IL3 (Detect and Resist) Controls
he detection of all suspected internal attacks.
The detection of all suspected internal attacks.
All commands issued to internal network devices and central consoles of internal monitoring systems should be logged and reportable.
Packets being passed by internal firewalls should be logged and reportable.
All actions invoked by users in response to an internal attack notification.
Every change in status of the internal attack recognition software (SIEM, NBA, IDS or IPS) signature base.