SI-4 Information System Monitoring

Description

Information system monitoring includes external and internal monitoring.

External monitoring includes the observation of events occurring at the information system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the information system.

Organizations can monitor information systems, for example, by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events.

Information system monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software).

Strategic locations for monitoring devices include, for example, selected perimeter locations and near server farms supporting critical applications, with such devices typically being employed at the managed interfaces associated with controls SC-7 and AC-17. Einstein network monitoring devices from the Department of Homeland Security can also be included as monitoring devices.

The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of information systems to support such objectives. Specific types of transactions of interest include, for example, Hyper Text Transfer Protocol (HTTP) traffic that bypasses HTTP proxies.

Information system monitoring is an integral part of organizational continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs.

A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless.

Applicability

This Control applies to all university managed information resources containing mission critical information, confidential information, and other information resources as may be managed by TAMU-CC.

The purpose of the implementation of this Control is to provide a set of measures that will mitigate information security risks associated with security monitoring. There may be other or additional measures that will provide appropriate mitigation of the risks. The assessment of potential risks and the application of appropriate mitigation measures are to be determined by the information resource owner or their designee.

The intended audience is all individuals that are responsible for the installation of new information resources, the operations of existing information resources, and individuals charged with information resources security.

Implementation

Chief Information Officer (CIO) or his/her designated representative and Chief Information Security and Privacy Officer shall establish a security strategy that includes perimeter protection. TAMU-CC ensures the security of information systems through monitoring network traffic and use of information resources:

1. Monitors the information system to detect:
   1. Attacks and indicators of potential attacks in accordance with alerts from monitoring devices and services; and
   2. Unauthorized local, network, and remote connections;
2. The Office of Information Security will provide security information management services to include external network monitoring, scanning, and alerting for TAMU-CC that utilize TAMU-CC information resources as specified in Texas Government Code, Chapter 2054, Information Resources [TGC 2054] and Chapter 2059, Texas Computer Network Security System [TGC 2059]. Perimeter security controls may include some or all of the following components: DMZ, firewall, intrusion detection or prevention system, or router.
3. Identifies unauthorized use of the information system through alerts generated by monitoring devices and services;
4. Deploys monitoring devices:
   1. Strategically within the information system to collect organization-determined essential information; and
   2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;
5. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;
6. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the nation based on law enforcement information, intelligence information, or other credible sources of information;
7. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, executive orders, directives, policies, or regulations; and
8. Provides alerts and status updates to Owners and Custodians of Information Resources.

Revision History

Last Updated: February 21, 2025

Previous Versions:

• June 29, 2023
• May 31, 2022
• March 25, 2021
• September 16, 2019