Definition
Monitoring, Logging and Runtime Security refers to the continuous observation and recording of system activities and the immediate detection and response to threats during the execution of applications and infrastructure. This involves collecting data from various sources like system logs, network traffic, and application events to establish a baseline of normal behavior. Understanding these activities is crucial for identifying security incidents, troubleshooting issues, and ensuring the integrity of systems and data. For instance, a security team might monitor server logs for unusual login attempts that could indicate a brute force attack. This differs from vulnerability scanning, which identifies potential weaknesses before an attack occurs, whereas runtime security focuses on active threats. Concepts related to monitoring, logging, and runtime security are frequently assessed on certifications such as CompTIA Security+, CySA+, and the CISSP exam.