Network monitoring, maintenance and IT policies: SNMP, schedules, AUP, DR/BCP and change management

Network monitoring

Network monitoring means continuously watching a network with specialised software to make sure devices and services are available and performing well. Monitoring systems check routers, switches, firewalls, servers and links, and spot slow or failing components before users complain.

What a monitoring system does

• Detects and reports failed devices and connections.
• Measures CPU and memory use on devices, and bandwidth use on links.
• Sends regular test messages to check that each device still responds.
• Raises alerts by email, text message or dashboard when something fails, slows down or behaves unexpectedly.

Monitoring a single computer

On Windows, open Task Manager (Ctrl + Shift + Esc) and select the Performance tab to see CPU, memory, disk and network use. Resource Monitor gives more detail. Running out of any resource makes a computer slow and hard to use.

Tools

ping is the simplest monitoring tool. Larger networks use dedicated monitoring platforms (open-source and commercial options exist) and external website-monitoring services that test sites from around the world.

SNMP

The Simple Network Management Protocol is the most widely used monitoring protocol. It has three parts:

• the managed devices being monitored;
• an agent (software) on each device;
• a Network Management System (NMS) that collects and displays the information.

With SNMP, administrators can measure bandwidth use, poll devices for status at regular intervals, receive alerts (traps) when a device fails or a disk is nearly full, and collect error data for troubleshooting. Always use SNMPv3, which adds authentication and encryption.

System maintenance

Regular maintenance keeps systems running smoothly and reduces the risk of breakdowns. Because services must be available most of the time, organisations agree fixed maintenance windows, usually when few people are working, and warn users in advance.

Always back up configurations before changes and have a rollback plan.

Policies and procedures

Policies set the rules and boundaries for decisions and actions in an organisation; procedures are the step-by-step methods that put policies into practice day to day.

Acceptable Use Policy (AUP)

Tells everyone how they may use the organisation's technology, including computers, servers, email and internet access. A typical AUP covers:

• access to and use of computer resources, and remote access;
• monitoring, and the fact that users should have no expectation of privacy on company systems;
• responsibility for passwords and computer security;
• bans on illegal copying, inappropriate or unlawful material and misrepresenting identity;
• standard email footers and the duty not to waste resources.

Security awareness

Regularly reminds users how their actions affect security and privacy. Security incidents and their costs keep rising; training, blocking unnecessary access, and detecting incidents early all reduce the risk. See phishing basics.

Information security policy

The foundation for managing data risk across people, process and technology. Related policies cover system and information access control, issuing user IDs, anonymous IDs and the password policy.

Disaster Recovery and Business Continuity (DR/BCP)

Makes sure the organisation has accurate, tested plans for disruptions: cyber attacks such as denial of service or ransomware, fires, floods, storms and power loss. Disaster recovery restores IT systems; business continuity keeps the business running throughout, using redundant systems and staff plans.

Change management

Makes sure every change is planned, approved, tested and recorded. Without it, a quick firewall update can suddenly block business traffic, or open a hole that leaks data. Unexpected things often happen during changes, so a rollback plan is essential.

Real-world example: a school catches a failing link early

A fictional secondary school monitored its switches and internet link with SNMP and sent alerts to the IT technician's phone. One morning the system flagged a rising number of interface errors on the fibre uplink to the science block, although nobody had complained yet. The technician cleaned and reseated the fibre connectors during the lunch break and the errors stopped. Two weeks later the same monitoring showed the internet link at full capacity every afternoon; flow data traced it to automatic game updates on the guest Wi-Fi. The acceptable use policy already banned gaming on school networks, so the technician blocked the update servers on the guest network and reminded users of the policy.