The network is monitored to detect potential cybersecurity events.

Access to buildings containing critical systems must be constantly monitored to detect unauthorized access or suspicious activity. The following issues should be taken into account in monitoring practices:

• touch, sound or motion detectors that trigger an intrusion alarm
• covering exterior doors and windows using sensors
• supervision of unstaffed and otherwise important (e.g. server or communication technology) premises
• regular testing of alarm systems

Information related to surveillance systems should be kept confidential, as disclosure of information can facilitate undetected breaches. The monitoring systems themselves must also be properly protected, so that the recordings or system status cannot be affected without permission.

The organisation must change the default password, which is used to login into firewall management interface, to something not easily guessed. Alternatively, organisation can block remote access to the management interface.

The organisation must not allow remote access if it is not properly and clearly documented and needed for business operations. In this case the system must be protected with multi factor authentication or with whitelisting only the necessary IP-addresses.

All endpoint devices in the organization should be protected by a properly configured software firewall that monitors traffic, accepts compliant traffic, and monitors users.

A firewall protects against malware and attacks that come from inside or outside your organization's network.

Owners have been assigned to various network devices, who are responsible for ensuring that the information processed on the networks and related services are protected from unauthorized access. Where appropriate, liability for network equipment must be separated from other related responsibilities.

The security arrangements required for critical online services, such as security features, service levels, and management requirements, are carefully defined in advance. Online services include e.g. connections, networks and network security solutions (e.g. firewalls).

The security features of online services can be e.g. the following:

• required security-related technologies such as authentication, encryption technology, and network connection management tools
• the technical parameters required for a secure connection to network services
• online service usage criteria that restrict access to the online service or applications as needed

An appropriate log is generated from the use of the network to enable the detection of actions relevant to cyber security.

The normal state of network traffic (traffic volumes, protocols, and connections) is known. In order to detect anomalies, there is a procedure for detecting events that are different from the normal state of network traffic (for example, anomalous connections or their attempts).

Organization's data systems and network must be monitored to detect abnormal use. When anomalities are detected, the organization must take the necessary measures to assess the possibility of security incident.

The monitoring should utilize tools that enable real-time or regular monitoring, taking into account the organization's requirements. Monitoring practices should be able to manage large amounts of data, adapt to changing threat environment, and send alerts immediately when necessary.

Inclusion of the following sources in the monitoring system should be considered:

• outbound and inbound network and data system traffic

  li>

• access to critical data systems, servers, network devices and the monitoring system itself
• critical system and network configuration files
• logs from security tools (e.g. antivirus, IDS, IPS, network filters, firewalls)

Organization must also establish procedures for identifying and correcting "false positive" results, including tuning monitoring software for more accurate anomaly detection.