+SI-04(25) Optimize Network Traffic Analysis
|
SI-04(25) Optimize Network Traffic Analysis
Control
Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
Discussion
Encrypted traffic, asymmetric routing architectures, capacity and latency limitations, and transitioning from older to newer technologies (e.g., IPv4 to IPv6 network protocol transition) may result in blind spots for organizations when analyzing network traffic. Collecting, decrypting, pre-processing, and distributing only relevant traffic to monitoring devices can streamline the efficiency and use of devices and optimize traffic analysis.
Assessment Objective
- visibility into network traffic at external system interfaces is provided to optimize the effectiveness of monitoring devices;
- visibility into network traffic at key internal system interfaces is provided to optimize the effectiveness of monitoring devices.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system architecture
system audit records
network traffic reports
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring system hosts
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|