03.11.03E Predictive Cyber Analytics

Statement

Employ the following advanced automation and analytics capabilities to predict and identify risks to {{ insert: param, A.03.11.03E.ODP.01 }}: {{ insert: param, A.03.11.03E.ODP.02 }}.

Guidance

A properly resourced security operations center (SOC) or computer incident response team (CIRT) may be overwhelmed by the volume of information generated by the proliferation of security tools and appliances unless it employs advanced automation and analytics to analyze the data. Advanced automation and predictive analytics capabilities are typically supported by artificial intelligence concepts and machine learning. Examples include automated threat discovery and response (which includes broad-based collection, context-based analysis, and adaptive response capabilities), automated workflow operations, and machine-assisted decision tools. However, sophisticated adversaries may be able to extract information related to analytic parameters and retrain the machine learning to classify malicious activity as benign. Accordingly, machine learning is augmented by human monitoring to help ensure that sophisticated adversaries are not able to conceal their activities. This requirement enhances SP 800-171 requirement 03.11.01.

Statement

• (includes expunge) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

• (includes detect and scrutinize) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.11.03E.ODP.01 }} are employed to predict and identify risks to {{ insert: param, A.03.11.03E.ODP.02 }}.

Assessment objective

{{ insert: param, A.03.11.03E.ODP.03 }} are employed to predict and identify risks to {{ insert: param, A.03.11.03E.ODP.02 }}.

Assessment method

• Risk assessment policy security planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates risk reports system security plan other relevant documents or records

Assessment method

• Personnel with risk assessment responsibilities personnel with information security responsibilities

Assessment method

• Processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final