DER.1 Detecting Security-Relevant Events

Based on the general security policy of the organisation in question, a specific security policy MUST be drawn up for detecting security-relevant events. This specific security policy MUST comprehensibly describe requirements and specifications on how to plan, set up, and safely operate methods of detecting security-relevant events. This specific security policy MUST be known to all employees responsible in the field of detection and serve as the basis of their work. If the specific security policy is changed or there are deviations from its requirements, this MUST be agreed and documented with the responsible CISO. The correct implementation of this specific security policy MUST be regularly reviewed. The results of the checks MUST be documented in a meaningful way.

When analysing log data, the provisions of current federal and state data protection law MUST be followed. If detection systems are used, employees' personal rights and rights of co-determination MUST be respected. It MUST also be ensured that all the additional legal provisions that apply are taken into consideration, such as the German Telemedia Act (TMG), the German Works Constitution Act, and the German Telecommunications Act.

Appropriate channels for reports and alerts MUST be defined and documented for security-relevant events. They MUST determine which points of contact must be informed and when. They MUST also specify how the respective persons can be reached. A security-relevant event MUST be reported using different communication channels depending on the urgency at hand.

All the relevant persons with regard to reporting and alarms MUST be informed of their tasks. All the steps of the reporting and alert process MUST be described in detail. The established reporting and alarm paths SHOULD be reviewed, tested, and updated at regular intervals as required.

All users MUST be instructed not to simply ignore or close the event messages displayed by their clients. Each user MUST use the prescribed alert channels to pass on messages to those responsible for incident management (see DER.2.1 Security Incident Handling).

Every employee MUST immediately report a security incident they have detected to the incident management department.

If IT systems or applications have features that can be used to detect security-relevant events, these MUST be enabled and used. If a security-relevant event occurs, the messages of the IT systems concerned MUST be evaluated. The logged events of other IT systems MUST be checked, as well. In addition, the collected messages SHOULD be checked randomly at mandatory intervals.

It MUST be checked whether additional malicious code scanners should be installed on central IT systems. If additional malware scanners are used, they MUST allow their messages and logs to be evaluated through a central access point. It MUST be ensured that the malicious code scanners will automatically report security-relevant events to the person responsible. The responsible parties MUST evaluate and investigate these messages.

All log data SHOULD be actively monitored and analysed as constantly as possible. Employees SHOULD be made responsible for these activities.

If the employees responsible have to actively search for security-relevant events that have occurred (e.g. when testing or monitoring IT systems), such tasks SHOULD be documented in corresponding process instructions.

Sufficient personnel resources SHOULD be made available for detecting security-relevant events.

The persons responsible for reviewing event messages SHOULD receive advanced training and qualifications. When new IT components are procured, a budget for training SHOULD be planned. A training concept SHOULD be created before the responsible staff members receive training on new IT components.

The network plan in question SHOULD be used to determine which network segments need to be protected by additional detection systems. Additional detection systems and sensors SHOULD be added to the information domain. Malicious code detection systems SHOULD be used and administered from a central location. The transitions defined in the network plan between internal and external networks SHOULD be complemented by network-based intrusion detection systems (NIDS).

At transitions to external networks, TLS/SSH proxies SHOULD be used to interrupt encrypted connections and make it possible to check the data being transmitted for malware. All TLS/SSH proxies SHOULD be protected against unauthorised access. Security-relevant events SHOULD be detected automatically on TLS/SSH proxies. An organisational regulation SHOULD be drawn up that specifies how log data can be evaluated manually in accordance with the provisions of data protection law.

Event messages that are generated by IT systems and applications and stored on a central logging infrastructure (see OPS.1.1.5 Logging) SHOULD be retrievable using a tool. The selected tool SHOULD be able to analyse the messages. The collected event messages SHOULD be checked for anomalies at regular intervals. The signatures of the detection systems used SHOULD always be identically up to date so that security-relevant events can also be detected retrospectively.

External sources SHOULD be used to gain new insights into security-relevant events that could impact an organisation’s own information domain. Messages from different channels SHOULD be recognised as relevant by employees and forwarded to the correct recipients. Information from reliable sources SHOULD be evaluated as a general rule. All information received SHOULD be evaluated in terms of whether it is relevant to the organisation's own information domain. If this is the case, the information SHOULD be escalated in line with security incident handling.

An organisation's detection systems and safeguards SHOULD be audited regularly to check whether they are still up to date and effective. The values assessed SHOULD include those that indicate how often security-relevant events are recorded, reported, and escalated. The results of the audits SHOULD be documented transparently and compared against the organisation's goals. Deviations SHOULD be investigated.

Employees SHOULD be specially assigned to monitor all types of log data. The monitoring of log data SHOULD be the predominant task of the appointed employees. The appointed employees SHOULD receive specialised further training and qualifications. A group of persons SHOULD be appointed to be exclusively responsible for the evaluation of log data.

Central components SHOULD be used to detect and evaluate security-relevant events. Centralised, automated analyses SHOULD be carried out using software tools. These central, automated, software-based analyses SHOULD be used to record and correlate all the events that occur in the system environment at hand. The security-relevant processes SHOULD be transparent. It SHOULD be possible to view and evaluate all the data received in the log administration system in a seamless manner. The data SHOULD be analysed as constantly as possible. If defined threshold values are exceeded, an alarm SHOULD be generated automatically. The corresponding personnel SHOULD make sure that an alarm triggers a qualified response that is appropriate to the situation at hand. In this context, the employee concerned SHOULD also be informed immediately.

The persons in charge of the system SHOULD audit and (if required) adapt the analysis parameters at regular intervals. In addition, data that has already been audited SHOULD be examined automatically for security-relevant events at regular intervals.

Applications with higher protection needs SHOULD be protected by means of additional detection safeguards. To this end, detection systems SHOULD be used that also make it possible to guarantee that higher protection needs are being met from a technical perspective.

Should a security-relevant event occur, the detection systems used SHOULD automatically report the event and react with appropriate security safeguards. In the process, methods SHOULD be used that automatically detect possible attacks, misuse attempts, or security violations. It SHOULD be possible to automatically intervene in data flows in order to prevent a possible security incident.

The integrity of all detection systems SHOULD be checked regularly. User rights SHOULD also be checked. In addition, the sensors in use SHOULD regularly check the integrity of files. An automatic alarm SHOULD be triggered if certain values change.