2 cissp ® Official Study Guide Eighth Edition

781
Other Monitoring Tools 
Although logs are the primary tools used with auditing, there are some additional tools 
used within organizations that are worth mentioning. For example, a closed-circuit televi-
sion (CCTV) can automatically record events onto tape for later review. Security personnel 
can also watch a live CCTV system for unwanted, unauthorized, or illegal activities in real 
time. This system can work alone or in conjunction with security guards, who themselves 
can be monitored by the CCTV and held accountable for any illegal or unethical activity. 
Other tools include keystroke monitoring, traffi c analysis monitoring, trend analysis moni-
toring, and monitoring to prevent data loss. 
Keystroke Monitoring
Keystroke monitoring
is the act of recording the keystrokes a user 
performs on a physical keyboard. The monitoring is commonly done via technical means 
such as a hardware device or a software program known as a keylogger. However, a video 
recorder can perform visual monitoring. In most cases, attackers use keystroke monitoring 
for malicious purposes. In extreme circumstances and highly restricted environments, an 
organization might implement keystroke monitoring to audit and analyze user activity. 
Keystroke monitoring is often compared to wiretapping. There is some debate about 
whether keystroke monitoring should be restricted and controlled in the same manner as 
telephone wiretaps. Many organizations that employ keystroke monitoring notify both 
authorized and unauthorized users of such monitoring through employment agreements, 
security policies, or warning banners at sign-on or login areas. 
Companies can and do use keystroke monitoring in some situations. How-
ever, in almost all cases, they are required to inform employees of the 
monitoring.
Traffic Analysis and Trend Analysis
Traffi c analysis
and
trend analysis
are forms of 
monitoring that examine the fl ow of packets rather than actual packet contents. This is 
sometimes referred to as network fl ow monitoring. It can infer a lot of information, such 
as primary and backup communication routes, the location of primary servers, sources of 
encrypted traffi c and the amount of traffi c supported by the network, typical direction of 
traffi c fl ow, frequency of communications, and much more. 
These techniques can sometimes reveal questionable traffi c patterns, such as when an 
employee’s account sends a massive amount of email to others. This might indicate the 
employee’s system is part of a botnet controlled by an attacker at a remote location. Similarly, 
traffi c analysis might detect if an unscrupulous insider forwards internal information to 
unauthorized parties via email. These types of events often leave detectable signatures.