Assessment Objective
Determine if:
- the system is monitored to detect attacks.
- the system is monitored to detect indicators of potential attacks.
- the system is monitored to detect unauthorized connections.
- unauthorized use of the system is identified.
- inbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
- outbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
Assessment Methods
Examine
- system and information integrity policy and procedures
- procedures for system monitoring tools and techniques
- continuous monitoring strategy
- facility diagram or layout
- system design documentation
- locations within the system where monitoring devices are deployed
- system configuration settings
- system protocols
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel with responsibilities for installing, configuring, or maintaining the system
- personnel with system monitoring responsibilities
- personnel with intrusion detection responsibilities
- personnel with information security responsibilities
- system administrators
Test
- processes for intrusion detection and system monitoring
- mechanisms for supporting or implementing system monitoring capabilities
- mechanisms for supporting or implementing intrusion detection and system monitoring capabilities
- mechanisms for supporting or implementing the monitoring of inbound and outbound communications traffic
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | 03.14.06 System Monitoring |