Analysis and Monitoring of Anomalous Behavior
Certification criterion
Network and data flows, and the like, shall be collected and analyzed so that intrusion attempts by internal/external actors, attempts to leak personal information, and fraudulent activities can be detected and responded to promptly, and follow-up actions based on the results of monitoring and inspection shall be carried out in a timely manner.
Key checkpoints
- Are network traffic, data flows, event logs, and the like generated by key information systems, applications, networks, and security systems collected, analyzed, and monitored so that anomalous behavior such as intrusion attempts by internal/external actors, attempts to leak personal information, and fraudulent activities can be detected?
- Are criteria and thresholds defined for determining whether an intrusion attempt, an attempt to leak personal information, or fraudulent activity has occurred, and are follow-up actions such as determining and investigating anomalous behavior carried out in a timely manner accordingly?
Detailed explanation
Network traffic, data flows, event logs, and the like generated by key information systems, applications, networks, and security systems shall be collected, analyzed, and monitored so that anomalous behavior such as intrusion attempts by internal/external actors, attempts to leak personal information, and fraudulent activities can be detected.
- A system for collecting and analyzing logs from information systems, security systems, applications, network equipment, and the like shall be in place to determine anomalous behavior
- Targets and scope for which event logs are to be collected or monitored
- Methods of collection, analysis, and monitoring
- Designation of persons in charge and responsible parties
- Reporting system for analysis and monitoring results
- Response procedures when anomalous behavior is discovered, and the like
- Where the size of the organization and the importance of the information system are high, consider 24-hour real-time monitoring
Criteria and thresholds shall be defined for determining whether an intrusion attempt, an attempt to leak personal information, or fraudulent activity has occurred, and follow-up actions such as determining and investigating anomalous behavior shall be carried out in a timely manner accordingly.
- Set anomalous-behavior identification criteria and thresholds for determining anomalous behavior, and reflect them in the system when necessary
- Periodically review and optimize the established criteria and thresholds
- When anomalous behavior is confirmed, perform follow-up actions such as emergency response, requests for explanation, and cause investigation in accordance with the regulations
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 6 (Access Control)
Evidence (examples)
- Status of anomalous-behavior analysis and monitoring
- Evidence of response when anomalous behavior is discovered
Nonconformity examples
- Where a continuous or periodic monitoring system and procedures that would enable recognition of intrusion attempts against servers, networks, databases, and security systems from external sources are not in place
- Where intrusion-attempt monitoring work is outsourced to an external organization such as a specialized external security monitoring company, but no record of reviewing the relevant reports provided by the outsourcing company can be confirmed, or a self-monitoring system for systems excluded from the outsourcing scope is not in place
- Where abnormal traffic exceeding internally defined thresholds is continuously discovered, but no response measures are being taken