SM-21—Security Monitoring Alert Criteria: Failed Logins

>Control Description

Organization defines security monitoring alert criteria for failed login attempts on Organization's network.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Security Monitoring Standard includes requirements for security monitoring alert criteria for failed login attempts on Organization's network. 2. Ensure a sample of security monitoring rules, to validate that the rules are defined to look for and alert applicable personnel on potential failed login attempts. 3. Ensure that alerts being generated are sent to the SOC team to support remediation.

>Testing Procedure

1. Inspect Organization's Security Monitoring Standard to determine whether requirements for security monitoring alert criteria for failed login attempts on Organization's network. 2. Inspect a sample of security monitoring rules, to validate that the rules are defined to look for and alert applicable personnel on potential failed login attempts. 3. Validate that alerts being generated are sent to the SOC team to support remediation.