[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.6.c
AP Cybersecurity · Securing Applications and Data
Evaluating a Data Detection Method
Judge it on speed — and on what it structurally cannot see.
key ideaEvaluate on speed and on what the method structurally cannot see.
The criteria
Two questions decide the value of a data detection method. How fast does it tell you — during the attack, or afterwards? And what class of attack is it incapable of noticing? The second is where the honest limitations live.
| Method | Speed | Note |
|---|
| honeypots | near instantaneous | access is the alert; there is nothing to analyze |
| real-time automated log analysis | during the attack | log analysis needs automation to operate at an effective speed |
| some DLP tools | during the attack | alerts allow a prompt response that can stop the attack before more harm |
| retrospective log review | after the fact | valuable for investigation; too late to prevent |
| periodic hash comparison | after the fact | detects alteration whenever the check next runs |
Manual log review is not on this list by accident. Log analysis needs to be augmented with some automation to operate at an effective speed — unautomated, it is retrospective whatever the intention.
| Method | What it structurally cannot detect |
|---|
| cryptographic hash | viewing or stealing data without altering it — a hash only detects alteration |
| honeypot | an adversary who goes straight to the real data and never touches the bait |
| retrospective review | anything, in time to act on it |
| DLP | exfiltration by a route the tool does not monitor |
Row 1 is the CED's own example of a false negative: an adversary could view and steal data without altering it, and the hash would report no change. The check is working; the attack is simply outside what it measures.
Comparing the options
Both columns are worth having, and they answer different questions. Only the left column can change the outcome of the attack you are currently having.SPEEDDo you need to stop the attack, or explain it?Honeypots offer near instantaneous detection. Some DLP tools and real-time automated log analysis provide alerts as an attack is happening, allowing a prompt response that can stop it before it does more harm.
AUTOMATIONIs log analysis part of the plan?To operate at an effective speed, log analysis needs to be augmented with some automation. A plan that depends on someone reading logs is a plan for retrospective detection, whatever it intends.
FALSE NEGATIVESWhat can this method not see?Cryptographic hash functions only detect if data have been altered. An adversary could view and steal data without altering it — and the hash would correctly report no change. Ask this question of every method you deploy.
COVERAGEDoes anything catch reading?If the answer is no, the design detects integrity failures and is blind to confidentiality ones. A honeypot or access logging closes that gap cheaply.
BALANCEWhat does a defensible design look like?Something real-time for prompt response, something retrospective for investigation, and at least one control that notices reading — because most of the cheap methods only notice change.
Worked analysis
EX 1
The hash that reported nothing wrong
A quarterly hash check finds no alteration. The following month it emerges that a competitor has the design files. Explain.
1
State what the hash measured
Whether the data had been altered.
2
State what happened instead
The files were read and copied, unchanged.
3
Name the outcome
A false negative — the CED's own example.
4
Note that nothing malfunctioned
The check was correct. It simply does not measure this.
5
Give the missing control
A honeypot or access logging — something that notices reading rather than change.
EX 2
Why automation changes the category
An organization collects excellent logs and has an analyst review them weekly. Evaluate the speed.
1
Note what exists
The data to detect an attack are present.
2
Note the cadence
Weekly review means detection lags by up to seven days.
3
Apply the CED point
To operate at an effective speed, log analysis needs to be augmented with some automation.
4
Classify what they have
Retrospective detection — useful for investigation, useless for interruption.
5
Give the upgrade
Real-time automated log analysis for the highest-value signals, keeping the weekly review for depth.
EX 3
Design a defensible mix
A firm holds client financial records. Propose a detection design and justify it on both criteria.
1
Cover speed
Honeypots in the record shares — near-instantaneous, and inexpensive.
2
Add real-time analysis
Automated log analysis on access to those shares, alerting as an attack is happening.
3
Cover integrity
Hash comparison on the records, to detect alteration a reader would not cause.
4
Name the residual gap
Exfiltration by an unmonitored route — which is where DLP earns its cost for financial data.
5
State the justification
Fast enough to interrupt, complete enough to investigate, and no single method left to cover reading alone.
Check yourself
Which methods detect an attack as it is happening?
Show answer
Some DLP tools, honeypots, and real-time automated log analysis provide alerts as an attack is happening — allowing a prompt response that can stop it before more harm.
Why does log analysis need automation?
Show answer
To operate at an effective speed. Unautomated review lags by hours or days, which makes it retrospective regardless of intent.
How fast are honeypots?
Show answer
Near instantaneous — access to the file is itself the alert, so there is no analysis step in between.
Give the CED's example of a false negative in data detection.
Show answer
Cryptographic hash functions only detect if data have been altered. An adversary could view and steal data without altering it, and the hash would report no change.