+SI-04 [H] System Monitoring
---+SI-04(02) [H] Automated Tools and Mechanisms for Real-time Analysis
---+SI-04(04) [H] Inbound and Outbound Communications Traffic
---+SI-04(05) [H] System-generated Alerts
---+SI-04(10) [H] Visibility of Encrypted Communications
---+SI-04(12) [H] Automated Organization-generated Alerts
---+SI-04(14) [H] Wireless Intrusion Detection
---+SI-04(20) [H] Privileged Users
---+SI-04(22) [H] Unauthorized Network Services
|
SI-04 [H] System Monitoring
Control
- Monitor the system to detect:
- Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignement: monitoring objectives] ; and
- Unauthorized local, network, and remote connections;
- Identify unauthorized use of the system through the following techniques and methods: [Assignement: techniques and methods];
- Invoke internal monitoring capabilities or deploy monitoring devices:
- Strategically within the system to collect organization-determined essential information; and
- At ad hoc locations within the system to track specific types of transactions of interest to the organization;
- Analyze detected events and anomalies;
- Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
- Obtain legal opinion regarding system monitoring activities; and
- Provide [Assignement: system monitoring information] to [Assignement: personnel or roles] [Selection(one-or-more): as needed; {{ insert: param, si-04_odp.06 }} ].
Discussion
System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software.
Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Assessment Objective
- the system is monitored to detect attacks and indicators of potential attacks in accordance with [Assignement: monitoring objectives];
- the system is monitored to detect unauthorized local connections;
- the system is monitored to detect unauthorized network connections;
- the system is monitored to detect unauthorized remote connections;
- unauthorized use of the system is identified through [Assignement: techniques and methods];
- internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information;
- internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization;
- detected events are analyzed;
- detected anomalies are analyzed;
- the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
- a legal opinion regarding system monitoring activities is obtained;
- [Assignement: system monitoring information] is provided to [Assignement: personnel or roles] [Selection(one-or-more): as needed; {{ insert: param, si-04_odp.06 }} ].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
continuous monitoring strategy
facility diagram/layout
system design documentation
system monitoring tools and techniques documentation
locations within the system where monitoring devices are deployed
system configuration settings and associated documentation
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
1. Преглед
| Наименование |
Стандарт |
|
SI-04(02) [H] Automated Tools and Mechanisms for Real-time Analysis
|
Control
Employ automated tools and mechanisms to support near real-time analysis of events.
Discussion
Automated tools and mechanisms include host-based, network-based, transport-based, or storage-based event monitoring tools and mechanisms or security information and event management (SIEM) technologies that provide real-time analysis of alerts and notifications generated by organizational systems. Automated monitoring techniques can create unintended privacy risks because automated controls may connect to external or otherwise unrelated systems. The matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.
Assessment Objective
automated tools and mechanisms are employed to support a near real-time analysis of events.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system audit records
system security plan
privacy plan
privacy program plan
privacy impact assessment
privacy risk management documentation
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security and privacy responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for incident response/management
|
|
SI-04(04) [H] Inbound and Outbound Communications Traffic
|
Control
- Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;
- Monitor inbound and outbound communications traffic [Assignement: organization-defined frequency] for [Assignement: organization-defined unusual or unauthorized activities or conditions].
Discussion
Unusual or unauthorized activities or conditions related to system inbound and outbound communications traffic includes internal traffic that indicates the presence of malicious code or unauthorized use of legitimate code or credentials within organizational systems or propagating among system components, signaling to external systems, and the unauthorized exporting of information. Evidence of malicious code or unauthorized use of legitimate code or credentials is used to identify potentially compromised systems or system components.
Assessment Objective
- criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined;
- criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined;
- inbound communications traffic is monitored [Assignement: frequency] for [Assignement: unusual or unauthorized activities or conditions];
- outbound communications traffic is monitored [Assignement: frequency] for [Assignement: unusual or unauthorized activities or conditions].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system protocols
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
|
|
SI-04(05) [H] System-generated Alerts
|
Control
Alert [Assignement: personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignement: compromise indicators].
Discussion
Alerts may be generated from a variety of sources, including audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be automated and may be transmitted telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the alert notification list can include system administrators, mission or business owners, system owners, information owners/stewards, senior agency information security officers, senior agency officials for privacy, system security officers, or privacy officers. In contrast to alerts generated by the system, alerts generated by organizations in [SI-4(12)](#si-4.12) focus on information sources external to the system, such as suspicious activity reports and reports on potential insider threats.
Assessment Objective
[Assignement: personnel or roles] are alerted when system-generated [Assignement: compromise indicators] occur.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system monitoring tools and techniques documentation
system configuration settings and associated documentation
list of personnel selected to receive alerts
documentation of alerts generated based on compromise indicators
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security and privacy responsibilities
system developers
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel on the system alert notification list
organizational personnel responsible for the intrusion detection system
|
|
SI-04(10) [H] Visibility of Encrypted Communications
|
Control
Make provisions so that [Assignement: encrypted communications traffic] is visible to [Assignement: system monitoring tools and mechanisms].
Discussion
Organizations balance the need to encrypt communications traffic to protect data confidentiality with the need to maintain visibility into such traffic from a monitoring perspective. Organizations determine whether the visibility requirement applies to internal encrypted traffic, encrypted traffic intended for external destinations, or a subset of the traffic types.
Assessment Objective
provisions are made so that [Assignement: encrypted communications traffic] is visible to [Assignement: system monitoring tools and mechanisms].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system protocols
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
|
|
SI-04(12) [H] Automated Organization-generated Alerts
|
Control
Alert [Assignement: personnel or roles] using [Assignement: automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignement: activities that trigger alerts].
Discussion
Organizational personnel on the system alert notification list include system administrators, mission or business owners, system owners, senior agency information security officer, senior agency official for privacy, system security officers, or privacy officers. Automated organization-generated alerts are the security alerts generated by organizations and transmitted using automated means. The sources for organization-generated alerts are focused on other entities such as suspicious activity reports and reports on potential insider threats. In contrast to alerts generated by the organization, alerts generated by the system in [SI-4(5)](#si-4.5) focus on information sources that are internal to the systems, such as audit records.
Assessment Objective
[Assignement: personnel or roles] is/are alerted using [Assignement: automated mechanisms] when [Assignement: activities that trigger alerts] indicate inappropriate or unusual activities with security or privacy implications.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
list of inappropriate or unusual activities with security and privacy implications that trigger alerts
suspicious activity reports
alerts provided to security and privacy personnel
system monitoring logs or records
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security and privacy responsibilities
system developers
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
|
|
SI-04(14) [H] Wireless Intrusion Detection
|
Control
Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
Discussion
Wireless signals may radiate beyond organizational facilities. Organizations proactively search for unauthorized wireless connections, including the conduct of thorough scans for unauthorized wireless access points. Wireless scans are not limited to those areas within facilities containing systems but also include areas outside of facilities to verify that unauthorized wireless access points are not connected to organizational systems.
Assessment Objective
- a wireless intrusion detection system is employed to identify rogue wireless devices;
- a wireless intrusion detection system is employed to detect attack attempts on the system;
- a wireless intrusion detection system is employed to detect potential compromises or breaches to the system.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system protocols
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
|
|
SI-04(20) [H] Privileged Users
|
Control
Implement the following additional monitoring of privileged users: [Assignement: additional monitoring].
Discussion
Privileged users have access to more sensitive information, including security-related information, than the general user population. Access to such information means that privileged users can potentially do greater damage to systems and organizations than non-privileged users. Therefore, implementing additional monitoring on privileged users helps to ensure that organizations can identify malicious activity at the earliest possible time and take appropriate actions.
Assessment Objective
[Assignement: additional monitoring] of privileged users is implemented.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
|
|
SI-04(22) [H] Unauthorized Network Services
|
Control
- Detect network services that have not been authorized or approved by [Assignement: authorization or approval processes] ; and
- [Selection(one-or-more): audit; alert {{ insert: param, si-04.22_odp.03 }} ] when detected.
Discussion
Unauthorized or unapproved network services include services in service-oriented architectures that lack organizational verification or validation and may therefore be unreliable or serve as malicious rogues for valid services.
Assessment Objective
- network services that have not been authorized or approved by [Assignement: authorization or approval processes] are detected;
- [Selection(one-or-more): audit; alert {{ insert: param, si-04.22_odp.03 }} ] is/are initiated when network services that have not been authorized or approved by authorization or approval processes are detected.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
documented authorization/approval of network services
notifications or alerts of unauthorized network services
system monitoring logs or records
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
|
1.1 Препратки
1.2 Идентифицирани изисквания
1.3 Свързани регулации
2. Идентифицирани изисквания
Изисквания
| Източник |
Изискване |
3. Свързани регулации
Регулации
| Източник |
Регулация |
Свързани задачи
|