id: "SI-04(11)" title: "Analyze Communications Traffic Anomalies" family: "SI" family_name: "System and Information Integrity" sort_id: "si-04.11" priority: "P1" implementation_level: "system" parent: "SI-04" enhancement: True
Statement
Analyze outbound communications traffic at the external interfaces to the system and selected {{ insert: param, si-04.11_odp }} to discover anomalies.
Guidance
Organization-defined interior points include subnetworks and subsystems. Anomalies within organizational systems include large file transfers, long-time persistent connections, attempts to access information from unexpected locations, the use of unusual protocols and ports, the use of unmonitored network protocols (e.g., IPv6 usage during IPv4 transition), and attempted communications with suspected malicious external addresses.
Assessment Objective: outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies;
Assessment Objective: outbound communications traffic at {{ insert: param, si-04.11_odp }} is analyzed to discover anomalies.
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
network diagram
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
Organizational processes for intrusion detection and system monitoring
mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
mechanisms supporting and/or implementing the analysis of communications traffic