+DER.1.A15 Central Detection and Real-Time Examination of Event Messages (H)

DER.1.A15 Central Detection and Real-Time Examination of Event Messages (H)

Central components SHOULD be used to detect and evaluate security-relevant events. Centralised, automated analyses SHOULD be carried out using software tools. These central, automated, software-based analyses SHOULD be used to record and correlate all the events that occur in the system environment at hand. The security-relevant processes SHOULD be transparent. It SHOULD be possible to view and evaluate all the data received in the log administration system in a seamless manner. The data SHOULD be analysed as constantly as possible. If defined threshold values are exceeded, an alarm SHOULD be generated automatically. The corresponding personnel SHOULD make sure that an alarm triggers a qualified response that is appropriate to the situation at hand. In this context, the employee concerned SHOULD also be informed immediately.

The persons in charge of the system SHOULD audit and (if required) adapt the analysis parameters at regular intervals. In addition, data that has already been audited SHOULD be examined automatically for security-relevant events at regular intervals.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
blocks G 0.29 Violations of Laws or Regulations
blocks G 0.37 Repudiation of Actions
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information