Куда я попал?
NIST Cybersecurity Framework (RU)
Framework
DE.CM-1
Для проведения оценки соответствия по документу войдите в систему.
Список требований
Похожие требования
CIS Critical Security Controls v8 (The 18 CIS CSC):
13.3
13.3 Deploy a Network Intrusion Detection Solution
Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.
Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.
13.6
13.6 Collect Network Traffic Flow Logs
Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.
Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.
13.8
13.8 Deploy a Network Intrusion Prevention Solution Network
Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.
Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.
ГОСТ Р № 57580.4-2022 от 01.02.2023 "Безопасность финансовых (банковских) операций. Обеспечение операционной надежности. Базовый состав организационных и технических мер. Раздел 7":
ВРВ.3
ВРВ.3 Организация сбора и фиксации технических данных (свидетельств)** о выявленных событиях реализации информационных угроз в рамках процессов защиты информации, реализуемых в соответствии с ГОСТ Р 57580.1., в целях проведения их последующего анализа, а также, в случае необходимости, проведения компьютерной экспертизы.
ВРВ.1
ВРВ.1 Организация мониторинга и выявления событий реализации информационных угроз в рамках процессов, реализуемых в соответствии с требованиями ГОСТ Р 57580.1., в целях своевременного обнаружения:
- компьютерных атак;
- аномальной активности лиц, имеющих легальный доступ к объектам информатизации финансовой организации;
- неправомерного использования доступа поставщиками услуг или другими доверенными организациями;
- фактов утечки защищаемой информации.
Russian Unified Cyber Security Framework (на основе The 18 CIS CSC):
13.3
13.3 Внедрена сетевая (network) система обнаружения вторжений (IDS, Intrusion Detection System)
Внедрить сетевое IDS-решение.
Внедрить сетевое IDS-решение.
13.8
13.8 Внедрена сетевая (network) система предотвращения вторжений (IPS, Intrusion Prevention Solution)
Внедрить сетевое IPS-решение.
Внедрить сетевое IPS-решение.
13.6
13.6 Реализован собор журналов сетевого трафика
Собирать журналы потоков сетевого трафика
Собирать журналы потоков сетевого трафика
CIS Critical Security Controls v7.1 (SANS Top 20):
CSC 12.8
CSC 12.8 Deploy NetFlow Collection on Networking Boundary Devices
Enable the collection of NetFlow and logging data on all network boundary devices.
Enable the collection of NetFlow and logging data on all network boundary devices.
CSC 12.6
CSC 12.6 Deploy Network-Based IDS Sensors
Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries.
Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries.
CSC 12.5
CSC 12.5 Configure Monitoring Systems to Record Network Packets
Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries.
Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries.
CSC 12.9
CSC 12.9 Deploy Application Layer Filtering Proxy Server
Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections.
Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections.
CSC 12.7
CSC 12.7 Deploy Network-Based Intrusion Prevention Systems
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization's network boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization's network boundaries.
CSC 15.3
CSC 15.3 Use a Wireless Intrusion Detection System
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.
CSC 18.10
CSC 18.10 Deploy Web Application Firewalls
Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks. For applications that are not web-based, specific application firewalls should be deployed if such tools are available for the given application type. If the traffic is encrypted, the device should either sit behind the encryption or be capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web application firewall should be deployed.
Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks. For applications that are not web-based, specific application firewalls should be deployed if such tools are available for the given application type. If the traffic is encrypted, the device should either sit behind the encryption or be capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web application firewall should be deployed.
Strategies to Mitigate Cyber Security Incidents (EN):
3.5.
Network-based intrusion detection/prevention system using signatures and heuristics to identify anomalous traffic both internally and crossing network perimeter boundaries.
Relative Security Effectiveness: Limited | Potential User Resistance: Low | Upfront Cost: High | Ongoing Maintenance Cost: Medium
Relative Security Effectiveness: Limited | Potential User Resistance: Low | Upfront Cost: High | Ongoing Maintenance Cost: Medium
SWIFT Customer Security Controls Framework v2022:
6 - 6.4 Logging and Monitoring
6.4 Logging and Monitoring
6 - 6.5A Intrusion Detection
6.5A Intrusion Detection
Приказ ФСТЭК России № 31 от 14.03.2014 "Состав мер защиты информации и их базовые наборы для соответствующего класса защищенности автоматизированной системы управления":
АУД.5
АУД.5 Контроль и анализ сетевого трафика
NIST Cybersecurity Framework (EN):
DE.CM-1
DE.CM-1: The network is monitored to detect potential cybersecurity events
Приказ ФСТЭК России № 239 от 25.12.2017 "Состав мер по обеспечению безопасности для значимого объекта соответствующей категории значимости":
АУД.5
АУД.5 Контроль и анализ сетевого трафика
Связанные защитные меры
Ничего не найдено
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.