Detect Unusual Behaviour

Intent of this Standard

To minimise the time to detect breaches and compromises, organisations need to be able to proactively monitor for any anomalous or unintended changes or activity within their environment. Early detection will assist in limiting the impact of any breach or compromise and enables organisations to activate steps that facilitate their containment and incident response processes.

For this to be successful, an understanding of the baseline operating environment and behaviour will aid in the early detection and identification of unusual or unexpected behaviour. Establishing and maintaining a baseline for an operating environment, in conjunction with regular reviews, will effectively reduce false-positive detection rates.

The area of anomalous behaviour detection is broad, and this Standard seeks to provide guidance on initial deployments. This Standard addresses the areas of successful and unsuccessful user authentication, privilege escalation, and infrastructure utilisation.

Minimum capability maturity level

We have established criteria within a maturity model to provide clarity, including the expected minimum implementation level, which is CS-CMM 2.

Cyber Security Capability Maturity Model

The requirements are intended to meet and comply with each respective level of maturity. The levels provide a pathway that can be used by agencies to assess themselves against, with a view to improving maturity over time.

Each maturity level builds on the requirement from the preceding level.

Below are the requirements for each capability maturity level for this Standard.

Focus areas

Focus areas are applicable to the Standard and are provided as a guide and not an exhaustive list. Each agency is best placed to identify areas of relevance.

The focus areas for this Standard are:

• Corporate network

• Cloud services

• Software as a service

• Bring-your-own-device access

• Internal systems

• Domain Naming System (DNS).

Suggested actions

The following list is not exhaustive. Organisations should identify which actions are appropriate to implement the Standard based on their current maturity level. However, the following actions follow good practice guidelines:

• Development of a baseline of utilisation for infrastructure.
• Monitoring failed login attempts, privileged operations, failed attempts to elevate privileges.
• Defining a tiered response plan (based on incident categorisation) to activate if unusual behaviour has been identified.
• Where possible, automatic responses such as lockouts on pre-determined repeated authentication failures are implemented.
• Allocating of resources to oversee and administer monitoring, detection and reporting.

Key dependencies

To implement this Standard, there are likely to be requisite measures or technologies in place.

A number of dependencies apply to multiple standards. In general, these dependencies are less technology-specific and relate to business processes.

Key dependencies for this Standard include:

• Centralised logging with adequate log retention function.
• Monitoring of infrastructure utilisation, including compute and network, occurs.
• Assets have been identified and their criticality evaluated.
• Threat intelligence capability to provide indicators of compromise exists.

Measurable outcomes

To establish whether the Standard is being implemented, the outcomes are a tool an organisation may wish (or already have in place) to measure to help make this determination.

The outcomes have been designed to align with the requirements contained in the maturity level.

Outcomes for this Standard include:

• An ongoing trend/baseline of utilisation of infrastructure, including network telemetry, is maintained and reviewed against.
• Maintaining a predefined tiered response plan to identify unusual behaviour exists and is regularly tested and updated when required.
• Centralised immutable logging capability exists.
• Proactive monitoring and response to unusual behaviour such as:
  • Security-related system alerts and failures
  • Modifications to permissions or protected system files
  • Repeated login failures
  • Authentication from unexpected or ‘impossible travel’ locations
  • Activities outside of regular business hours
  • Unexpected or unusual network and compute utilisation.