Skip to main content

Security+ — Part 7: Monitoring, Logging & Firewalls

Jason J. Boderebe
3 min read
#security-plus #siem #logging #firewalls #network-security #ids #cybersecurity #monitoring
Security+ — Part 7: Monitoring, Logging & Firewalls

Welcome Back!

Monitoring and logging are what separate a security program from a checkbox exercise. Without visibility into what’s actually happening across your systems, every other control is blind. You can have the best firewall in the world, but if you’re not collecting and analyzing logs, you won’t know when something gets through.

This is Part 7 of the Security+ series. Full notes on GitHub.

Monitoring & Logging

Centralized logging aggregates events from across your environment into a single platform where they can be correlated, searched, and alerted on.

Key Principles

  • Centralized logging — collect logs from multiple sources into one place (SIEM)
  • Log retention and integrity — define how long logs are kept, ensure they can’t be tampered with (hashing, WORM storage)
  • Timestamps and normalization — use NTP for time sync and consistent formats so logs from different systems can be correlated
  • Event types — authentication events, access control, system errors, process starts/stops, privilege escalations
  • Alerting and correlation — set thresholds and use behavioral analytics (UEBA) to surface anomalies

Log Sources

  • Firewalls, routers, IDS/IPS
  • Operating systems (Windows Event Logs, syslog)
  • Applications and authentication services
  • Cloud services (AWS CloudTrail, Azure Monitor)

Monitoring Tools

  • SIEM — Splunk, Elastic Stack, Microsoft Sentinel
  • EDR — Endpoint Detection and Response for host-level visibility
  • NetFlow, SNMP, packet capture — network-level traffic analysis

Firewall Technologies

Firewalls control what traffic can enter and leave your network. The type of firewall determines how deeply it inspects traffic.

Firewall Types

TypeHow It Works
Packet-filteringRules based on IP, port, protocol — fast but limited
Stateful inspectionTracks active sessions and connection context
Application-level gateway (proxy)Inspects application-layer payloads
Next-generation firewall (NGFW)Integrates IDS/IPS, deep packet inspection, content filtering

Firewall Placement

  • Perimeter — between the internet and your internal network
  • Internal segmentation — between user VLANs, server zones, and sensitive environments
  • Host-based — controls traffic at the individual system level

Best Practices

  • Implicit deny — block all traffic by default, then explicitly allow what’s needed
  • Use ACLs for segmentation and least privilege access
  • Enable logging on firewall rules — rules you can’t audit are rules you can’t trust
  • Periodically review and clean up rulesets — old rules accumulate and create gaps

Intrusion Detection & Prevention (IDS/IPS)

IDS monitors for malicious behavior and alerts. IPS does the same but can block traffic inline.

Types

  • NIDS (Network IDS) — network-wide visibility, detects scanning, sniffing, and protocol anomalies
  • HIDS (Host IDS) — monitors file changes, registry access, and process behavior on individual hosts
  • Signature-based — matches known attack patterns
  • Anomaly-based — detects deviations from a behavioral baseline

Placement

  • Inline (IPS) — positioned to actively block malicious traffic
  • Tap/mirror port (IDS) — passive detection without the ability to block

Integration

  • Feed IDS/IPS alerts into your SIEM for correlation
  • Trigger automated response playbooks via SOAR

The Snort IDS series covers hands-on IDS setup, and the Splunk series covers SIEM-based detection — both apply these concepts in a real lab environment.

Part 8 covers SSO, privileged access, and identity lifecycle

Stay Curious!