As part of an effort to implement a control on E-mail and Web Protections, an organization is monitoring their webserver traffic. Which event should…

A web server failing to respond to a SYN packet for an extended period, such as 30 minutes, is a critical indicator of a service outage. This event signifies that the server is unable to establish new TCP connections, which is its primary function. The cause could be a server crash, a network failure, a misconfigured firewall, or a Denial of Service (DoS) attack, such as a SYN flood, which exhausts the server's connection resources. Monitoring for this condition is a fundamental aspect of web protection, as it directly relates to the availability of the service, a core tenet of information security (Confidentiality, Integrity, Availability).

A. An increase in website hits above the daily average is an anomaly but could be due to legitimate reasons like a marketing campaign. It requires correlation, not an immediate alert.

B. Log file rotation and archiving is a routine, scheduled administrative task necessary for system maintenance and is not indicative of a security incident.

D. A server sending a TCP Reset (RST) packet to terminate an idle connection is standard protocol behavior for managing resources and preventing session exhaustion.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 2.3.2, "Events," and Table 2-2, "Examples of Incident Indicators," categorize "Disruption of service" as a primary indicator of a security incident. A server not responding to SYN packets is a clear disruption of service.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 3, Section 3.5, "Connection-Oriented Transport: TCP," the text describes the three-way handshake (SYN, SYN-ACK, ACK) as the required process for establishing a connection. A failure at the first step (responding to a SYN) indicates a complete inability to provide service. The text also describes DoS attacks, including the SYN flood attack, where attackers overwhelm a server with SYN packets, preventing it from responding to legitimate requests.

3. Internet Engineering Task Force (IETF) RFC 4987, TCP SYN Flooding Attacks and Common Mitigations. Section 2, "The TCP SYN Flooding Attack," describes how this attack consumes server resources, leading to a state where "the server is unable to accept new, legitimate connections." The scenario in the question—a server not responding to SYN packets—is the direct symptom of such an attack or a similar availability failure.

4. Fall, K. R., & Stevens, W. R. (2011). TCP/IP Illustrated, Volume 1: The Protocols (2nd ed.). Addison-Wesley Professional. Chapter 13, "TCP Connection Management," details the normal processes for connection establishment and termination. It explains that a TCP Reset (RST) is a valid mechanism for a host to close a connection, including when a timeout is reached, confirming that option D is normal behavior.