#iso27002/2022/EN
## 8.16 Monitoring activities

| **Control type**       | **Information security properties**       | **Cybersecurity concepts** | **Operational capabilities**           | **Security domains** |
| ---------------------- | ----------------------------------------- | -------------------------- | -------------------------------------- | -------------------- |
| #Detective #Corrective | #Confidentiality #Integrity #Availability | #Detect #Respond           | #Information_security_event_management | #Defence             |

  
**Control**
Networks, systems and applications should be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

**Purpose**
To detect anomalous behaviour and potential information security incidents.

**Guidance**
The monitoring scope and level should be determined in accordance with business and information security requirements and taking into consideration relevant laws and regulations. Monitoring records should be maintained for defined retention periods.

The following should be considered for inclusion within the monitoring system:

a\) outbound and inbound network, system and application traffic;

b\) access to systems, servers, networking equipment, monitoring system, critical applications, etc.;

c\) critical or admin level system and network configuration files;

d\) logs from security tools \[e.g. antivirus, IDS, intrusion prevention system (IPS), web filters, firewalls, data leakage prevention\];

e\) event logs relating to system and network activity;

f\) checking that the code being executed is authorized to run in the system and that it has not been tampered with (e.g. by recompilation to add additional unwanted code);

g\) use of the resources (e.g. CPU, hard disks, memory, bandwidth) and their performance.

The organization should establish a baseline of normal behaviour and monitor against this baseline for anomalies. When establishing a baseline, the following should be considered:

a\) reviewing utilization of systems at normal and peak periods;

b\) usual time of access, location of access, frequency of access for each user or group of users.

The monitoring system should be configured against the established baseline to identify anomalous behaviour, such as:

a\) unplanned termination of processes or applications;

b\) activity typically associated with malware or traffic originating from known malicious IP addresses or network domains (e.g. those associated with botnet command and control servers);

c\) known attack characteristics (e.g. denial of service and buffer overflows);

d\) unusual system behaviour (e.g. keystroke logging, process injection and deviations in use of standard protocols);

e\) bottlenecks and overloads (e.g. network queuing, latency levels and network jitter);

f\) unauthorized access (actual or attempted) to systems or information;

g\) unauthorized scanning of business applications, systems and networks;

h\) successful and unsuccessful attempts to access protected resources (e.g. DNS servers, web portals and file systems);

i\) unusual user and system behaviour in relation to expected behaviour.

Continuous monitoring via a monitoring tool should be used. Monitoring should be done in real time or in periodic intervals, subject to organizational need and capabilities. Monitoring tools should include the ability to handle large amounts of data, adapt to a constantly changing threat landscape, and allow for real-time notification. The tools should also be able to recognize specific signatures and data or network or application behaviour patterns.

Automated monitoring software should be configured to generate alerts (e.g. via management consoles, email messages or instant messaging systems) based on predefined thresholds. The alerting system should be tuned and trained on the organization’s baseline to minimize false positives. Personnel should be dedicated to respond to alerts and should be properly trained to accurately interpret potential incidents. There should be redundant systems and processes in place to receive and respond to alert notifications.

Abnormal events should be communicated to relevant parties in order to improve the following activities: auditing, security evaluation, vulnerability scanning and monitoring (see 5.25). Procedures should be in place to respond to positive indicators from the monitoring system in a timely manner, in order to minimize the effect of adverse events (see 5.26) on information security. Procedures should also be established to identify and address false positives including tuning the monitoring software to reduce the number of future false positives.

  **Other information**

Security monitoring can be enhanced by:

a\) leveraging threat intelligence systems (see 5.7);

b\) leveraging machine learning and artificial intelligence capabilities;

c\) using blocklists or allowlists;

d\) undertaking a range of technical security assessments (e.g. vulnerability assessments, penetration testing, cyber-attack simulations and cyber response exercises), and using the results of these assessments to help determine baselines or acceptable behaviour;

e\) using performance monitoring systems to help establish and detect anomalous behaviour;

f\) leveraging logs in combination with monitoring systems.

Monitoring activities are often conducted using specialist software, such as intrusion detection systems. These can be configured to a baseline of normal, acceptable and expected system and network activities.

Monitoring for anomalous communications helps in the identification of botnets (i.e. set of devices under the malicious control of the botnet owner, usually used for mounting distributed denial of service attacks on other computers of other organizations). If the computer is being controlled by an external device, there is a communication between the infected device and the controller. The organization should therefore employ technologies to monitor for anomalous communications and take such action as necessary.