Principle C2: Proactive security event discovery

The organisation detects, within networks and information systems, malicious activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard signature based security prevent/detect solutions (or when standard solutions are not deployable).

Description

You define examples of abnormalities in system behaviour that provide practical ways of detecting malicious activity that is otherwise hard to identify.

Indicators of good practice (IGP) achievement levels

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing

1. Understanding of normal system behaviour – Obtain and inspect organisation’s documentation establishing baselines for normal system behaviour. Verify that it is comprehensive, and interrogate how the organisation would use this to search for system abnormalities. (A#1)

2. Threat intelligence – Obtain and inspect documentation showing the organisation collects system abnormality descriptions from threat intelligence and past attacks. Verify that it uses them to identify and investigate malicious activity. (A#2)

3. Searching according to risk – Obtain and inspect evidence that the organisation has rationalised which attacks are likely to impact its essential functions. Verify that it searches for indicators of these attacks when performing searches for system abnormalities. (A#3)

4. Updating system abnormality descriptions – Assess the organisation has a process for updating system abnormality descriptions to reflect changes in the organisation’s networks and information systems and current threat intelligence. Obtain samples of updates and verify that the process is followed. (A#4)

Suggested documentation list

Suggested documentation includes:

• system behaviour baselines
• system abnormality descriptions from threat intelligence and past incidents
• evidence of risk assessments being used for system abnormality searches
• review process for system abnormality descriptions

Description

You use an informed understanding of more sophisticated attack methods and of normal system behaviour to monitor proactively for malicious activity.

Indicators of good practice (IGP) achievement levels

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Suggested approach to testing

1. Proactive security event discovery management – Obtain and inspect evidence to assess whether:

1. System abnormalities are routinely searched for to indicate any malicious activity on the networks and information systems. (A#1)
2. Alerts are generated based on system abnormalities detected. (A#1)
3. The organisation has carried out testing to gain confidence that its searches are effective in detecting system abnormalities indicative of suspicious activity. (A#2)

Suggested documentation list

Suggested documentation includes:

• evidence of system abnormality searches being routinely performed
• configuration of alerts for system abnormality detection
• assurance activities relating to system abnormality searches