DE – DETECT

NIST CSF 2.0 – DE – DETECT

1.Kravtext (engelskt original)#

DE.AE – Adverse Event Analysis#

Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents

DE.AE-01

A baseline of network operations and expected data flows for users and systems is established and managed

DE.AE-02

Potentially adverse events are analyzed to better understand associated activities

Examples:

• Use security information and event management (SIEM) or other tools to continuously monitor log events for known malicious and suspicious activity
• Utilize up-to-date cyber threat intelligence in log analysis tools to improve detection accuracy and characterize threat actors, their methods, and indicators of compromise
• Regularly conduct manual reviews of log events for technologies that cannot be sufficiently monitored through automation
• Use log analysis tools to generate reports on their findings

DE.AE-03

Information is correlated from multiple sources

Examples:

• Constantly transfer log data generated by other sources to a relatively small number of log servers
• Use event correlation technology (e.g., SIEM) to collect information captured by multiple sources
• Utilize cyber threat intelligence to help correlate events among log sources

DE.AE-04

The estimated impact and scope of adverse events are understood

Examples:

• Use SIEMs or other tools to estimate impact and scope, and review and refine the estimates
• A person creates their own estimates of impact and scope

DE.AE-05

Incident alert thresholds are established

DE.AE-06

Information on adverse events is provided to authorized staff and tools

Examples:

• Use cybersecurity software to generate alerts and provide them to the security operations center (SOC), incident responders, and incident response tools
• Incident responders and other authorized personnel can access log analysis findings at all times
• Automatically create and assign tickets in the organization’s ticketing system when certain types of alerts occur
• Manually create and assign tickets in the organization’s ticketing system when technical staff discover indicators of compromise

DE.AE-07

Cyber threat intelligence and other contextual information are integrated into the analysis

Examples:

• Securely provide cyber threat intelligence feeds to detection technologies, processes, and personnel
• Securely provide information from asset inventories to detection technologies, processes, and personnel
• Rapidly acquire and analyze vulnerability disclosures for the organization’s technologies from suppliers, vendors, and third-party security advisories

DE.AE-08

Incidents are declared when adverse events meet the defined incident criteria

Examples:

• Apply incident criteria to known and assumed characteristics of activity in order to determine whether an incident should be declared
• Take known false positives into account when applying incident criteria

DE.CM – Continuous Monitoring#

Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events

DE.CM-01

Networks and network services are monitored to find potentially adverse events

Examples:

• Monitor DNS, BGP, and other network services for adverse events
• Monitor wired and wireless networks for connections from unauthorized endpoints
• Monitor facilities for unauthorized or rogue wireless networks
• Compare actual network flows against baselines to detect deviations
• Monitor network communications to identify changes in security postures for zero trust purposes

DE.CM-02

The physical environment is monitored to find potentially adverse events

Examples:

• Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts
• Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)
• Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering
• Monitor the physical environment using alarm systems, cameras, and security guards

DE.CM-03

Personnel activity and technology usage are monitored to find potentially adverse events

Examples:

• Use behavior analytics software to detect anomalous user activity to mitigate insider threats
• Monitor logs from logical access control systems to find unusual access patterns and failed access attempts
• Continuously monitor deception technology, including user accounts, for any usage

DE.CM-04

Malicious code is detected

DE.CM-05

Unauthorized mobile code is detected

DE.CM-06

External service provider activities and services are monitored to find potentially adverse events

Examples:

• Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems
• Monitor activity from cloud-based services, internet service providers, and other service providers for deviations from expected behavior

DE.CM-07

Monitoring for unauthorized personnel, connections, devices, and software is performed

DE.CM-08

Vulnerability scans are performed

DE.CM-09

Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

Examples:

• Monitor email, web, file sharing, collaboration services, and other common attack vectors to detect malware, phishing, data leaks and exfiltration, and other adverse events
• Monitor authentication attempts to identify attacks against credentials and unauthorized credential reuse
• Monitor software configurations for deviations from security baselines
• Monitor hardware and software for signs of tampering
• Use technologies with a presence on endpoints to detect cyber health issues (e.g., missing patches, malware infections, unauthorized software), and redirect the endpoints to a remediation environment before access is authorized

DE.DP – Detection Processes#

DE.DP-01

Roles and responsibilities for detection are well defined to ensure accountability

DE.DP-02

Detection activities comply with all applicable requirements

DE.DP-03

Detection processes are tested

DE.DP-04

Event detection information is communicated

DE.DP-05

Detection processes are continuously improved

National Institute of Standards and Technology, OSCAL release 1.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.