Network security management, monitoring, and incident handling
The exam tests how you keep a network security architecture working day to day: operational control, detection, and a disciplined response when something goes wrong.
Operational management
Configuration baselines, change control, patch and vulnerability management, capacity and availability management belong here. Keep documentation current - architecture, rulesets, data flows - and separate duties so the person who requests a firewall rule is not the person who approves and deploys it.
Monitoring
- Collect logs from network devices, authentication services and security gateways; protect, retain and time-synchronise them so events correlate.
- Detection uses IDS/IPS, flow analysis, SIEM correlation and anomaly detection, each with a defined use case and accountable owner.
- ISO/IEC 27002:2022 controls 8.15 logging, 8.16 monitoring activities and 8.17 clock synchronisation support this.
Incident handling
ISO/IEC 27035 provides the lifecycle: prepare; detect and report; assess and decide; respond by containing, eradicating and recovering; learn. 27002:2022 controls 5.24 to 5.27 mirror this, and 5.28 covers evidence collection. Network specifics matter: isolate segments, block egress at the gateway, preserve flow and device logs before rebuilding, then feed lessons into rule and design changes.
Worked example
IDS flags periodic outbound traffic to an unknown host. Validate the alert against flow logs; scope affected hosts; contain by blocking the destination at the egress gateway and isolating the segment; preserve logs before rebuilding; eradicate the implant; recover; then update firewall rules and add a detection use case. Reasoning: containment precedes eradication to limit spread, and evidence preservation keeps legal or disciplinary options open.
Traps
Collecting logs with no use case or owner; unsynchronised clocks that break correlation; blocking first and destroying evidence; closing an incident without a lessons-learned change to rules, design or monitoring.