Security monitoring: policy and processes
Published 22 June 2015
© Crown copyright 2015
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/security-operations-and-management/security-monitoring-policy-and-processes
1. Security monitoring policy
The information gathered during security monitoring must be used for its intended purpose. Any monitoring of user activities is subject to legal requirements that need to be observed, and the information generated, especially in raw form, will include personal data that needs to be correctly protected and handled.
For these reasons the security monitoring capabilities, their configuration, their use, the supporting business processes, management roles, responsibilities and procedures should be formalised into a security monitoring policy. Depending on the complexity of the organisation, the policy can apply to the entire organisation, or to specific business aspects within it.
The policy should establish:
- what is being monitored and audited, in terms of user scenarios covering:
- actions that need to be accounted for
- actions that would constitute suspicious activity
- what information will be collected to support the user scenarios
- how the information gathered will be used (and not used), to include both permitted and prohibited purposes
- who will access the information, and their responsibilities
- how the information will be protected, stored, retained and disposed of
- how notification of monitoring is achieved, and how user consent is obtained
2. Security monitoring processes
Security monitoring comprises two fundamental processes, collection and analysis. These feed directly into two follow-on processes that deal with incident management and reporting. The final process in the chain deals with information retention and archive.
2.1 Collection
Collection is defined as the process of collecting and recording security monitoring data that is triggered by events that have been identified as requiring security monitoring. Alerts are specific events where the analysis has been done in advance. This means their occurrence indicates the likelihood of an information security incident requiring investigation is high. There are two significant concepts associated with alerts:
- false positive - where an alert is raised and then found not to indicate an information security incident
- false negative - where an information security incident occurs that has failed to raise an expected alert
Too many false positives or false negatives can significantly affect the viability of the security monitoring service. Where this is the case, further analysis (see below) is required to minimise their occurrence.
2.2 Analysis
Analysis is defined as the process of analysing the recorded security monitoring data and applying policy, compliance and business rules to highlight security incidents. The analysis can also provide input into a long-term reporting cycle over which trends are analysed and overall policy direction reviewed.
2.3 Incident management
Incident management is defined as the process aimed at minimising the immediate and long-term business impact of incidents and to prevent re-occurrences. Due to the complexity of this process, it is covered separately under Security incident management.
2.4 Reporting
Reporting is defined as the tangible output of the auditing and event data analysis. Although usually tailored for senior management roles, some reports can be generated for other roles and will contain specific information relevant to their job function.
2.5 Retention and archive
Retention concerns ensuring that security monitoring data is retained only for as long as it is required, and that it is disposed of securely after that time. Archive concerns the provision of long-term storage and protection of accounting information, either for retrospective analysis or for forensic purposes.