SM-20—Security Monitoring Alert Criteria: Wireless Access Point

>Control Description

Organization defines security monitoring alert criteria for attack attempts against wireless access points.

Theme

Process

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that Organization's Security Monitoring Standard includes requirements for security monitoring alert criteria for attack attempts against wireless access points. 2. Ensure that the security monitoring rules are defined, enabled and alert applicable personnel on potential failed login attempts. 3. Ensure that alerts are being generated and sent to the SOC team to support remediation.

>Testing Procedure

1. Inspect Organization's Security Monitoring Standard to determine whether requirements for security monitoring alert criteria for attack attempts against wireless access points are defined. 2. Obtain list of security monitoring rules that are defined.