DE.CM Continuous Monitoring

Statement

Networks and network services are monitored to find potentially adverse events

Guidance

Monitor DNS, BGP, and other network services for adverse events

Guidance

Monitor wired and wireless networks for connections from unauthorized endpoints

Guidance

Monitor facilities for unauthorized or rogue wireless networks

Guidance

Compare actual network flows against baselines to detect deviations

Guidance

Monitor network communications to identify changes in security postures for zero trust purposes

Statement

The physical environment is monitored to find potentially adverse events

Guidance

Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts

Guidance

Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)

Guidance

Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering

Guidance

Monitor the physical environment using alarm systems, cameras, and security guards

Statement

Personnel activity and technology usage are monitored to find potentially adverse events

Guidance

Use behavior analytics software to detect anomalous user activity to mitigate insider threats

Guidance

Monitor logs from logical access control systems to find unusual access patterns and failed access attempts

Guidance

Continuously monitor deception technology, including user accounts, for any usage

Statement

Malicious code is detected

Statement

Unauthorized mobile code is detected

Statement

External service provider activities and services are monitored to find potentially adverse events

Guidance

Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems

Guidance

Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior

Statement

Monitoring for unauthorized personnel, connections, devices, and software is performed

Statement

Vulnerability scans are performed

Statement

Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

Guidance

Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events

Guidance

Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse

Guidance

Monitor software configurations for deviations from security baselines

Guidance

Monitor hardware and software for signs of tampering

Guidance

Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized