NIST SP 800-171 3.3.5 ๐๐จ๐ซ๐ซ๐๐ฅ๐๐ญ๐ ๐๐ฎ๐๐ข๐ญ ๐ซ๐๐๐จ๐ซ๐ ๐ซ๐๐ฏ๐ข๐๐ฐ, ๐๐ง๐๐ฅ๐ฒ๐ฌ๐ข๐ฌ, ๐๐ง๐ ๐ซ๐๐ฉ๐จ๐ซ๐ญ๐ข๐ง๐ ๐ฉ๐ซ๐จ๐๐๐ฌ๐ฌ๐๐ฌ ๐๐จ๐ซ ๐ข๐ง๐ฏ๐๐ฌ๐ญ๐ข๐ ๐๐ญ๐ข๐จ๐ง ๐๐ง๐ ๐ซ๐๐ฌ๐ฉ๐จ๐ง๐ฌ๐ ๐ญ๐จ ๐ข๐ง๐๐ข๐๐๐ญ๐ข๐จ๐ง๐ฌ ๐จ๐ ๐ฎ๐ง๐ฅ๐๐ฐ๐๐ฎ๐ฅ, ๐ฎ๐ง๐๐ฎ๐ญ๐ก๐จ๐ซ๐ข๐ณ๐๐, ๐ฌ๐ฎ๐ฌ๐ฉ๐ข๐๐ข๐จ๐ฎ๐ฌ, ๐จ๐ซ ๐ฎ๐ง๐ฎ๐ฌ๐ฎ๐๐ฅ ๐๐๐ญ๐ข๐ฏ๐ข๐ญ๐ฒ.
This is the 8th most likely requirement to be “other than satisfied” by defense contractors, according to the DoD’s Cybersecurity Assessment Center.
The problem is that this requirement can be read in two (totally) different ways.
๐ฎ๐ป Option 1) When scary logs are generated, ๐ด๐ฐ๐ฎ๐ฆ๐ฐ๐ฏ๐ฆ ๐ฏ๐ฐ๐ต๐ช๐ค๐ฆ๐ด ๐ข๐ฏ๐ฅ ๐ด๐ต๐ข๐ณ๐ต๐ด ๐ฅ๐ฐ๐ช๐ฏ๐จ ๐ช๐ฏ๐ค๐ช๐ฅ๐ฆ๐ฏ๐ต ๐ณ๐ฆ๐ด๐ฑ๐ฐ๐ฏ๐ด๐ฆ! In other words “see something, do something”.
๐ Option 2) All logs from all systems need to go to a central place so that you can ‘correlate’ multiple sources of logs together using technical means.
Very different interpretations, right???
My personal take: I think that Option 1 ๐ฎ๐ป is the best way to interpret this requirement. I’m looking at the word ๐ฉ๐ซ๐จ๐๐๐ฌ๐ฌ๐๐ฌ to mean manual activities performed by people.
Without Option 1 ๐ฎ๐ป, we have a problem where 800-171 requires lots of logs, and it requires lots of incident response, but there is no link between the two. I think we need this requirement to tell companies that they have to start incidents when they see ๐ข๐ง๐๐ข๐๐๐ญ๐ข๐จ๐ง๐ฌ ๐จ๐ ๐ฎ๐ง๐ฅ๐๐ฐ๐๐ฎ๐ฅ, ๐ฎ๐ง๐๐ฎ๐ญ๐ก๐จ๐ซ๐ข๐ณ๐๐, ๐ฌ๐ฎ๐ฌ๐ฉ๐ข๐๐ข๐จ๐ฎ๐ฌ, ๐จ๐ซ ๐ฎ๐ง๐ฎ๐ฌ๐ฎ๐๐ฅ ๐๐๐ญ๐ข๐ฏ๐ข๐ญ๐ฒ.
My personal pet peeve: I’ve talked to many companies that hired external SOC services or MSSPs, are paying them thousands of dollars per month, and have had “zero” incidents in the last year. ๐น๐๐๐๐๐? ๐ช’๐๐๐.
That is an example of not correlating audit record review to analysis and reporting processes.
Another argument for Option 1 ๐ฎ๐ป – an examinable object for this is “procedures addressing investigation of and response to suspicious activities”.
I also respect those who interpret 3.3.5 as Option 2 ๐ – Have a SIEM. A test object is “mechanisms supporting analysis and correlation of audit records”. This would normally be done by collecting logs in a central location so that you can correlate different alarms and activities as an intruder passes through your different systems.
Maybe both???
In preparation for Kieri Solution’s CMMC assessment by DIBCAC, we took the “both” approach to be safe. We discussed how we have processes that ensure incidents are started when there is scary activity in the logs. We also mentioned how we use a SIEM. Our assessors were satisfied.