ISO 27001 A.8.16: Monitoring activities

Deploy monitoring tools that match your environment. The key capabilities are: SIEM for log correlation and alerting, network detection and response (NDR) for traffic analysis, endpoint detection and response (EDR) for endpoint behaviour, user and entity behaviour analytics (UEBA) for anomaly detection, cloud security monitoring for cloud workloads, and application performance monitoring (APM) for application behaviour.

Build detection use cases around your risk assessment and threat model. Focus on what actually matters: brute force attacks, privilege escalation attempts, lateral movement, data exfiltration indicators, command and control communications, unauthorised access to sensitive data, anomalous user behaviour, and unusual cloud resource provisioning.

Create detection rules for each use case. Mix signature-based rules for known threats, threshold-based rules for volumetric indicators, and anomaly-based rules for behavioural deviations. Tune aggressively to reduce false positives without sacrificing detection. Integrate threat intelligence feeds to keep your rules current with evolving attack patterns.

Set up monitoring operations. Define who watches the alerts and when. Critical environments need 24/7 coverage. Create triage procedures with clear response actions for different alert types. Build escalation paths for alerts that need senior analysis or full incident response. Track alert volumes, false positive rates, and mean time to investigate.

Measure and improve continuously. Track detection coverage (map against MITRE ATT&CK to see your blind spots), mean time to detect (MTTD), mean time to respond (MTTR), and false positive rates. Use red team exercises and penetration tests to validate your detection capabilities. Review and tune detection rules regularly.