📖 What is Baseline?
A Baseline is a documented set of performance and configuration metrics that represent the normal state of a system or network. Analysts use baselines to identify anomalies, which may indicate a security breach, misconfiguration, or system failure.
"You cannot detect an anomaly if you do not have a baseline. Always establish the 'normal' before looking for the 'weird' in traffic."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Baseline?
- ▸ Establishing a baseline requires collecting data over a representative period to ensure that periodic spikes, like weekly backups, are captured as normal behavior.
- ▸ Network baselines typically track metrics such as average bandwidth utilization, common protocols used, and typical traffic patterns between internal segments and external IPs.
- ▸ Configuration baselines provide a known-good state for systems, often based on industry standards like CIS Benchmarks, to ensure consistent security hardening across the enterprise.
- ▸ Anomaly detection relies on comparing real-time telemetry against the established baseline to identify deviations that could signal an ongoing attack or system failure.
- ▸ Baselines must be periodically reviewed and updated to reflect legitimate changes in the business environment, preventing an increase in false positive security alerts.
🎯 How does Baseline appear on the CS0-003 Exam?
You may be asked to analyze a traffic spike in a SIEM dashboard; you must determine if the activity is malicious by comparing the current volume to the established network baseline.
A scenario might describe a system that has drifted from its secure state; you will need to identify the configuration baseline as the reference point for remediation.
Expect questions where you must identify the first step in detecting an insider threat, which involves establishing a behavioral baseline for users to spot unusual data access.
❓ Frequently Asked Questions
Why can't I just use a generic industry baseline for my network?
Industry standards provide a great starting point for configurations, but performance baselines must be unique to your environment because every organization has different traffic patterns and resource needs.
What happens if a baseline is created while a system is already compromised?
This creates a 'poisoned baseline,' where malicious activity is recorded as normal. This is why analysts should verify system integrity before capturing baseline data to ensure accuracy.