+03.11.09E Indicators of Compromise

03.11.09E Indicators of Compromise

Statement

Discover, collect, and distribute to {{ insert: param, A.03.11.09E.ODP.01 }}, indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.02 }}.

Guidance

Indicators of compromise (IOCs) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include universal resource locator (URL) or protocol elements that indicate malicious code command and control servers. The rapid distribution and adoption of IOCs can improve information security by reducing the time that systems and organizations are vulnerable to the same exploit or attack. Threat indicators, signatures, tactics, techniques, procedures, and other IOCs may be available via government and non-government cooperatives, including the Forum of Incident Response and Security Teams (FIRST), the Computer Emergency Response Team Coordination Center (CERT/CC), the United States Computer Emergency Readiness Team (US-CERT), and the Defense Industrial Base (DIB) Cybersecurity Information Sharing Program. This requirement enhances SP 800-171 requirement 03.14.06.

Statement

  • (includes detect and reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

    • Reduce likelihood of impact.

    • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.01 }} are discovered.

Assessment objective

indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.01 }} are collected.

Assessment objective

indicators of compromise provided by {{ insert: param, A.03.11.09E.ODP.01 }} are distributed to {{ insert: param, A.03.11.09E.ODP.02 }}.

Assessment method

  • System and information integrity policy system and information integrity procedures procedures addressing system monitoring system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation system monitoring logs or records system audit records system security plan other relevant documents or records

Assessment method

  • System/network administrators personnel with information security responsibilities system developers personnel installing, configuring, and/or maintaining the system personnel responsible for monitoring system hosts

Assessment method

  • Processes for system monitoring processes for the discovery, collection, distribution, and use of indicators of compromise mechanisms supporting and/or implementing a system monitoring capability mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

Nõuded

3. Seotud regulatsioonid

Regulatsioonid

Lingitud teemad

Lingid
is blocked by 03.11.09E Indicators of Compromise – Assessment Procedure