+DE.CM Continuous Monitoring
---+DE.CM-01 Networks and network services are monitored to find potentially adverse events
---+DE.CM-02 The physical environment is monitored to find potentially adverse events
---+DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
---+DE.CM-04 Malicious code is detected
---+DE.CM-05 Unauthorized mobile code is detected
---+DE.CM-06 External service provider activities and services are monitored to find potentially adverse events
---+DE.CM-07 Monitoring for unauthorized personnel, connections, devices, and software is performed
---+DE.CM-08 Vulnerability scans are performed
---+DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
|
DE.CM Continuous Monitoring
StatementAssets are monitored to find anomalies, indicators of compromise, and other potentially adverse events
1. Prezentare generală
| Titlu |
Standard |
|
DE.CM-01 Networks and network services are monitored to find potentially adverse events
|
StatementNetworks and network services are monitored to find potentially adverse events GuidanceMonitor DNS, BGP, and other network services for adverse events GuidanceMonitor wired and wireless networks for connections from unauthorized endpoints GuidanceMonitor facilities for unauthorized or rogue wireless networks GuidanceCompare actual network flows against baselines to detect deviations GuidanceMonitor network communications to identify changes in security postures for zero trust purposes
|
|
DE.CM-02 The physical environment is monitored to find potentially adverse events
|
StatementThe physical environment is monitored to find potentially adverse events GuidanceMonitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts GuidanceReview and monitor physical access records (e.g., from visitor registration, sign-in sheets) GuidanceMonitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering GuidanceMonitor the physical environment using alarm systems, cameras, and security guards
|
|
DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events
|
StatementPersonnel activity and technology usage are monitored to find potentially adverse events GuidanceUse behavior analytics software to detect anomalous user activity to mitigate insider threats GuidanceMonitor logs from logical access control systems to find unusual access patterns and failed access attempts GuidanceContinuously monitor deception technology, including user accounts, for any usage
|
|
DE.CM-04 Malicious code is detected
|
StatementMalicious code is detected
|
|
DE.CM-05 Unauthorized mobile code is detected
|
StatementUnauthorized mobile code is detected
|
|
DE.CM-06 External service provider activities and services are monitored to find potentially adverse events
|
StatementExternal service provider activities and services are monitored to find potentially adverse events GuidanceMonitor remote and onsite administration and maintenance activities that external providers perform on organizational systems GuidanceMonitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior
|
|
DE.CM-07 Monitoring for unauthorized personnel, connections, devices, and software is performed
|
StatementMonitoring for unauthorized personnel, connections, devices, and software is performed
|
|
DE.CM-08 Vulnerability scans are performed
|
StatementVulnerability scans are performed
|
|
DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
|
StatementComputing hardware and software, runtime environments, and their data are monitored to find potentially adverse events GuidanceMonitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events GuidanceMonitor authentication attempts to identify attacks against credentials and unauthorized credential reuse GuidanceMonitor software configurations for deviations from security baselines GuidanceMonitor hardware and software for signs of tampering GuidanceUse technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized
|
1.1 Referințe
1.2 Cerințe identificate
1.3 Reglementări asociate
2. Cerințe identificate
3. Reglementări asociate
Reglementări
| Sursă |
Reglementare |
Tichete legate
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|