SI-4(25): Optimize Network Traffic Analysis

Control Family:

System and Information Integrity

Parent Control:

SI-4: System Monitoring

CSF v1.1 References:

ID.RA-1
PR.DS-5
PR.IP-8
DE.AE-1
DE.AE-2
DE.AE-3
DE.AE-4
DE.CM-1
DE.CM-4
DE.CM-5
DE.CM-6
DE.CM-7
DE.DP-2
DE.DP-3
DE.DP-4
DE.DP-5
RS.AN-1

Threats Addressed:

Lateral Movement

Baselines:

(Not part of any baseline)

Control is new to this version of the control set.

Control Statement

Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.

Supplemental Guidance

Encrypted traffic, asymmetric routing architectures, capacity and latency limitations, and transitioning from older to newer technologies (e.g., IPv4 to IPv6 network protocol transition) may result in blind spots for organizations when analyzing network traffic. Collecting, decrypting, pre-processing, and distributing only relevant traffic to monitoring devices can streamline the efficiency and use of devices and optimize traffic analysis.