Threats Mitigated by Monitoring and Operations
🌟 Objective
To map the attack vectors that can be detected, anticipated or correlated by the practices described in this chapter, contributing to response capacity and to the improvement of the security posture.
📊 Threat categories addressed
| Category (OSC&R / ATT&CK) | Summary description |
|---|---|
| Credential abuse | Use of compromised passwords or tokens |
| Brute force / guessing | Repeated authentication attempts |
| Privilege escalation / tampering | Improper elevation or alteration of permissions |
| Access abuse / insider misuse | Illegitimate use of valid access |
| Data exfiltration | Unauthorised outflow of data |
| Pipeline compromise | Improper execution in CI/CD pipelines |
| Configuration tampering | Modification of parameters or secrets |
| Availability sabotage (DoS) | Suspicious inactivity, loss of logs, sabotage |
🔍 Mapping practices → mitigated threats
| Monitoring practice | Mitigated threats |
|---|---|
| Logging of authentications and failures | Brute force, credential abuse |
| Alerts for out-of-profile logins | Insider misuse, improper use |
| Correlation: role change + config change | Privilege escalation, tampering |
| Monitoring of uploads/downloads | Exfiltration, lateral movement |
| Detecting unusual executions in the pipeline | Compromise in CI/CD |
| Logging of structured exceptions | Reconnaissance, probing, bug hunting |
| Alert on loss of logs or inactivity | Sabotage, forwarding tampering |
📄 Examples of practical coverage
| Identified threat | Indicative event(s) | Associated practice |
|---|---|---|
| Brute force | >10 failures in 3 min from one IP | Threshold alerts, auth logs |
| Compromised token | Login with a valid token outside the usual country | Correlation with IP/geolocation |
| Privilege abuse | User creation + secret change | Logging + correlation between sources |
| Silent exfiltration | High data transfer off-hours | Behavioural detection |
| Log sabotage | Loss of logs + change to the forwarder config | Inactivity alerts + system logs |
✅ Final recommendations
- Use this mapping as the basis for the justification of monitoring controls;
- Relate directly to OSC&R / MITRE ATT&CK in coverage plans and threat modelling;
- Prioritise threats with high impact and low visibility without active logging.
🧠 Monitoring is not blocking - it is detecting and reacting in time. Visibility is the first step of resilience.