SI-4(11)
SI-4(11): Analyze Communications Traffic Anomalies
The organization analyzes outbound communications traffic at the external boundary of the information system and selected [organization-defined interior points within the system (e.g., subnetworks, subsystems)] to discover anomalies.
Supplemental
Anomalies within organizational information systems include, for example, large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses.
| CIA Levels | |
|---|---|
| Confidentiality | high |
| Integrity | high |
| Availability | high |
| Overlays |
|---|
| None |
| CSF Categories |
|---|
| None |