+SYS.1.6.A24 Host-Based Attack Detection (H)

SYS.1.6.A24 Host-Based Attack Detection (H)

The behaviour of containers and the applications or services running in them SHOULD be monitored. Deviations from normal behaviour SHOULD be noticed and reported. The reports SHOULD be handled appropriately in a centralised process for security incident handling.

At minimum, the behaviour to be monitored SHOULD cover:

  • Network connections
  • Created processes
  • File system access attempts
  • Kernel requests (syscalls)

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
blocks G 0.22 Manipulation of Information
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information