id: "SI-04(18)" title: "Analyze Traffic and Covert Exfiltration" family: "SI" family_name: "System and Information Integrity" sort_id: "si-04.18" priority: "P1" implementation_level: "system" parent: "SI-04" enhancement: True
Statement
Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: {{ insert: param, si-04.18_odp }}.
Guidance
Organization-defined interior points include subnetworks and subsystems. Covert means that can be used to exfiltrate information include steganography.
Assessment Objective: outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information;
Assessment Objective: outbound communications traffic is analyzed at {{ insert: param, si-04.18_odp }} to detect covert exfiltration of information.
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
network diagram
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system
Organizational processes for intrusion detection and system monitoring
mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
mechanisms supporting and/or implementing an analysis of outbound communications traffic