CertaDNS
Skip to lesson

What Detection Misses · lesson 2 of 2

The failure mode nobody budgets for

After this lesson you can

Explain why a monitoring programme that finds everything protects nothing.

Assumes you have read What monitoring cannot see.

The most common way a domain monitoring programme fails is not missing something. It is finding everything, alerting on all of it, and being switched off in month four.

How it happens

Month 1   Monitoring goes live. Everything is watched,
          because narrowing felt like accepting risk.
          400 alerts in the first week.

Month 2   Someone builds a filter. 120 a week.
          Most are parked domains and renewals.

Month 3   The channel is muted during a busy period.
          Nobody unmutes it.

Month 4   An incident. The domain was in the queue,
          detected on day one, position 340.

Month 5   A review concludes monitoring was inadequate
          and recommends broader coverage.

The last step is the one that makes it a cycle. The instinct after a miss is to widen the net, and widening the net is what caused the miss.

The numbers that indicate health

MetricHealthyWhat an unhealthy value means
Alerts requiring a human per weekSingle figuresAbove twenty, they are being skimmed rather than read.
Fraction leading to actionA meaningful shareUnder a few percent, the rules are matching the wrong things.
Time from detection to triageHoursDays means the queue is a backlog rather than a workflow.
Findings closed with a recorded reasonNearly allA queue that only grows is one people stop opening.
Repeat findings for the same domainNear zeroClosure is not being recorded, so the same work repeats.

What prevents it

  • Two tiers, explicitly. A small set of conditions that page someone — new name plus resolving plus MX or a fresh certificate — and everything else in a queue reviewed on a schedule.
  • Closure with a reason, always. It is the only thing that stops the same domain consuming an hour every cycle.
  • Suppress your own renewals. They are usually the largest single source of volume and carry no information.
  • Review the scope quarterly against what was actually acted on, and cut what has never produced anything.

Narrowing scope is a decision, not an oversight

Every exclusion should be written down with its rationale, because after an incident the exclusions are what gets examined. Recorded, it is a decision to revisit with new information. Unrecorded, it is a gap somebody has to account for — and the reflex will be to widen the net again.

Last reviewed