[Autogenerated] I'm going to skip over, require 11.3,
which is concerned with ___________ testing because it's such a big requirement,
and it's with one of the most important security controls in the deeds.
It justifies its own module,
so we're going to move on to the other two items left in required 11.
These last to a detective controls the first,
of which 11.4 is a requirement to have intruded detection on
perhaps intruder prevention techniques.
Now it's important to note this, Jenner says, techniques.
So it's neutral when it comes to how this is implemented in your organization,
although is usually going to be on a perimeter device like a
firewall on the standard sort of requires or implies that because
it talks about having it at the perimeter,
although you know it will be equally valid for you to
have this on a network span port on,
analyze traffic for a whole network segment and look
for intruders on that segment on,
then feed that back into a primitive control device
from something like the I PS detector.
Another a couple more things to think about because as
well as at the perimeter of the 500.
The Standard also talks about monitoring traffic at critical points.
So it's a question of thinking where the best points would be on the
network to detect attacker traffic that pose the highest risk to
cardholder data in our sample network.
The main points I'd be looking for intruder detection capability
would be the main perimeter of the e commerce Web servers then that
firewall that provides the connection into head office from the
retail stores that also be quite pleased to have some ideas
functionality on the retail stores, firewalls.
But the key place I would want IDE s is that firewall that
connected the Dems to the payment systems on also provides the
connection to the management network.
Because that's the most likely route into my 500 for an attacker.
The testing procedures pretty comprehensive for this requirement.
The QoS is first going to look at the network diagram and cardholder
data flows to make sure that they understand what is the perimeter on
where the critical places in the CDR,
where intruder detection or prevention will be necessary Next,
they're going to look at the configuration of IDE s or IOPS systems to
make sure they're set to produce alerts on the QoS.
I will also want to interview the people who should
be responding to those alerts.
Finally,
the validate that the system's the IDE is or IOPS systems
are getting regular vendor updates such as new signatures
or new behavioral algorithms, or even just system upgrades.