A security incident response team is alerted to unusual outbound network traffic from several internal workstations to an unknown external IP address. Further investigation reveals that a new, unauthorized process is running on these machines, attempting to establish command-and-control communication. The team needs to quickly identify the type of malware responsible and its communication method. Which security monitoring concept is critical for detecting and analyzing this type of activity?
- AVulnerability Scanning
- BAsset Inventory Management
- CNetwork Flow Data Analysis
- DSecurity Awareness Training
Show answer & explanationAnswer & explanation
Correct answer: C. Network Flow Data Analysis
Network flow data (e.g., NetFlow, IPFIX) provides metadata about network communications, including source/destination IP addresses, ports, protocols, and volume of traffic. Analyzing this data is crucial for detecting command-and-control (C2) communication, identifying unknown external connections, and understanding the scope of network-based attacks without deep packet inspection.
Why the other options are wrong
- A. Vulnerability scanning identifies weaknesses, not active malicious communication.
- B. Asset inventory tracks devices, not live network communication.
- D. Security awareness training educates users, but doesn't directly detect network anomalies.
Network Flow Data Analysis
The process of collecting, storing, and analyzing network flow records (like NetFlow, IPFIX, sFlow) to gain insights into network traffic patterns, identify anomalies, detect security threats (e.g., C2 communication, data exfiltration), and perform network forensics.
- Provides metadata about network conversations (who, what, where, when, how much).
- Does not typically include packet payload content.
- Crucial for detecting C2, lateral movement, and unusual outbound traffic.
Memory trick: Flow data is like looking at the 'who, what, and where' of network conversations, not the actual words.