Security testing, surveillance and monitoring

Proactively testing and monitoring the IT security implementation is considered very important by COBIT. A logging and monitoring function will enable early prevention or detection, and subsequent timely reporting, of unusual or abnormal activities that may need to be addressed. Any solution should update, monitor and report of system events and activity, enabling enterprises to gain a holistic view of their security and network activity trends. The consistent presentation of data across the enterprise enables more effective data collection, analysis and response.

Security incident definition

COBIT advises that companies should clearly define and communicate the characteristics of potential security incidents so that they can be properly classified and treated by the incident and problem management process. It’s important to choose a solution that provides comprehensive support for the identification, handling and reporting of security incidents. It is possible to analyse log data in near real-time to identify significant threats across the network, as well as preset software to generate alerts to take appropriate action to mitigate the detected threat.


Malicious software prevention, detection and correction

COBIT argues that putting preventive, detection, and corrective measures in place (especially up-to-date security patches and virus control) across the organisation, protects information systems and technology from malware. Finding a solution that includes integrated, high-performance antivirus technology to detect and eliminate malware from endpoint PCs will help to combat this. Virus detection is based on a combination of signatures, behaviour blockers and heuristic analysis that together enable your network environment to attain one of the industry’s highest detection rates.

Network security

Security techniques and related management procedures are suggested, e.g. firewalls, security appliances, network segmentation or intrusion detection, to authorise access and control information flows from and to networks. Companies should attempt to find a solution from which administrators can centrally manage, approve, view network topology, and verify all external network connections and changes to the firewall configuration.