+SI-04(11) Analyze Communications Traffic Anomalies
|
SI-04(11) Analyze Communications Traffic Anomalies
Control
Analyze outbound communications traffic at the external interfaces to the system and selected [Assignement: interior points] to discover anomalies.
Discussion
Organization-defined interior points include subnetworks and subsystems. Anomalies within organizational systems include large file transfers, long-time persistent connections, attempts to access information from unexpected locations, the use of unusual protocols and ports, the use of unmonitored network protocols (e.g., IPv6 usage during IPv4 transition), and attempted communications with suspected malicious external addresses.
Assessment Objective
- outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies;
- outbound communications traffic at [Assignement: interior points] is analyzed to discover anomalies.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
network diagram
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|