Assessment Objective
Determine if:
- [Assignment: personnel or roles] are alerted when system-generated [Assignment: indicators of compromise] occur.
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- system security plan
- system audit records
- procedures addressing system monitoring tools and techniques
- system monitoring tools and techniques documentation
- list of personnel selected to receive alerts
- system configuration settings and associated documentation
- documentation of alerts generated based on compromise indicators
- other relevant documents or records
Interview
- Personnel with information security responsibilities
- system developers
- personnel installing, configuring, and/or maintaining the system
- personnel responsible for monitoring the system
- personnel on the system alert notification list
- personnel responsible for the intrusion detection system
- system/network administrators
Test
- Processes for intrusion detection and system monitoring
- mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
- mechanisms supporting and/or implementing alerts for compromise indicators
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | 03.14.17E System-Generated Alerts |