IR-4(6): Insider Threats
Implement an incident handling capability for incidents involving insider threats.
- Control Family: Incident Response
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
Search Results for: insider
AT-2(2): Insider Threat
Provide literacy training on recognizing and reporting potential indicators of insider threat.
- Control Family: Awareness and Training
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
PM-12: Insider Threat Program
Implement an insider threat program that includes a cross-discipline insider threat incident handling team.
- Control Family: Program Management
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
IR-4(7): Insider Threats – Intra-organization Coordination
Coordinate an incident handling capability for insider threats that includes the following organizational entities [Assignment: organization-defined entities].
- Control Family: Incident Response
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
AT-2(2): Insider Threat
The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
- Control Family: Awareness And Training
- Control Set: NIST Special Publication 800-53 Revision 4
PM-12: Insider Threat Program
The organization implements an insider threat program that includes a cross-discipline insider threat incident handling team.
- Control Family: Program Management
- Control Set: NIST Special Publication 800-53 Revision 4
IR-4(6): Insider Threats – Specific Capabilities
The organization implements incident handling capability for insider threats.
- Control Family: Incident Response
- Control Set: NIST Special Publication 800-53 Revision 4
IR-4(7): Insider Threats – Intra-Organization Coordination
The organization coordinates incident handling capability for insider threats across [Assignment: organization-defined components or elements of the organization].
- Control Family: Incident Response
- Control Set: NIST Special Publication 800-53 Revision 4
3.2.3: Provide security awareness training on recognizing and reporting potential indicators of insider threat
Potential indicators and possible precursors of insider threat include behaviors such as: inordinate, long-term job dissatisfaction; attempts to gain access to information that is not required for job performance; unexplained access to financial resources; bullying or sexual harassment of fellow employees; workplace violence; and other serious violations of the policies, procedures, directives, rules, or practices … Continue reading ""
- Control Family: Awareness and Training
- Control Set: NIST Special Publication 800-171 Revision 2
03.02.01: Literacy Training and Awareness
Provide security literacy training to system users: As part of initial training for new users and [Assignment: organization-defined frequency] thereafter, When required by system changes or following [Assignment: organization-defined events], and On recognizing and reporting indicators of insider threat, social engineering, and social mining. Update security literacy training content [Assignment: organization-defined frequency] and following [Assignment: … Continue reading ""
- Control Family: Awareness and Training
- Control Set: NIST SP 800-171 Revision 3.0
CA-2(2): Specialized Assessments
Include as part of control assessments, [Assignment: organization-defined specialized assessment frequency], [Assignment: announced, unannounced], [Assignment (one or more): in-depth monitoring, security instrumentation, automated security test cases, vulnerability scanning, malicious user testing, insider threat assessment, performance and load testing, data leakage or data loss assessment, [Assignment: organization-defined other forms of assessment] ].
- Control Family: Assessment, Authorization, and Monitoring
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
AC-3(2): Dual Authorization
Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other actions].
- Control Family: Access Control
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
AC-23: Data Mining Protection
Employ [Assignment: organization-defined techniques] for [Assignment: organization-defined data storage objects] to detect and protect against unauthorized data mining.
- Control Family: Access Control
- Control Set: NIST Special Publication 800-53 Revision 5
DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events
[csf.tools Note: Subcategories do not have detailed descriptions.]
- Framework Category: Continuous Monitoring
- Framework: NIST Cybersecurity Framework v2.0
CA-2(2): Specialized Assessments
The organization includes as part of security control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: organization-defined other forms of security assessment]].
- Control Family: Security Assessment And Authorization
- Control Set: NIST Special Publication 800-53 Revision 4
AC-6(9): Log Use of Privileged Functions
Log the execution of privileged functions.
- Control Family: Access Control
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
AU-6(9): Correlation with Information from Nontechnical Sources
Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
- Control Family: Audit and Accountability
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
SI-4(5): System-generated Alerts
Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].
- Control Family: System and Information Integrity
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
SI-4(12): Automated Organization-generated Alerts
Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].
- Control Family: System and Information Integrity
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
03.01.07: Least Privilege — Privileged Functions
Prevent non-privileged users from executing privileged functions. Log the execution of privileged functions.
- Control Family: Access Control
- Control Set: NIST SP 800-171 Revision 3.0
RS.CO-03: Information is shared with designated internal and external stakeholders
[csf.tools Note: Subcategories do not have detailed descriptions.]
- Framework Category: Incident Response Reporting And Communication
- Framework: NIST Cybersecurity Framework v2.0
SI-20: Tainting
Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: organization-defined systems or system components].
- Control Family: System and Information Integrity
- Control Set: NIST Special Publication 800-53 Revision 5.2.0
AC-6(9): Auditing Use Of Privileged Functions
The information system audits the execution of privileged functions.
- Control Family: Access Control
- Control Set: NIST Special Publication 800-53 Revision 4
SI-4(12): Automated Alerts
The organization employs automated mechanisms to alert security personnel of the following inappropriate or unusual activities with security implications: [Assignment: organization-defined activities that trigger alerts].
- Control Family: System And Information Integrity
- Control Set: NIST Special Publication 800-53 Revision 4
AU-6(9): Correlation With Information From Nontechnical Sources
The organization correlates information from nontechnical sources with audit information to enhance organization-wide situational awareness.
- Control Family: Audit And Accountability
- Control Set: NIST Special Publication 800-53 Revision 4