CyberStrikeus/CyberStrike - Page 143

si-4-23-host-based-devices

Implement the following host-based monitoring mechanisms at [organization-defined]: [organization-defined].

si-4-24-indicators-of-compromise

Discover, collect, and distribute to [organization-defined] , indicators of compromise provided by [organization-defined].

si-4-25-optimize-network-traffic-analysis

Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.

si-4-3-automated-tool-and-mechanism-integration

Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.

si-4-4-inbound-and-outbound-communications-traffic

Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;

si-4-5-system-generated-alerts

Alert [organization-defined] when the following system-generated indications of compromise or potential compromise occur: [organization-defined].

si-4-6-restrict-non-privileged-users

Restrict Non-privileged Users

si-4-7-automated-response-to-suspicious-events

Notify [organization-defined] of detected suspicious events;

si-4-8-protection-of-monitoring-information

Protection of Monitoring Information

si-4-9-testing-of-monitoring-tools-and-mechanisms

Test intrusion-monitoring tools and mechanisms [organization-defined].

si-4-system-monitoring

Monitor the system to detect: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [organization-define

si-5-1-automated-alerts-and-advisories

Broadcast security alert and advisory information throughout the organization using [organization-defined].

si-5-security-alerts-advisories-and-directives

Receive system security alerts, advisories, and directives from [organization-defined] on an ongoing basis;

si-6-1-notification-of-failed-security-tests

Notification of Failed Security Tests

si-6-2-automation-support-for-distributed-testing

Implement automated mechanisms to support the management of distributed security and privacy function testing.

si-6-3-report-verification-results

Report the results of security and privacy function verification to [organization-defined].

si-6-security-and-privacy-function-verification

Verify the correct operation of [organization-defined];

si-7-1-integrity-checks

Perform an integrity check of [organization-defined] [organization-defined].

si-7-10-protection-of-boot-firmware

Implement the following mechanisms to protect the integrity of boot firmware in [organization-defined]: [organization-defined].

si-7-11-confined-environments-with-limited-privileges

Confined Environments with Limited Privileges

si-7-12-integrity-verification

Require that the integrity of the following user-installed software be verified prior to execution: [organization-defined].

si-7-13-code-execution-in-protected-environments

Code Execution in Protected Environments

si-7-14-binary-or-machine-executable-code

Binary or Machine Executable Code

si-7-15-code-authentication

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [organization-defined].

si-7-16-time-limit-on-process-execution-without-supervision

Prohibit processes from executing without supervision for more than [organization-defined].

si-7-17-runtime-application-self-protection

Implement [organization-defined] for application self-protection at runtime.

si-7-2-automated-notifications-of-integrity-violations

Employ automated tools that provide notification to [organization-defined] upon discovering discrepancies during integrity verification.

si-7-3-centrally-managed-integrity-tools

Employ centrally managed integrity verification tools.

si-7-4-tamper-evident-packaging

Tamper-evident Packaging

si-7-5-automated-response-to-integrity-violations

Automatically [organization-defined] when integrity violations are discovered.

si-7-6-cryptographic-protection

Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

si-7-7-integration-of-detection-and-response

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [organization-defined].

si-7-8-auditing-capability-for-significant-events

Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [organization-defined

si-7-9-verify-boot-process

Verify the integrity of the boot process of the following system components: [organization-defined].

si-7-software-firmware-and-information-integrity

Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [organization-defined] ;

si-8-1-central-management

Central Management

si-8-2-automatic-updates

Automatically update spam protection mechanisms [organization-defined].

si-8-3-continuous-learning-capability

Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.

si-8-spam-protection

Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages;

si-9-information-input-restrictions

Information Input Restrictions