Information Security Office

The University of Texas at San Antonio

Information Resource Standards

Security Monitoring Standard

Purpose - Security Monitoring provides a means by which to confirm that information resource security controls are in place, are effective and are not being bypassed. One of the benefits of security monitoring is the early identification of wrongdoing or new security vulnerabilities.  Early detection and monitoring can prevent possible attacks or minimize their impact on computer systems. Other benefits include Audit Compliance, Service Level Monitoring, Performance Measuring, Limiting Liability and Capacity Planning.  This standard serves as a companion to the Intrusion Detection Standard and provides for the continuous monitoring that takes place at the system level.

Audience - The UTSA Security Monitoring Standard applies to all individuals who that are responsible for the installation of new information resources, the operations of existing information resources and individuals charged with information resource security.

1. UTSA will use automated tools to provide real-time notification of detected wrongdoing and vulnerability exploitation. Where possible, a security baseline will be developed and the tools will report exceptions. These tools will be deployed by the Office of Information Technology to monitor UTSA computers and devices for:
   1. Internet traffic
   2. Electronic mail traffic
   3. LAN traffic, protocols and device inventory
   4. Operating system security parameters
   5. Rogue access points/devices
   6. Installed software on servers and desktops
2. The following files will be checked for signs of illicit activity and vulnerability to exploitation at a frequency determined by risk:
   1. Automated intrusion detection system logs
   2. Firewall logs
   3. User account logs
   4. Network scanning logs
   5. System error logs
   6. Configuration files
   7. Application logs
   8. Data backup and recovery logs
   9. Help desk trouble tickets
   10. Telephone activity – Call Detail Reports
   11. Network printer and fax logs
3. Assigned individuals will monitor the following (at least annually):
   1. Password strength
   2. Unauthorized network devices
   3. Unauthorized personal web servers
   4. Unsecured sharing of devices
   5. Unauthorized modem use
   6. Operating System and software licenses
4. For audit purposes, logs will be archived for a minimum of 90 days.
5. Any security issues discovered will be reported to the ISO for follow-up investigation.