[FINAL] C.2 Proactive Security Event Discovery: ● The organisation detects, within networks and information systems, malicious activity affecting, or with the potential to affect, the delivery of essential services even when the activity evades standard signature based security prevent/detect solutions (or when standard solutions are not deployed). Explanation Security Monitoring:​ ​An effective monitoring strategy is required so that actual or attempted security breaches are discovered and there are appropriate processes in place to respond. Good monitoring is more than simply the collection of logs. It is also the use of appropriate tools and skilled analysis to identify indicators of compromise in a timely manner so that corrective action can be taken. This principle also indicates the need to provide effective and ongoing operational security. As time goes on new vulnerabilities are discovered, support arrangements for software and services change and functional needs and uses for technology change. Security is a continuous activity and the effectiveness of the security measures in place should be reviewed and maintained throughout the delivery and operational lifecycle of a system or service. Anomaly Detection:​ Some cyber attackers will go to great lengths to avoid detection via standard security monitoring tools such as anti-virus software, or signature-based intrusion detection systems, which give a direct indication of compromise. Other, less direct, security event indicators may provide additional opportunities for detecting attacks that could result in disruption to essential services. Examples of less direct indicators could include the following: ● ● ● Deviations from normal interaction with systems (e.g. user activity outside normal working hours). Unusual patterns of network traffic (e.g. unexpectedly high traffic volumes, or traffic of an unexpected type etc). ‘Tell-tale’ signs of attack, such as attempts to laterally move across networks, or running privilege escalation software. It is not possible to give a generic list of suitable indicators since their usefulness in detecting malicious activity will vary considerably, depending on how a typical attacker’s actions might reveal themselves in relation to the normal operation of an organisation’s networks and information systems. Opportunities for exploiting these less direct security event indicators to improve network and information system security should be proactively investigated, assessed and implemented when feasible e.g. technically possible, cost effective etc. Successful attack detection by means of less direct security event indicators may depend on identifying combinations of network events that match likely attacker behaviour, and will therefore require an analysis and assessment capability to determine the security significance of detected events. Wherever possible, network and information systems supporting the delivery of essential Page 34