A municipal SOC suspects slow, low-and-slow abuse against wireless authentication. Which audit technique best looks for that pattern over time?
Select an answer to reveal the explanation.
Short Explanation
Slow-burn attacks hide in the long movie, not the five-minute trailer. Dig through months of RADIUS and WIPS logs to see the pattern. Short captures alone miss the drip-drip story.
Full Explanation
Detecting slow, low-and-slow abuse against wireless authentication in a municipal Security Operations Center (SOC) requires analyzing system logs over an extended period, such as 90 days. This approach leverages RADIUS authentication logs and Wireless Intrusion Prevention System (WIPS) event data to identify subtle patterns of repeated failed authentications, suspicious MAC addresses, or anomalous behavior that may not be evident in short-term snapshots. Long-term log analysis enables correlation of events, trend detection, and identification of stealthy attacks designed to evade immediate detection. Relying solely on a five-minute live packet capture misses historical context and the cumulative nature of slow attacks. Deleting RADIUS logs weekly eliminates the forensic trail necessary to reconstruct attack patterns, undermining incident response capabilities. Analyzing only wired point-of-sale logs in unrelated areas like cafeterias ignores the wireless authentication layer where the abuse occurs, rendering the audit ineffective. The audit scope should include all relevant wireless authentication and intrusion detection logs, retained for sufficient duration to enable meaningful analysis. Operationally, SOC analysts should aggregate and parse RADIUS and WIPS logs, apply anomaly detection algorithms, and generate alerts for suspicious authentication patterns over multi-month windows.