+AU-06 [H] Audit Record Review, Analysis, and Reporting
---+AU-06(01) [H] Automated Process Integration
---+AU-06(03) [H] Correlate Audit Record Repositories
---+AU-06(05) [H] Integrated Analysis of Audit Records
---+AU-06(06) [H] Correlation with Physical Monitoring
|
AU-06 [H] Audit Record Review, Analysis, and Reporting
Control
- Review and analyze system audit records [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
- Report findings to [Assignement: personnel or roles] ; and
- Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Discussion
Audit record review, analysis, and reporting covers information security- and privacy-related logging performed by organizations, including logging that results from the monitoring of account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and non-local maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at system interfaces, and use of mobile code or Voice over Internet Protocol (VoIP). Findings can be reported to organizational entities that include the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The frequency, scope, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received.
Assessment Objective
- system audit records are reviewed and analyzed [Assignement: frequency] for indications of [Assignement: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
- findings are reported to [Assignement: personnel or roles];
- the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
reports of audit findings
records of actions taken in response to reviews/analyses of audit records
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
1. Přehled
| Název |
Standard |
|
AU-06(01) [H] Automated Process Integration
|
Control
Integrate audit record review, analysis, and reporting processes using [Assignement: automated mechanisms].
Discussion
Organizational processes that benefit from integrated audit record review, analysis, and reporting include incident response, continuous monitoring, contingency planning, investigation and response to suspicious activities, and Inspector General audits.
Assessment Objective
audit record review, analysis, and reporting processes are integrated using [Assignement: automated mechanisms].
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
procedures addressing investigation and response to suspicious activities
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
|
|
AU-06(03) [H] Correlate Audit Record Repositories
|
Control
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
Discussion
Organization-wide situational awareness includes awareness across all three levels of risk management (i.e., organizational level, mission/business process level, and information system level) and supports cross-organization awareness.
Assessment Objective
audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
system design documentation
system configuration settings and associated documentation
system audit records across different repositories
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
|
|
AU-06(05) [H] Integrated Analysis of Audit Records
|
Control
Integrate analysis of audit records with analysis of [Selection(one-or-more): vulnerability scanning information; performance data; system monitoring information; {{ insert: param, au-06.05_odp.02 }} ] to further enhance the ability to identify inappropriate or unusual activity.
Discussion
Integrated analysis of audit records does not require vulnerability scanning, the generation of performance data, or system monitoring. Rather, integrated analysis requires that the analysis of information generated by scanning, monitoring, or other data collection activities is integrated with the analysis of audit record information. Security Information and Event Management tools can facilitate audit record aggregation or consolidation from multiple system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches for analyzing audit record information collected. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans of the system and in correlating attack detection events with scanning results. Correlation with performance data can uncover denial-of-service attacks or other types of attacks that result in the unauthorized use of resources. Correlation with system monitoring information can assist in uncovering attacks and in better relating audit information to operational situations.
Assessment Objective
analysis of audit records is integrated with analysis of [Selection(one-or-more): vulnerability scanning information; performance data; system monitoring information; {{ insert: param, au-06.05_odp.02 }} ] to further enhance the ability to identify inappropriate or unusual activity.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing audit review, analysis, and reporting
system design documentation
system configuration settings and associated documentation
integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information, and associated documentation
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with information security and privacy responsibilities
|
|
AU-06(06) [H] Correlation with Physical Monitoring
|
Control
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Discussion
The correlation of physical audit record information and the audit records from systems may assist organizations in identifying suspicious behavior or supporting evidence of such behavior. For example, the correlation of an individual’s identity for logical access to certain systems with the additional physical security information that the individual was present at the facility when the logical access occurred may be useful in investigations.
Assessment Objective
information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
Assessment Method
Examine
Audit and accountability policy
procedures addressing audit review, analysis, and reporting
procedures addressing physical access monitoring
system design documentation
system configuration settings and associated documentation
documentation providing evidence of correlated information obtained from audit records and physical access monitoring records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with audit review, analysis, and reporting responsibilities
organizational personnel with physical access monitoring responsibilities
organizational personnel with information security and privacy responsibilities
|
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|