STANDARD FOR INTRUSION DETECTION
The University of Texas at San Antonio
Office of Information Technology
Office of Information Security (OIS) Standards
OIS 19 – Standard for Intrusion Detection
I. STANDARD STATEMENT
The UTSA Intrusion Detection Standard applies to all individuals who are responsible for the installation of new information resources, the operations of existing information resources and individuals charged with information resources security.
This standard supports HOP Policy 8-12 Information Resources Use and Security Policy
This standard applies to all UTSA faculty, staff, and students.
If you have any questions about OIS 19 – Standard for Intrusion Detection contact the following office:
The Office of Information Security
- Intrusion detection is the use of tools and policies to monitor system performance in order to prevent unauthorized use of UTSA information resources. Intrusion detection provides two important functions in protecting information resources:
- Trigger: a mechanism that determines when to activate planned responses to an intrusion incident.
- Feedback: information about the effectiveness of other components of the security system. If a robust and effective intrusion detection system is in place, the lack of detected intrusions is an indication that other defenses are working.
- Users shall be trained to report any anomalies in system performance and/or signs of suspected wrongdoing to the Information Security Officer (ISO) or the Computer Incident Response Team at 210-458-5555, OITConnect (Help Desk) at 210-458-5555 or to the UTSA Compliance Hotline, 210 877-1888.
- All suspected and/or confirmed instances of successful and/or attempted intrusions must be reported immediately in accordance with the Information Security Incident Response.
- Operating system, user accounting and application software audit logging processes must be enabled on all host and server systems.
- Alarm and alert functions of firewalls and other network perimeter access control systems must be enabled.
- Audit logging of firewalls and other network perimeter access control systems must be enabled.
- Audit logs from the perimeter access control systems must be monitored/reviewed daily by the system administrator.
- System integrity checks of the firewalls and other network perimeter access control systems must be performed on a daily basis.
- Audit logs for servers and hosts on the internal, protected network must be reviewed on a weekly basis. The system administrator must furnish any audit logs as requested by the ISO.
- Network/host-based intrusion tools will be checked on a daily basis.
- All trouble reports received by system administration personnel should be reviewed for signs that might indicate intrusive activity.
Effective Date: October 15, 2011 Last Revised: March 2016