Regular review and understanding of the logs produced by these tools and services can enable you to benchmark what is normal and typical for your enterprise, which in turn provides a benchmark to spot unusual or atypical behavior that might indicate an advanced persistent threat or other intrusion.
Correlating log information across various tools and services also provides a timely “pulse” of the threat landscape, which can sometimes have interesting associations to global non-malware-related events.
Most importantly, regular review and understanding of the data can help uncover the elusive “black swan”—the types of surreptitious and malicious events that otherwise could fly below the radar.
The Cisco 4Q11 Global Threat Report released today features data from across Cisco Security Intelligence Operations. This quarter’s contributors were Cisco Intrusion Prevention System (IPS), Cisco IronPort, Cisco Security Research and Operations (SR&O), and Cisco ScanSafe.
Key highlights from the Cisco 4Q11 Global Threat Report include:
- Enterprise users experienced an average of 339 Web malware encounters per month in 4Q11
- An overall average of 362 Web malware encounters per month occurred throughout 2011
- The highest rate of encounters occurred during September and October 2011 at 698 and 697 on average per enterprise, respectively
- An average of 20,141 unique Web malware hosts were encountered per month in 2011, compared to a monthly average of 14,217 in 2010
- During 4Q11, 33 percent of Web malware encountered was zero-day malware not detectable by traditional signature-based methodologies at the time of encounter
- The rate of SQL injection signature events remained fairly steady throughout 4Q11, with a slight decrease observed as the quarter progressed
- Denial of Service events increased slightly over the course of 4Q11
- Global spam volumes continued to decline throughout 2011.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.