Assessment Objective

Determine if:

• SI-04(07)(a) [Assignment: incident response personnel] are notified of detected suspicious events;
• SI-04(07)(b) [Assignment: least-disruptive actions] are taken upon the detection of suspicious events.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• procedures addressing system monitoring tools and techniques
• system design documentation
• system monitoring tools and techniques documentation
• system configuration settings and associated documentation
• alerts and notifications generated based on detected suspicious events
• records of actions taken to terminate suspicious events
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel responsible for monitoring the system
• organizational personnel responsible for the intrusion detection system

Test

• Organizational processes for intrusion detection and system monitoring
• mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
• mechanisms supporting and/or implementing notifications to incident response personnel
• mechanisms supporting and/or implementing actions to terminate suspicious events

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final