SI-4.18: Analyze Traffic and Covert Exfiltration

outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information;

outbound communications traffic is analyzed at interior points to detect covert exfiltration of information.

System and information integrity policy

system and information integrity procedures

procedures addressing system monitoring tools and techniques

system design documentation

network diagram

system monitoring tools and techniques documentation

system configuration settings and associated documentation

system monitoring logs or records

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

organizational personnel installing, configuring, and/or maintaining the system

organizational personnel responsible for monitoring the system

organizational personnel responsible for the intrusion detection system

Organizational processes for intrusion detection and system monitoring

mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities

mechanisms supporting and/or implementing an analysis of outbound communications traffic