Assessment Objective

Determine if:

• SI-04(12) [Assignment: personnel or roles] is/are alerted using [Assignment: automated mechanisms] when [Assignment: activities that trigger alerts] indicate inappropriate or unusual activities with security or privacy implications.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• procedures addressing system monitoring tools and techniques
• system design documentation
• system monitoring tools and techniques documentation
• system configuration settings and associated documentation
• list of inappropriate or unusual activities with security and privacy implications that trigger alerts
• suspicious activity reports
• alerts provided to security and privacy personnel
• system monitoring logs or records
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel responsible for monitoring the system
• organizational personnel responsible for the intrusion detection system

Test

• Organizational processes for intrusion detection and system monitoring
• automated mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
• automated mechanisms supporting and/or implementing automated alerts to security personnel

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final