Deploy a Network Intrusion Detection Solution
Description
Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.
Implementation Checklist
Tool Recommendations
AI-driven network detection and response with self-learning threat analysis and autonomous response
Darktrace · Enterprise subscription
AI-driven threat detection and response for network, cloud, and identity with attack signal intelligence
Vectra AI · Enterprise subscription
Network detection and response platform with real-time traffic analysis, encrypted traffic inspection, and cloud visibility
ExtraHop · Per-device/bandwidth subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Command-and-Control Traffic Over Encrypted Channels
ConfidentialityAn attacker establishes encrypted C2 communications over HTTPS or DNS tunneling that bypass perimeter firewalls, remaining undetected because no network intrusion detection system is inspecting traffic patterns.
Network-Based Exploitation Traversing Unmonitored Segments
IntegrityAn attacker exploits a vulnerability in an internal service, and the exploit traffic crosses network segments without triggering any alert because no NIDS is deployed to analyze east-west traffic.
Large-Scale Data Exfiltration via Network Protocols
ConfidentialitySensitive data is exfiltrated in bulk over standard protocols like HTTP or FTP to an external staging server, and the anomalous data volume goes unnoticed without network-level intrusion detection.
Vulnerabilities (When Safeguard Absent)
No Network Traffic Anomaly Detection
Without a NIDS, malicious network traffic patterns such as port scans, exploit payloads, and beaconing behavior are not identified, leaving the network blind to active intrusions.
Unmonitored East-West Network Traffic
Internal network segments lack inspection capabilities, allowing attackers who have gained initial access to freely probe and exploit other systems within the environment.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |