CyberStrikeus/CyberStrike - Page 142

si-19-7-validated-algorithms-and-software

Perform de-identification using validated algorithms and software that is validated to implement the algorithms.

si-19-8-motivated-intruder

Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-iden

si-19-de-identification

Remove the following elements of personally identifiable information from datasets: [organization-defined] ;

si-2-1-central-management

Central Management

si-2-2-automated-flaw-remediation-status

Determine if system components have applicable security-relevant software and firmware updates installed using [organization-defined] [organization-de

si-2-4-automated-patch-management-tools

Employ automated patch management tools to facilitate flaw remediation to the following system components: [organization-defined].

si-2-5-automatic-software-and-firmware-updates

Install [organization-defined] automatically to [organization-defined].

si-2-6-removal-of-previous-versions-of-software-and-firmware

Remove previous versions of [organization-defined] after updated versions have been installed.

si-2-7-root-cause-analysis

Conduct root cause analysis to identify underlying causes of issues or failures.

si-2-flaw-remediation

Identify, report, and correct system flaws;

si-20-tainting

Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly remove

si-21-information-refresh

Refresh [organization-defined] at [organization-defined] or generate the information on demand and delete the information when no longer needed.

si-22-information-diversity

Identify the following alternative sources of information for [organization-defined]: [organization-defined] ;

si-23-information-fragmentation

Based on [organization-defined]: Fragment the following information: [organization-defined] ; and Distribute the fragmented information across the fol

si-3-1-central-management

Central Management

si-3-10-malicious-code-analysis

Employ the following tools and techniques to analyze the characteristics and behavior of malicious code: [organization-defined] ;

si-3-2-automatic-updates

Automatic Updates

si-3-3-non-privileged-users

Non-privileged Users

si-3-4-updates-only-by-privileged-users

Update malicious code protection mechanisms only when directed by a privileged user.

si-3-5-portable-storage-devices

Portable Storage Devices

si-3-6-testing-and-verification

Test malicious code protection mechanisms [organization-defined] by introducing known benign code into the system;

si-3-7-nonsignature-based-detection

Nonsignature-based Detection

si-3-8-detect-unauthorized-commands

Detect the following unauthorized operating system commands through the kernel application programming interface on [organization-defined]: [organi...

si-3-9-authenticate-remote-commands

Authenticate Remote Commands

si-3-malicious-code-protection

Implement [organization-defined] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;

si-4-1-system-wide-intrusion-detection-system

Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.

si-4-10-visibility-of-encrypted-communications

Make provisions so that [organization-defined] is visible to [organization-defined].

si-4-11-analyze-communications-traffic-anomalies

Analyze outbound communications traffic at the external interfaces to the system and selected [organization-defined] to discover anomalies.

si-4-12-automated-organization-generated-alerts

Alert [organization-defined] using [organization-defined] when the following indications of inappropriate or unusual activities with security or priva

si-4-13-analyze-traffic-and-event-patterns

Analyze communications traffic and event patterns for the system;

si-4-14-wireless-intrusion-detection

Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to

si-4-15-wireless-to-wireline-communications

Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.

si-4-16-correlate-monitoring-information

Correlate information from monitoring tools and mechanisms employed throughout the system.

si-4-17-integrated-situational-awareness

Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.

si-4-18-analyze-traffic-and-covert-exfiltration

Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of inf

si-4-19-risk-for-individuals

Implement [organization-defined] of individuals who have been identified by [organization-defined] as posing an increased level of risk.

si-4-2-automated-tools-and-mechanisms-for-real-time-analysis

Employ automated tools and mechanisms to support near real-time analysis of events.

si-4-20-privileged-users

Implement the following additional monitoring of privileged users: [organization-defined].

si-4-21-probationary-periods

Implement the following additional monitoring of individuals during [organization-defined]: [organization-defined].

si-4-22-unauthorized-network-services

Detect network services that have not been authorized or approved by [organization-defined] ;