STANDARD FOR SECURITY MONITORING

 

The University of Texas at San Antonio

Office of Information Technology

Office of Information Security (OIS) Standards

 

OIS 32 – Standard for Security Monitoring

 


I.  STANDARD STATEMENT


This standard serves as a companion to the Standard for Intrusion Detection and provides for the continuous monitoring that takes place at the system level.

 


RATIONALE


This standard supports HOP Policy 8-12 Information Resources Use and Security Policy.

 


III. SCOPE


This standard applies to all UTSA faculty, staff, and students.

 


IV.  CONTACTS


If you have any questions about OIS 32 – Standard for Security Monitoring contact the following office:

 

The Office of Information Security

informationsecurity@utsa.edu

 


V.  PROCEDURES 


1. Security Monitoring provides a means by which to confirm that information resource security controls are in place, are effective and are not being bypassed. One of the benefits of security monitoring is the early identification of wrongdoing or new security vulnerabilities. Early detection and monitoring can prevent possible attacks or minimize their impact on computer systems. Other benefits include audit compliance, service level monitoring, performance measuring, limiting liability and capacity planning.

2. The UTSA Standard for Security Monitoring applies to all individuals who are responsible for the installation of new information resources, the operations of existing information resources and individuals charged with information resource security.

  1. UTSA will use automated tools to provide real-time notification of detected wrongdoing and vulnerability exploitation. Where possible, a security baseline will be developed and the tools will report exceptions. These tools will be deployed by the Office of Information Technology (OIT) to monitor UTSA computers and devices for:
    1. Internet traffic
    2. Electronic mail traffic
    3. LAN traffic, protocols and device inventory
    4. Operating system security parameters
    5. Rogue access points/devices
    6. Installed software on servers and desktops
  2. The following files will be checked for signs of illicit activity and vulnerability to exploitation at a frequency determined by risk:
    1. Automated intrusion detection system logs
    2. Firewall logs
    3. User account logs
    4. Network scanning logs
    5. System error logs
    6. Configuration files
    7. Application logs
    8. Data backup and recovery logs
    9. OITConnect trouble tickets
    10. Telephone activity – Call Detail Reports
    11. Network printer and fax logs
  3. Assigned individuals will monitor the following (at least annually):
    1. Password strength
    2. Unauthorized network devices
    3. Unauthorized personal Web servers
    4. Unsecured sharing of devices
    5. Unauthorized modem use
    6. Operating System and software licenses
  4. For audit purposes, logs will be archived for a minimum of 90 days.
  5. Any security issues discovered will be reported to the Information Security Officer (ISO) for follow-up investigation.

     

    ______________________________________________________________________________

    Effective Date: January 1, 2013

    Last Revised: April 10, 2013

    Reviewed: June 29, 2017

     

 

<< Back