8.16 Monitoring Activities

Networks, systems and applications should be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

Monitoring activities in information security refers to the ongoing process of observing and analyzing system and network activity in order to identify and respond to potential security threats and vulnerabilities.

Monitoring activities can include the use of various tools and techniques, such as:

• Intrusion detection and prevention systems (IDPS): These systems monitor network traffic and use rules, signatures, and other techniques to detect and block malicious activity.
• Security Information and Event Management (SIEM) systems: These systems collect and analyze log data from multiple sources, such as servers, network devices, and applications, to detect and alert on potential security incidents.
• Vulnerability scanning and penetration testing: These activities involve using automated tools or manual techniques to identify and assess systems, networks, and applications vulnerabilities.
• Behavioral analysis: This approach monitors the behaviour of users, systems, and network traffic to detect any abnormal or malicious activity.
• Network and system monitoring: This involves monitoring the performance and availability of systems, networks, and applications to ensure that they are functioning correctly and to detect any issues that could affect security.
• Security cameras and physical access controls: This involves monitoring the physical access to the buildings and data centers, to detect any unauthorised access, and also to record the activities to be used in case of an incident.
The goal of monitoring activities is to detect and respond to security incidents as quickly as possible in order to minimize the impact of the incident, and to improve overall security posture of the organisation. It is important to have a well-defined monitoring plan in place and to ensure that the monitoring tools and processes are effective, efficient, and compliant with regulatory requirements.