id: "SI-04(25)" title: "Optimize Network Traffic Analysis" family: "SI" family_name: "System and Information Integrity" sort_id: "si-04.25" priority: "P1" implementation_level: "system" parent: "SI-04" enhancement: True
Statement
Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
Guidance
Encrypted traffic, asymmetric routing architectures, capacity and latency limitations, and transitioning from older to newer technologies (e.g., IPv4 to IPv6 network protocol transition) may result in blind spots for organizations when analyzing network traffic. Collecting, decrypting, pre-processing, and distributing only relevant traffic to monitoring devices can streamline the efficiency and use of devices and optimize traffic analysis.
Assessment Objective: visibility into network traffic at external system interfaces is provided to optimize the effectiveness of monitoring devices;
Assessment Objective: visibility into network traffic at key internal system interfaces is provided to optimize the effectiveness of monitoring devices.
System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system architecture
system audit records
network traffic reports
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring system hosts
Organizational processes for system monitoring
organizational processes for the discovery, collection, distribution, and use of indicators of compromise
mechanisms supporting and/or implementing a system monitoring capability
mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise