Front cover - IBM Redbooks

3. Systems must be able to log invalid access attempts against the access
control policies defined and approved for the system (in other words, define
what constitutes a log exception). The log should contain all information that
would be pertinent to a security investigation such as: user ID, source
address, destination address, time, date, protocol, port, process, and NETID.
4. Systems must have a process for detecting systematic attacks, or detecting
intrusions against the system. Activity logs are instrumental for this purpose,
but should not be the sole method of intrusion detection. If no dedicated
intrusion detection tool is compatible with a given system, then a procedure
must be implemented whereby logs for the system are reviewed regularly and
frequently, such as weekly at a minimum.
5. The organization’s security policy should define procedures for reporting
incidents related to systems and components. It should cover incidents that
originate from both external and internal sources. Due to increasing
legislation, the procedures for handling and preserving potential evidence
should be defined as part of the organization’s incident response plan.
Assessment
The assessment function includes health checking, vulnerability scanning and
technical testing. Assessments are the processes and procedures, defined in the
organization’s security policy, whereby the organization has the ability to validate
that the security system components are functioning as designed and as a whole
are providing the protection intended. Periodic assessments are also valuable
because they provide an opportunity to evaluate if the current layers of defense
address the latest potential exploits.
When changes are made that affect the security controls implemented within a
system or subsystem, testing must be completed to assure that the controls
specified are active and continuing to function as designed. Documentation of
changes to any component must be maintained and regularly reviewed to ensure
no security measure has been affected. A formal annual security assessment
review is a recommended best practice. If a security assessment reveals a
negative finding, there should be a procedure defined in the organization’s
security policy that describes the actions required and time frame in which they
must be performed.
The most thorough security assessment will engage a test team to inspect the
overall system. Often, a more thorough and objective assessment will be
conducted if people outside the organization are performing the testing. We
recommend that the results of such a test team investigation be incorporated and
documented as part of the annual security assessment process. We strongly
recommend that the appropriate levels of management approval be obtained
prior to conducting any form of vulnerability testing, and all parties that either
support or use a particular system should be identified as the first step in
Chapter 3. Secure infrastructure requirements 113