Threat Activity Response & Reporting Function
Parent: GR
Description
The mission should develop parameters to describe normal activities on the network for accessing and controlling mission applications and capabilities in a manner that allows security operations incident response and leadership to make effective decisions about resource allocation and risk management.
Mapped SPARTA techniques
2 techniques
The practice requires parameters describing normal network activity for accessing and controlling mission applications. Overflowing the audit log is an abnormality against that baseline, though the practice governs the baseline rather than protecting the log.
Malicious commanding through a valid ground station authenticates correctly, so a baseline of normal commanding activity is one of the few controls that can surface it. The practice's parameters are that baseline, which is active detection against the technique's defining vector.
Cite as SafeMode Space, nasa-bpg GR-MON-04.