Security Continuous Monitoring

Summary

Every platform in BeeTcore’s care is monitored continuously from launch, at the edge, application, infrastructure, and access levels. Automated tools collect security events in real time, flag unusual activity, and alert the responsible technical owner. Findings drive the response to incidents and the improvement of controls over time. Monitoring is aligned to the principles of ISO 27001 and to the logging and alerting expectations of the OWASP Top 10.

1. Scope and approach

Monitoring starts on launch day and runs for as long as BeeTcore looks after a platform. It is automated, layered, and continuous, so no single tool is relied on to catch everything. The tools used follow each platform’s stack, as confirmed in its project agreement.

2. What is monitored

• Edge: Cloudflare monitors traffic patterns, firewall events, DDoS activity, bot traffic, and DNS.
• Application (WordPress platforms): Wordfence and MalCare monitor firewall events, login attempts, malware, unexpected file changes, and vulnerable plugins or themes.
• Application (custom builds): real-time error tracking, application performance monitoring, and alerts on vulnerable dependencies.
• Infrastructure: uptime, real-time server resource and performance metrics, and server logs.
• Access: administrator logins, new administrator accounts, and changes to user permissions.

3. Log collection and correlation

Security events are collected in real time as they happen. Logs from each layer are centralised where the platform supports it, and reviewed together, so patterns that no single tool would show become visible. For example, a traffic spike at the edge can be linked to a wave of failed logins at the application.

4. Alerts and triage

Unusual activity triggers an alert to the responsible technical owner, who assesses it and, where it is an incident, classifies it under the Incident Management Response Strategy. Where a client runs its own security operations team or security information and event management (SIEM) platform, BeeTcore’s alerts can feed into it.

5. Vulnerability monitoring

Published vulnerabilities and security advisories for every component in use, including plugins, themes, packages, and platform cores, are monitored continuously. Fixes are applied as set out in the Cloud Security Framework and the Change Management Framework.

6. Keeping monitoring effective

Monitoring tools are kept updated with the latest threat intelligence and detection rules. Alert thresholds and rules are tuned as lessons are learned, so real threats stand out from routine noise.

7. Reporting

Monitoring data is analysed for trends and emerging risks. Reporting is defined for each engagement and can be tailored to the client:

• Regular reports: where an engagement includes scheduled reporting, each report summarises security status, including vulnerabilities found, patches applied, and the platform’s overall security standing.
• Detailed security reports: available on request.
• Custom reporting: scope, format, and timing can be tailored and confirmed in the project agreement.

8. Response and post-analysis

Confirmed threats are contained and resolved under the Incident Management Response Strategy. Security logs are preserved as evidence for investigation and post-incident review, and the lessons feed into Continuous Service Improvement.

9. Review

This document is reviewed annually and whenever monitoring tools or platforms change significantly.

Frequently asked questions