SI-4 — System Monitoring

Linking individual intrusion detection tools into a system-wide intrusion detection system provides additional coverage and effective detection capabilities. The information contained in one intrusion detection tool can be shared widely across the organization, making the system-wide detection capability more robust and powerful.

1. SI-04(01)[01]individual intrusion detection tools are connected to a system-wide intrusion detection system;
2. SI-04(01)[02]individual intrusion detection tools are configured into a system-wide intrusion detection system.

Automated tools and mechanisms include host-based, network-based, transport-based, or storage-based event monitoring tools and mechanisms or security information and event management (SIEM) technologies that provide real-time analysis of alerts and notifications generated by organizational systems. Automated monitoring techniques can create unintended privacy risks because automated controls may connect to external or otherwise unrelated systems. The matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessment and make determinations that are in alignment with their privacy program plan.

automated tools and mechanisms are employed to support a near real-time analysis of events.

Using automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access and flow control mechanisms facilitates a rapid response to attacks by enabling the reconfiguration of mechanisms in support of attack isolation and elimination.

1. SI-04(03)[01]automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms;
2. SI-04(03)[02]automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.

Unusual or unauthorized activities or conditions related to system inbound and outbound communications traffic includes internal traffic that indicates the presence of malicious code or unauthorized use of legitimate code or credentials within organizational systems or propagating among system components, signaling to external systems, and the unauthorized exporting of information. Evidence of malicious code or unauthorized use of legitimate code or credentials is used to identify potentially compromised systems or system components.

1. SI-04(04)(a)
   1. SI-04(04)(a)[01]criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined;
   2. SI-04(04)(a)[02]criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined;
2. SI-04(04)(b)
   1. SI-04(04)(b)[01]inbound communications traffic is monitored [Organization-defined: frequency] for [Organization-defined: unusual or unauthorized activities or conditions];
   2. SI-04(04)(b)[02]outbound communications traffic is monitored [Organization-defined: frequency] for [Organization-defined: unusual or unauthorized activities or conditions].

Alerts may be generated from a variety of sources, including audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be automated and may be transmitted telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the alert notification list can include system administrators, mission or business owners, system owners, information owners/stewards, senior agency information security officers, senior agency officials for privacy, system security officers, or privacy officers. In contrast to alerts generated by the system, alerts generated by organizations in [SI-4(12)](#si-4.12) focus on information sources external to the system, such as suspicious activity reports and reports on potential insider threats.

[Organization-defined: personnel or roles] are alerted when system-generated [Organization-defined: compromise indicators] occur.

Least-disruptive actions include initiating requests for human responses.

1. SI-04(07)(a)[Organization-defined: incident response personnel] are notified of detected suspicious events;
2. SI-04(07)(b)[Organization-defined: least-disruptive actions] are taken upon the detection of suspicious events.

Testing intrusion-monitoring tools and mechanisms is necessary to ensure that the tools and mechanisms are operating correctly and continue to satisfy the monitoring objectives of organizations. The frequency and depth of testing depends on the types of tools and mechanisms used by organizations and the methods of deployment.

intrusion-monitoring tools and mechanisms are tested [Organization-defined: frequency].

Organizations balance the need to encrypt communications traffic to protect data confidentiality with the need to maintain visibility into such traffic from a monitoring perspective. Organizations determine whether the visibility requirement applies to internal encrypted traffic, encrypted traffic intended for external destinations, or a subset of the traffic types.

provisions are made so that [Organization-defined: encrypted communications traffic] is visible to [Organization-defined: system monitoring tools and mechanisms].

Organization-defined interior points include subnetworks and subsystems. Anomalies within organizational systems include large file transfers, long-time persistent connections, attempts to access information from unexpected locations, the use of unusual protocols and ports, the use of unmonitored network protocols (e.g., IPv6 usage during IPv4 transition), and attempted communications with suspected malicious external addresses.

1. SI-04(11)[01]outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies;
2. SI-04(11)[02]outbound communications traffic at [Organization-defined: interior points] is analyzed to discover anomalies.

Organizational personnel on the system alert notification list include system administrators, mission or business owners, system owners, senior agency information security officer, senior agency official for privacy, system security officers, or privacy officers. Automated organization-generated alerts are the security alerts generated by organizations and transmitted using automated means. The sources for organization-generated alerts are focused on other entities such as suspicious activity reports and reports on potential insider threats. In contrast to alerts generated by the organization, alerts generated by the system in [SI-4(5)](#si-4.5) focus on information sources that are internal to the systems, such as audit records.

[Organization-defined: personnel or roles] is/are alerted using [Organization-defined: automated mechanisms] when [Organization-defined: activities that trigger alerts] indicate inappropriate or unusual activities with security or privacy implications.

Identifying and understanding common communications traffic and event patterns help organizations provide useful information to system monitoring devices to more effectively identify suspicious or anomalous traffic and events when they occur. Such information can help reduce the number of false positives and false negatives during system monitoring.

1. SI-04(13)(a)
   1. SI-04(13)(a)[01]communications traffic for the system is analyzed;
   2. SI-04(13)(a)[02]event patterns for the system are analyzed;
2. SI-04(13)(b)
   1. SI-04(13)(b)[01]profiles representing common traffic are developed;
   2. SI-04(13)(b)[02]profiles representing event patterns are developed;
3. SI-04(13)(c)
   1. SI-04(13)(c)[01]traffic profiles are used in tuning system-monitoring devices;
   2. SI-04(13)(c)[02]event profiles are used in tuning system-monitoring devices.

Wireless signals may radiate beyond organizational facilities. Organizations proactively search for unauthorized wireless connections, including the conduct of thorough scans for unauthorized wireless access points. Wireless scans are not limited to those areas within facilities containing systems but also include areas outside of facilities to verify that unauthorized wireless access points are not connected to organizational systems.

1. SI-04(14)[01]a wireless intrusion detection system is employed to identify rogue wireless devices;
2. SI-04(14)[02]a wireless intrusion detection system is employed to detect attack attempts on the system;
3. SI-04(14)[03]a wireless intrusion detection system is employed to detect potential compromises or breaches to the system.

Wireless networks are inherently less secure than wired networks. For example, wireless networks are more susceptible to eavesdroppers or traffic analysis than wireline networks. When wireless to wireline communications exist, the wireless network could become a port of entry into the wired network. Given the greater facility of unauthorized network access via wireless access points compared to unauthorized wired network access from within the physical boundaries of the system, additional monitoring of transitioning traffic between wireless and wired networks may be necessary to detect malicious activities. Employing intrusion detection systems to monitor wireless communications traffic helps to ensure that the traffic does not contain malicious code prior to transitioning to the wireline network.

an intrusion detection system is employed to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.

Correlating information from different system monitoring tools and mechanisms can provide a more comprehensive view of system activity. Correlating system monitoring tools and mechanisms that typically work in isolation—including malicious code protection software, host monitoring, and network monitoring—can provide an organization-wide monitoring view and may reveal otherwise unseen attack patterns. Understanding the capabilities and limitations of diverse monitoring tools and mechanisms and how to maximize the use of information generated by those tools and mechanisms can help organizations develop, operate, and maintain effective monitoring programs. The correlation of monitoring information is especially important during the transition from older to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols).

information from monitoring tools and mechanisms employed throughout the system is correlated.

Correlating monitoring information from a more diverse set of information sources helps to achieve integrated situational awareness. Integrated situational awareness from a combination of physical, cyber, and supply chain monitoring activities enhances the capability of organizations to more quickly detect sophisticated attacks and investigate the methods and techniques employed to carry out such attacks. In contrast to [SI-4(16)](#si-4.16) , which correlates the various cyber monitoring information, integrated situational awareness is intended to correlate monitoring beyond the cyber domain. Correlation of monitoring information from multiple activities may help reveal attacks on organizations that are operating across multiple attack vectors.

information from monitoring physical, cyber, and supply chain activities are correlated to achieve integrated, organization-wide situational awareness.

Organization-defined interior points include subnetworks and subsystems. Covert means that can be used to exfiltrate information include steganography.

1. SI-04(18)[01]outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information;
2. SI-04(18)[02]outbound communications traffic is analyzed at [Organization-defined: interior points] to detect covert exfiltration of information.

Indications of increased risk from individuals can be obtained from different sources, including personnel records, intelligence agencies, law enforcement organizations, and other sources. The monitoring of individuals is coordinated with the management, legal, security, privacy, and human resource officials who conduct such monitoring. Monitoring is conducted in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

[Organization-defined: additional monitoring] is implemented on individuals who have been identified by [Organization-defined: sources] as posing an increased level of risk.

Privileged users have access to more sensitive information, including security-related information, than the general user population. Access to such information means that privileged users can potentially do greater damage to systems and organizations than non-privileged users. Therefore, implementing additional monitoring on privileged users helps to ensure that organizations can identify malicious activity at the earliest possible time and take appropriate actions.

[Organization-defined: additional monitoring] of privileged users is implemented.

During probationary periods, employees do not have permanent employment status within organizations. Without such status or access to information that is resident on the system, additional monitoring can help identify any potentially malicious activity or inappropriate behavior.

[Organization-defined: additional monitoring] of individuals is implemented during [Organization-defined: probationary period].

Unauthorized or unapproved network services include services in service-oriented architectures that lack organizational verification or validation and may therefore be unreliable or serve as malicious rogues for valid services.

1. SI-04(22)(a)network services that have not been authorized or approved by [Organization-defined: authorization or approval processes] are detected;
2. SI-04(22)(b)[Organization-defined: si-04.22_odp.02] is/are initiated when network services that have not been authorized or approved by authorization or approval processes are detected.

Host-based monitoring collects information about the host (or system in which it resides). System components in which host-based monitoring can be implemented include servers, notebook computers, and mobile devices. Organizations may consider employing host-based monitoring mechanisms from multiple product developers or vendors.

[Organization-defined: host-based monitoring mechanisms] are implemented on [Organization-defined: system components].

Indicators of compromise (IOC) are forensic artifacts from intrusions that are identified on organizational systems at the host or network level. IOCs provide valuable information on systems that have been compromised. IOCs can include the creation of registry key values. IOCs for network traffic include Universal Resource Locator or protocol elements that indicate malicious code command and control servers. The rapid distribution and adoption of IOCs can improve information security by reducing the time that systems and organizations are vulnerable to the same exploit or attack. Threat indicators, signatures, tactics, techniques, procedures, and other indicators of compromise may be available via government and non-government cooperatives, including the Forum of Incident Response and Security Teams, the United States Computer Emergency Readiness Team, the Defense Industrial Base Cybersecurity Information Sharing Program, and the CERT Coordination Center.

1. SI-04(24)[01]indicators of compromise provided by [Organization-defined: sources] are discovered;
2. SI-04(24)[02]indicators of compromise provided by [Organization-defined: sources] are collected;
3. SI-04(24)[03]indicators of compromise provided by [Organization-defined: sources] are distributed to [Organization-defined: personnel or roles].

Encrypted traffic, asymmetric routing architectures, capacity and latency limitations, and transitioning from older to newer technologies (e.g., IPv4 to IPv6 network protocol transition) may result in blind spots for organizations when analyzing network traffic. Collecting, decrypting, pre-processing, and distributing only relevant traffic to monitoring devices can streamline the efficiency and use of devices and optimize traffic analysis.

1. SI-04(25)[01]visibility into network traffic at external system interfaces is provided to optimize the effectiveness of monitoring devices;
2. SI-04(25)[02]visibility into network traffic at key internal system interfaces is provided to optimize the effectiveness of monitoring devices.