Common criteria series CC7: vulnerability and configuration monitoring, anomaly detection, evaluation of security events, incident response and recovery.
Detection and monitoring procedures that find configuration changes introducing new vulnerabilities and exposure to newly discovered vulnerabilities: configuration standards, change detection, unknown components and vulnerability scans.
Monitoring system components and how they operate for anomalies that point to malicious acts, natural disasters or errors, and analyzing anomalies to decide whether they are security events: logging, detection tools and alert filtering.
Evaluating security events to decide whether they are security incidents, meaning they could cause or have caused a failure to meet objectives, and acting on them; with confidentiality or privacy in scope, assessing the impact on that information.
Responding to identified security incidents through a defined incident response program: roles, containment, mitigation, remediation, communication and post-incident evaluation, plus breach procedures when privacy is in scope.
Recovering from identified security incidents: restoring the affected environment, communicating about the incident, finding the root cause, preventing recurrence, and testing the incident recovery plan.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.