Control 3.14.6

★What This Means in Plain English

Both incoming and outgoing network traffic must be monitored for signs of attacks. This includes detecting malware callbacks, data exfiltration, command-and-control traffic, and other indicators of compromise.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Arctic Wolf SIEM monitoring all inbound and outbound network traffic for threat indicators
• FortiGate IPS/IDS analyzing traffic in real-time for attack signatures and anomalies
• CrowdStrike Falcon monitoring endpoint communications for indicators of compromise
• DNS monitoring detecting malicious domain lookups and command-and-control communications
• DLP policies monitoring outbound traffic for unauthorized CUI exfiltration
• 24/7 SOC monitoring through Arctic Wolf Managed Detection and Response

🔎Assessment Guidance

Assessors will review network monitoring capabilities and coverage, verify that both inbound and outbound traffic is monitored, test detection of known attack patterns, check that monitoring alerts are investigated, and confirm 24/7 monitoring is in place.

⚠Common Implementation Gaps

• Only inbound traffic monitored, outbound not analyzed
• IDS/IPS deployed but alerts not reviewed
• No monitoring of DNS traffic for malicious domains
• No DLP monitoring of outbound data flows
• Monitoring only during business hours, not 24/7

⇄Cross-Framework Mapping