Navigate

SI-4

SI-4: Information System Monitoring

The organization:

a: Monitors the information system to detect:
- 1: Attacks and indicators of potential attacks in accordance with [organization-defined monitoring objectives]; and
- 2: Unauthorized local, network, and remote connections;

b: Identifies unauthorized use of the information system through [organization-defined techniques and methods];

c: Deploys monitoring devices:
- 1: Strategically within the information system to collect organization-determined essential information; and
- 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization;

d: Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;

e: Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;

f: Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and

g: Provides [organization-defined information system monitoring information] to [organization-defined personnel or roles] [one or more of as needed/ {{ insert: param, si-4_prm_6 }} ].

Supplemental

Information system monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system. Organizations can monitor information systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include, for example, selected perimeter locations and near server farms supporting critical applications, with such devices typically being employed at the managed interfaces associated with controls SC-7 and AC-17. Einstein network monitoring devices from the Department of Homeland Security can also be included as monitoring devices. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of information systems to support such objectives. Specific types of transactions of interest include, for example, Hyper Text Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. Information system monitoring is an integral part of organizational continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
DE.AE-1, DE.AE-2, DE.AE-3, DE.AE-4, DE.CM-1, DE.CM-5, DE.CM-6, DE.CM-7, DE.DP-2, DE.DP-3, DE.DP-4, DE.DP-5, ID.RA-1, PR.DS-5, PR.IP-8, RS.AN-1, RS.CO-3

Related Controls

The controls below (if any) were marked by NIST as being related to SI-4.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-4	The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [organization-defined information flow control policies].
AC-8	The information system: a: Displays to users [organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: 1: Users are accessing a U.S. Government information system; 2: Information system usage may be monitored, recorded, and subject to audit; 3: Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and 4: Use of the information system indicates consent to monitoring and recording; b: Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and c: For publicly accessible systems: 1: Displays system use information [organization-defined conditions], before granting further access; 2: Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3: Includes a description of the authorized uses of the system.
AC-17	The organization: a: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorizes remote access to the information system prior to allowing such connections.
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [organization-defined auditable events]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-6	The organization: a: Reviews and analyzes information system audit records [organization-defined frequency] for indications of [organization-defined inappropriate or unusual activity]; and b: Reports findings to [organization-defined personnel or roles].
AU-7	The information system provides an audit reduction and report generation capability that: a: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and b: Does not alter the original content or time ordering of audit records.
AU-9	The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [organization-defined information system components]; b: Allows [organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].
IR-4	The organization: a: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinates incident handling activities with contingency planning activities; and c: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
RA-5	The organization: a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1: Enumerating platforms, software flaws, and improper configurations; 2: Formatting checklists and test procedures; and 3: Measuring vulnerability impact; c: Analyzes vulnerability scan reports and results from security control assessments; d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).
SC-7	The information system: a: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b: Implements subnetworks for publicly accessible system components that are [] separated from internal organizational networks; and c: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-26	The information system includes components specifically designed to be the target of malicious attacks for the purpose of detecting, deflecting, and analyzing such attacks.
SC-35	The information system includes components that proactively seek to identify malicious websites and/or web-based malicious code.
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.
SI-7	The organization employs integrity verification tools to detect unauthorized changes to [organization-defined software, firmware, and information].

Enhancements

The controls below (if any) add on to the requirements of SI-4.

Control	Description
SI-4(1)	The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.
SI-4(2)	The organization employs automated tools to support near real-time analysis of events.
SI-4(3)	The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.
SI-4(4)	The information system monitors inbound and outbound communications traffic [organization-defined frequency] for unusual or unauthorized activities or conditions.
SI-4(5)	The information system alerts [organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [organization-defined compromise indicators].
SI-4(6)
SI-4(7)	The information system notifies [organization-defined incident response personnel (identified by name and/or by role)] of detected suspicious events and takes [organization-defined least-disruptive actions to terminate suspicious events].
SI-4(8)
SI-4(9)	The organization tests intrusion-monitoring tools [organization-defined frequency].
SI-4(10)	The organization makes provisions so that [organization-defined encrypted communications traffic] is visible to [organization-defined information system monitoring tools].
SI-4(11)	The organization analyzes outbound communications traffic at the external boundary of the information system and selected [organization-defined interior points within the system (e.g., subnetworks, subsystems)] to discover anomalies.
SI-4(12)	The organization employs automated mechanisms to alert security personnel of the following inappropriate or unusual activities with security implications: [organization-defined activities that trigger alerts].
SI-4(13)	The organization: (a): Analyzes communications traffic/event patterns for the information system; (b): Develops profiles representing common traffic patterns and/or events; and (c): Uses the traffic/event profiles in tuning system-monitoring devices to reduce the number of false positives and the number of false negatives.
SI-4(14)	The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.
SI-4(15)	The organization employs an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.
SI-4(16)	The organization correlates information from monitoring tools employed throughout the information system.
SI-4(17)	The organization correlates information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.
SI-4(18)	The organization analyzes outbound communications traffic at the external boundary of the information system (i.e., system perimeter) and at [organization-defined interior points within the system (e.g., subsystems, subnetworks)] to detect covert exfiltration of information.
SI-4(19)	The organization implements [organization-defined additional monitoring] of individuals who have been identified by [organization-defined sources] as posing an increased level of risk.
SI-4(20)	The organization implements [organization-defined additional monitoring] of privileged users.
SI-4(21)	The organization implements [organization-defined additional monitoring] of individuals during [organization-defined probationary period].
SI-4(22)	The information system detects network services that have not been authorized or approved by [organization-defined authorization or approval processes] and [one or more of audits/alerts {{ insert: param, si-4.22_prm_3 }} ].
SI-4(23)	The organization implements [organization-defined host-based monitoring mechanisms] at [organization-defined information system components].
SI-4(24)	The information system discovers, collects, distributes, and uses indicators of compromise.

Related CCIs

The CCIs below are tied to SI-4.

CCI	Definition
CCI-001253	Defines the objectives of monitoring for attacks and indicators of potential attacks on the system.
CCI-001255	Invoke internal monitoring capabilities or deploy monitoring devices strategically within the system to collect organization-determined essential information.
CCI-001256	Invoke internal monitoring capabilities or deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization.
CCI-001257	Adjust the level of system monitoring activity when there is a change in increased risk to organizational operations and assets, individuals, other organizations, or the Nation.
CCI-001258	Obtain legal opinion with regard to system monitoring activities.
CCI-002641	Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives.
CCI-002642	Monitor the system to detect unauthorized local connections.
CCI-002643	Monitor the system to detect unauthorized network connections.
CCI-002644	Monitor the system to detect unauthorized remote connections.
CCI-002645	Defines the techniques and methods to be used to identify unauthorized use of the system.
CCI-002646	Identify unauthorized use of the system through organization-defined techniques and methods.
CCI-002647	The organization protects information obtained from intrusion-monitoring tools from unauthorized access.
CCI-002648	The organization protects information obtained from intrusion-monitoring tools from unauthorized modification.
CCI-002649	The organization protects information obtained from intrusion-monitoring tools from unauthorized deletion.
CCI-002650	Defines the system monitoring information that is to be provided the organization-defined personnel or roles.
CCI-002651	Defines the personnel or roles that are to be provided organization-defined system monitoring information.
CCI-002652	Defines the frequency at which the organization will provide the organization-defined system monitoring information to organization-defined personnel or roles.
CCI-002653	The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency.
CCI-002654	Provide organization-defined system monitoring information to organization-defined personnel or roles as needed, and/or per organization-defined frequency.