issues and verify policy adherence.

Network Flows (NetFlow)

Logged session metadata capturing source IP, destination IP, port, and service without packet payload details.

PCI-DSS

Payment Card Industry Data Security Standard; an example of a compliance standard that mandates log retention policies.

Plug

The inner cylindrical core of a mechanical lock into which the key is inserted and which rotates to disengage the lock bolt.

Shear Line

The physical gap between the inner rotating plug and the outer cylinder shell of a pin-tumbler lock.

SIEM

Security Information and Event Management; a centralized system used to aggregate, correlate, analyze, and retain system logs.

Signature-Based Monitoring

A monitoring technique that matches system traffic or activity against known indicators of attack or malicious patterns.

Snap Gun

A mechanical tool used in lock picking that impacts key pins simultaneously to transfer energy to driver pins, momentarily clearing the shear line.

Tensioner / Torsion Wrench

A lock picking tool used to apply rotational torque to the plug, enabling pins to bind along the shear line when lifted.

Turnstile

A physical security barrier that restricts access to a single individual at a time and often enforces one-way transit.

/var/log/secure

A system log file on Linux servers dedicated to recording authentication attempts and authorization activity.