+SYS.1.6.A24 Host-Based Attack Detection (H)

SYS.1.6.A24 Host-Based Attack Detection (H)

The behaviour of containers and the applications or services running in them SHOULD be monitored. Deviations from normal behaviour SHOULD be noticed and reported. The reports SHOULD be handled appropriately in a centralised process for security incident handling.

At minimum, the behaviour to be monitored SHOULD cover:

  • Network connections
  • Created processes
  • File system access attempts
  • Kernel requests (syscalls)

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

Zahtjevi

3. Povezani propisi

Propisi

Povezani zadaci

Poveznice
blocks G 0.22 Manipulation of Information
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information