Subcontrol 12.6 - Githubissues

adammontville / cis-controls-71-measures

0 stars 0 forks source link

Subcontrol 12.6 #114

Open adammontville opened 5 years ago

adammontville commented 5 years ago

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries.

Measures

>indicators of compromise (IOCs) and network telemetry is used to identify attacks
>Fressnes(how frequently IOC is collected) 
> Completeness(How much is covered by listed IOC)

Metrics

see measure

adammontville commented 5 years ago

Notes: Reading this control as "deploy network-intrusion detection system sensors at each of the organization's network boundaries."

Inputs:

List of network boundaries
List of IDS sensors

Operations:

For each IDS sensor, enumerate network boundaries covered

Measures:

M1 - Count of network boundaries
M2 - Count of IDS sensors
M3 - Count of network boundaries covered by IDS sensors

Metrics:

(M1 - M3) / M1 - Percentage of network boundaries not covered by IDS sensors

wmunyan commented 5 years ago

Accepted