IL3 (Detect and Resist) Controls


• he detection of all suspected internal attacks.
• The detection of all suspected internal attacks.
• All commands issued to internal network devices and central consoles of internal monitoring systems should be logged and reportable.
• Packets being passed by internal firewalls should be logged and reportable.
• All actions invoked by users in response to an internal attack notification.
• Every change in status of the internal attack recognition software (SIEM, NBA, IDS or IPS) signature base.