Subcontrol 12.8

[adammontville]

Enable the collection of NetFlow and logging data on all network boundary devices.

Measures

>Coverage = # of boundary device with netflow enabled
 / # of boundary device
>Quality measure = # of stored probe
 / # of sent probe through unique boundary device

Metrics

see measure

[adammontville]

NOTES: Assumes organization has positive control over inventory - explicitly ignores the case where there may be a network boundary device present and not accounted for (if other controls are working, this should not be the case).

Inputs:

• List of network boundary devices (from inventory)

Operations:

• For each network boundary device,
  • Check configuration for NetFlow data (i.e. NetFlow is enabled)
  • Check configuration for logging data (i.e. logging is enabled)

Measures:

• M1 - Count of network boundary devices
• M2 - Count of network boundary devices with NetFlow enabled
• M3 - Count of network boundary devices with logging enabled
• M4 - Count of network boundary devices with both NetFlow and logging enabled

Metrics:

• (M1 - M2) / M1 - Percentage of network boundary devices with misconfigured NetFlow
• (M1 - M3) / M1 - Percentage of network boundary devices with misconfigured logging
• (M1 - M4) / M1 - Percentage of misconfigured network boundary devices

[wmunyan]

Accepted.