Those access controls can also be so restrictive as to make the asset they're protecting worthless to the authorized users of that asset. So the bottom line is that through mistakes or limitations in resources, access controls will be foiled. If our preventative measures sometimes fail, we need to have detection and response mechanisms. We do this with things like logs, audits, and monitoring systems. These can be broken down into several areas.
System processes that monitor internal logs, files, and operations.
Computers like sniffers that listen to the wire for unusual traffic patterns or content. Network components like routers and firewalls that monitor internal traffic patterns, content, logs, and operations. Computers that remotely check other systems for vulnerabilties.