View source for 3.2.1.5: Intrusion Detection or Prevention System

<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''1.	Risk: Unauthorized access attempts go unnoticed.'''<br>
:a.	SOX.2.1.5.1: IDS-IPS authentication attempts are limited to attempts specified by the Corporate IT standard.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''2.	Risk: Unauthorized execution of privileged system commands may disrupt business processes, and corrupt critical business data stores.'''<br>
:a.	SOX.2.1.5.2: IDS-IPS administrator level access is password restricted and is limited to the designated IDS-IPS administrators only.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''3.	Risk: Unscheduled access by support vendors may result in business process interruptions or loss of production data.'''<br>
:a.	SOX.2.1.5.3: IDS-IPS access by support vendors is granted through a service request.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''4.	Risk: Unauthorized users might exploit privileged access to critical business processes and data.'''<br>
:a.	SOX.2.1.5.4: New IDS-IPS user accounts are pre-expired.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''5.	Risk: Unauthorized users might exploit unauthorized access to critical business processes and data.'''<br>
:a.	SOX.2.1.5.5: The IDS-IPS operating application has a session "Time-Out" function enabled.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''6.	Risk: Unnecessary disruptions to business processes or data corruption may occur.'''<br>
:a.	SOX.2.1.5.6: IDS-IPS rule changes are scheduled during maintenance windows.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''7.	Risk: Unidentifiable users may compromise critical business processes and data.'''<br>
:a.	SOX.2.1.5.7: The IDS-IPS system will not allow identical administrator IDs.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''8.	Risk: Insufficient security standards may allow unauthorized access to production systems and business data stores.'''<br>
:a.	SOX.2.1.5.8: IDS-IPS passwords are required for each administrator ID. Password configuration is based on Corporate IT standards.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''9.	Risk: Inappropriate administrative actions are executed without accountability measures.'''<br>
:a.	SOX.2.1.5.9: The IDS-IPS operating application has the functionality to monitor administrator access related events.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''10.	Risk: Reactive security monitoring results in data compromise and financial loss or liability.'''<br>
:a.	SOX.2.1.5.10: IDS-IPS administration team is notified when security violations occur.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''11.	Risk: Forensic evidence is not available to resolve malfunctions, compromises or other security compromising incidents.'''<br>
:a.	SOX.2.1.5.11: The IDS-IPS administration team reviews security logs looking for security violations.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''12.	Risk: Unauthorized access is granted to business systems or data stores.'''<br>
:a.	SOX.2.1.5.12: IDS-IPS access is granted through a service request.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''13.	Risk: Unauthorized access may occur resulting in business data compromise or destruction.'''<br>
:a.	SOX.2.1.5.13: Terminations are sent through the HR process. An Email is sent from HR with all terminations to the IDS-IPS system administrators.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''14.	Risk: Insufficient security standards may allow unauthorized access to production systems and business data stores.'''<br>
:a.	SOX.2.1.5.14: IDS-IPS password expiration is set to Corporate IT standards.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''15.	Risk: Security violations or data corruption may occur with no forensic evidence available to resolve the situation.'''<br>
:a.	SOX.2.1.5.15: IDS-IPS rules and logging is applied to everyone equally including system administrators.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''16.	Risk: Unauthorized access (i.e. terminated employees) may occur.'''<br>
:a.	SOX.2.1.5.16: A semi-annual revalidation of IDS-IPS administrator accounts are performed by security administration.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''17.	Risk: Unauthorized execution of privileged system commands may disrupt business processes, and corrupt critical business data stores.'''<br>
:a.	SOX.2.1.5.17: Privileged level access is password restricted. This password is known only by the system administrators.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''18.	Risk: Unauthorized routing parameters or virtual LAN connections established may disrupt business capabilities or bypass security controls causing business data loss and confidentiality loss.'''<br>
:a.	SOX.2.1.5.18: Routing protocols are approved by management.<br>
</blockquote>


<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
'''19.	Risk: Confidentiality and or privacy may be compromised.'''<br>
:a.	SOX.2.1.5.19: Unauthorized network tapping does not occur without the approval of management.<br>
</blockquote>