0

For Windows-based systems, I have seen that changes to the Registry or System Directories are some of the things which are used to track if a machine has been compromised. Similar things must exist for other platforms- and I must admit that I am unaware of them.

My curiosity here is that what are the best metrics which a security personnel may want to leverage (at the host itself or at the Network-admin level) to decide whether a system has been compromised, and do them in an OS-agnostic way? That is, these metrics should not change - irrespective of Windows, *nix, Mac, or handheld devices with Android etc.

Improve this question

1 Answer 1

Reset to default
1

There is no simple set of metrics I'm afraid. Modern computers are designed to be general purpose and so are very complex.

Modern compromises may also be complex. Many Windows compromises are very hard to detect and certainly wouldn't touch the registry.

Some changes to look for across systems are:

  • Changes to the boot sector
  • Changes to system files that don't match controlled updates
  • Changes to configuration files that don't match controlled updates

From this, you can probably recognise that you need to have very tight change controls and methods to track changes.

Improve this answer
2
  • Another area to look for is to monitor network traffic. This could be as simple as verifying active connections using netstat for over a period of time.
    – ciphercodes
    Commented Jun 14, 2014 at 16:06
  • Yeah it is not expected to be a simple set of metrics- and it may be difficult to be comprehensive as well! Monitoring network traffic will surely figure here, as @ciphercodes said.
    – pnp
    Commented Jun 14, 2014 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .