Control Objectives: Monitoring and measurement

Adhere to operating procedures as defined in the Standard Operating Procedures Manual.

Alert interested personnel when suspicious activity is detected by an Intrusion Detection System or Intrusion Prevention System.

Analyze system audit reports and determine the need to perform more tests.

Archive the audit trail in accordance with compliance requirements.

Assess customer satisfaction.

Assign penetration testing to a qualified internal resource or external third party.

Assign vulnerability scanning to a qualified internal resource or external third party.

Automate the continuous monitoring of Configuration Management, as necessary.

Back up audit trails according to backup procedures.

Back up logs according to backup procedures.

Centralize network time servers to as few as practical.

Compare system performance metrics to organizational standards and industry benchmarks.

Compile the event logs of multiple components into a system-wide time-correlated audit trail.

Copy logs from all predefined hosts onto a log management infrastructure.

Correct vulnerabilities and repeat penetration testing.

Correct vulnerabilities and repeat vulnerability scanning.

Create a plan of action to correct control deficiencies identified in an audit.

Create specific test plans to test each system component.

Define the frequency to capture and log events.

Deny access to restricted data or restricted information when an individual is terminated.

Detect unauthorized access to systems.

Determine if honeypots should be installed, and if so, where the honeypots should be placed.

Determine the appropriate assessment method for each testing process in the test plan.

Determine the effectiveness of risk control measures.

Distribute the reviews of audit reports to organizational management.

Document the event information to be logged in the event information log specification.

Document validated testing processes in the testing procedures.

Enable and configure logging on all network access controls.

Enable logging for all systems that meet a traceability criteria.

Enable monitoring and logging operations on all assets that meet the organizational criteria to maintain event logs.

Encrypt files and move them to a secure file server when a user account is disabled.

Escalate the report when the software configuration is updated absent authorization.

Establish and maintain a Software Change Management metrics program.

Establish and maintain a System Security Plan.

Establish and maintain a compliance monitoring policy.

Establish and maintain a continuous monitoring for Configuration Management program.

Establish and maintain a log management program.

Establish and maintain a metrics policy.

Establish and maintain a penetration test program.

Establish and maintain a policies and controls metrics program.

Establish and maintain a risk monitoring program.

Establish and maintain a security test program.

Establish and maintain a technical measurement metrics policy.

Establish and maintain a vulnerability analysis program.

Establish and maintain an Information Security metrics program.

Establish and maintain an approach for compliance monitoring.

Establish and maintain an incident management and vulnerability management metrics program.

Establish and maintain event logging procedures.

Establish and maintain intrusion management operations.

Establish and maintain logging and monitoring operations.

Implement automated audit tools.

Implement file integrity monitoring.

Include a standard to collect and interpret event logs in the event logging procedures.

Install and maintain an Intrusion Detection System and/or Intrusion Prevention System.

Limit access to audit trails to a need to know basis.

Limit access to logs to a need to know basis.

Monitor and evaluate system performance.

Monitor and evaluate user account activity.

Monitor compliance with the Quality Control system.

Monitor continuously for threats.

Monitor devices continuously for conformance with production specifications.

Monitor for and report when a software configuration is updated.

Monitor for firmware updates absent authorization.

Monitor for new vulnerabilities.

Monitor for software configurations updates absent authorization.

Monitor for when documents are being updated absent authorization.

Monitor personnel and third parties for compliance to the organizational compliance framework.

Monitor systems for Denial of Service attacks.

Monitor systems for access to restricted data or restricted information.

Monitor systems for blended attacks and multiple component incidents.

Monitor systems for inappropriate usage and other security violations.

Monitor systems for unauthorized mobile code.

Monitor the activities to correct control deficiencies identified in an audit.

Monitor the usage and capacity of critical IT assets.

Monitoring and measurement

Notify the interested personnel and affected parties after the failure of an automated security test.

Notify the interested personnel and affected parties before the storage unit will reach maximum capacity.

Operationalize key monitoring and logging concepts to ensure the audit trails capture sufficient information.

Perform application-layer penetration testing on all systems, as necessary.

Perform internal vulnerability scans on the organization's systems.

Perform network-layer penetration testing on all systems, as necessary.

Perform penetration testing on a regular basis.

Perform vulnerability scanning on a regular basis.

Protect each person's right to privacy and civil liberties during intrusion management operations.

Protect logs from unauthorized activity.

Protect the event logs from failure.

Provide transactional walkthrough procedures for external auditors.

Recommend mitigation techniques based on penetration test results.

Report compliance monitoring statistics to the Board of Directors and other key stakeholders, as necessary.

Report on the mean time from patch availability to patch installation.

Retain penetration test remediation action records according to internal policy.

Review accounts and access rights when notified of personnel status changes.

Review and terminate accounts or terminate access rights when notified than an individual is terminated.

Review and update the list of auditable events in the event logging procedures.

Review event logs, Intrusion Detection System reports, security incident tracking reports, and other security logs regularly.

Revoke asset access when an individual is terminated.

Scan the network for Wireless Access Points.

Scan wireless networks for rogue devices.

Supply each in scope asset with audit reduction tool and report generation capabilities to support after-the-fact investigations without altering the event logs.

Synchronize system clocks to an accurate and universal time source on all devices that have logging enabled.

Test compliance controls for proper functionality.

Test the system for Cross-Site Request Forgery.

Test the system for broken access controls.

Test the system for broken authentication and session management.

Test the system for buffer overflows.

Test the system for cross-site scripting attacks.

Test the system for injection flaws.

Test the system for insecure communications.

Test the system for insecure configuration management.

Test the system for insecure cryptographic storage.

Test the system for proper error handling.

The manufacturing system and/or network should be covered by the OT Security Monitoring (industrial Intrusion Detection System - IIDS) service according to OT Monitoring Scope requirements defined within the DIA OT CS Security & Operations SOP.

Update the intrusion detection capabilities and the incident response capabilities regularly.

Update the vulnerability scanners' vulnerability list.

Use automated mechanisms to compare new vulnerability test results with past vulnerability test results.

Validate all testing assumptions in the test plans.