Policy 7230A - Department of Administration

6.2. Integrity Operations
The following are the Non-Mandatory Procedures that support the Integrity
Operations section of the Default Security Requirements:
6.2.1. Monitor System Security Controls
Agencies should provide for continuous monitoring of security controls to
ensure that the value of the implemented controls is not undermined and their
security protection is not minimized:
6.2.1.1 Identify Sources of Information
Before monitoring can be performed, the organization must
determine the granularity with which monitoring of the infrastructure
will be performed and configure the infrastructure to perform that
monitoring:
• Decide on the infrastructure level to be monitored.
• Establish what information capturing capabilities exist natively
to infrastructure components that could be monitored.
• Determine which infrastructure components will be
monitored to achieve the required granularity.
• Configure monitoring capabilities to capture required
information.
6.2.1.2 Collect and Collate Data from All Sources
Combining monitoring information from multiple sources allows for
events to be reviewed with greater context. This contextualization
yields greater insight into the nature and potential results of any
event:
• Gather monitoring information from disparate systems on a
periodic basis.
• Consolidate disparate monitoring information into a central
repository.
6.2.1.3 Analyze Aggregated Data
Once monitoring data has been collected it must be reviewed for
potential threats and threat trends to determine if Incident Response
processes should be activated:
• Review monitoring data for Precursors of potential threat as
well as Indicators of actual threat. Examine both individual
events as well as event trend data.
21