Who is watching? Protection

• Remote system monitoring
• Real-time intrusion detection and response
• Layers of monitoring
• Storing monitored data on other systems to protect against tampering
• Anomaly detection — look for unusual behavior
• Use IDS rules that detect audit trail tampering