Decide which data is security-relevant and should be collected. With regard to the parts of the system described in 3.2.3, one should collect the following as a minimum: a) Data relating to access control (successful and unsuccessful log-in attempts), and b) Administration and security logs from devices and services in the ICT systems. With regard to clients, one should record the following as a minimum: c) attempts to run unknown software (cf. 2.3.2), and d) attempts to seek privilege escalation.
The organization must be aware of the logs that accrue from the use of different data systems, whether generating the logs is the responsibility of the organization or the system provider. Logs record user actions as well as anomalies, errors, and security incidents.
The adequacy of log should be reviewed regularly. If necessary, log should be usable to determine the root causes for system incidents.
Security systems (e.g. firewall, malware protection) often have the ability to record a log of events. At regular intervals, make sure that a comprehensive log is accumulated and try to identify suspicious activity. The log is also useful in investigating disturbances or violations.
The organization must log admin and security logs from used devices and services.
These logs record actions taken by system administrators and privileged users. They help monitor changes to system configurations, user access rights, and other critical settings. By keeping these logs, an organization can audit administrative activities and ensure accountability.
Security logs capture events related to the security of systems and data. This includes login attempts, firewall activities, intrusion detection system alerts, and antivirus actions. Monitoring these logs helps identify suspicious activities that could indicate a security breach or an internal threat.
Organization's data systems and network must be monitored to detect abnormal use. When anomalities are detected, the organization must take the necessary measures to assess the possibility of security incident.
The monitoring should utilize tools that enable real-time or regular monitoring, taking into account the organization's requirements. Monitoring practices should be able to manage large amounts of data, adapt to changing threat environment, and send alerts immediately when necessary.
Inclusion of the following sources in the monitoring system should be considered:
li>
Organization must also establish procedures for identifying and correcting "false positive" results, including tuning monitoring software for more accurate anomaly detection.
Our organization has defined policies in place to prevent or at least detect the use of unauthorized programs.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
