C5ISR CSSP SaaS Monitoring Requirements 2024.pdf

Origination Date: February 2024 Next Review Date: February 2025 Last Review Date: N/A

CYBERSECURITY SERVICE PROVIDER (CSSP)

CSSP SaaS Subscriber Monitoring Requirements

Page | 1

Table of Contents

INTRODUCTION

CAPTURE REQUIREMENTS

AUDITABLE EVENT DEFINITIONS REQUIREMENTS

DESCRIPTIONS

Event Categories

User and Administrator Access

Administrator Behavior

User Behavior

Third-Party API Access

APPENDIX 1: MONITORING CHECKLIST

Page | 2

INTRODUCTION

For Software-as-a-Service (SaaS) environments operating within the DoD, there are certain requirements that must be met, and artifacts provided to the C5SIR CSSP team before services may be considered. The following document identifies these requirements along with the core security related application events that must be continuously monitored.

Before official alignment with C5ISR can begin, reach out to your vendor Technical Account Manager (TAM) and work with them to provide the necessary artifacts listed throughout this document. This document also contains a monitoring checklist (Appendix 1) that must be filled out and returned to the C5ISR Mission Support/Cloud Support team for review. Below is a list of what will need to be submitted:

• API Documentation

• Audit Log Data and Event Catalog

• Data Dictionary

• 2x Sample Log Files

• Completed Monitoring Checklist (Appendix 1)

CSSP services will be determined through C5ISR government approval.

CAPTURE REQUIREMENTS

The C5ISR CSSP requires access to the log events generated from the SaaS application, which can be done via application programming interface (API) call or by using Cloud Service Provider (CSP) native storage solutions such as AWS S3 or Azure Log Analytic Workspaces. If an API is not available for the application or access to CSP native storage, an API solution will be required to capture logs for CSSP alignment. Determining capture requirements helps C5ISR to understand the LOE.

Page | 3

AUDITABLE EVENT DEFINITIONS REQUIREMENTS

API Documentation (Unless CSP native storage is utilized):

C5ISR requires subscribers to provide detailed documentation of the interfaces available for interaction with their audit logging systems. This documentation must include descriptions of:

• API endpoints,

• required parameters,

• authentication mechanisms, and

• example calls and responses, This ensures that C5ISR and other stakeholders have the necessary information to programmatically access audit logs and integrate them with monitoring systems.

Audit Log Data and Event Catalog:

Subscribers must create a detailed reference guide based on the event categorization framework outlined in the table 'Log Event Category' of the monitoring checklist. This foundational approach ensures a comprehensive and well-structured overview of audit log services, covering the range of events monitored. It aims to enhance stakeholders' understanding of the system's monitoring capabilities.

Data Dictionary:

Subscribers must develop and provide a detailed dictionary that defines the structure and schema of their audit logs. This dictionary should enumerate each field's name, data type, and description, etc. within a log entry. Such a data dictionary is essential for C5ISR to analyze the audit logs effectively, ensuring that the logs can be parsed and interpreted for security insights and compliance reporting.

Table 1: Data dictionary for User Activity Field Name Data

Type Description

User Login Failed

String Describes the action that occurred, such as "User Login Failed" or "Policy Published" date String The date and time when the action occurred, formatted as

“MM DD YYYY HH:MM:SS UTC”

user String The email of the user who performed the action, or the name of the program that made the change

Page | 4

Sample Log Files:

Subscribers are also required to provide sample log entries for the required auditable events within the monitoring checklist (Appendix 1), showcasing the format of the logs and the type of information captured. These samples will help C5ISR familiarize themselves with the log data, facilitating the development of custom analytics and monitoring solutions tailored to specific security needs.

When providing the sample log files the following requirements must be met:

• Raw log sample containing 24 hrs. of log events.

• Log samples showing examples of each applicable audit log event listed in the monitoring checklist (Appendix 1).

Page | 5

DESCRIPTIONS

Event Categories

User and Administrator Access

User and administrator access is necessary to detect the following types of attack:

• Brute Force Attack

• Phishing

• Credential Stuffing

• Password Spraying

Administrator Behavior

Administrator behavior is necessary to detect the following types of attacks:

• Insider Threat

• Unauthorized Access

• Data Exfiltration

User Behavior

User behavior is necessary to detect the following types of attacks:

• Social Engineering

• Insider Threat

• Unauthorized Access

• Data Leakage

Third-Party API Access

Application program interfaces (APIs) enable third-party software to interact with SaaS applications but are often abused in the following ways:

• API Exploitation

• Main-in-the-Middle Attacks (MitM)

• Injection Attacks

• Data Breach via Third Party

Page | 6

APPENDIX 1: MONITORING CHECKLIST

FEDRAMP Approved? Yes ☐ No ☐

API or CSP Storage Available? Yes ☐ No ☐

Native JSON conversion available? Yes ☐ No ☐

Raw Format Type XML ☐ CSV ☐ JSON☐ Syslog☐ Other☐

(If other, please specify) __________________________________

Log Event Category Function (Please check the box if log event type is available) User and Administrator Access

☐ Login successes and failures ☐ Logins by time and location ☐ Logins by device type and attributes ☐ Repeated login failures followed by login success ☐ SSO activity, AD activity

Administrator Behavior ☐ Repeated user and/or data deletions ☐ Addition of privileged users/User account changes ☐ Changes to network permissions ☐ Changes to audit logging configuration ☐ Changes to policy controls

☐ Configuration changes to the system User Behavior

☐ User file activity (download, delete, copy, move, import, export) ☐ Sharing files with external collaborators ☐ Creating open/shared links (public access) ☐ Network traffic activity ☐ Escalation of privileges

Security Alerts ☐ If your SaaS application includes any vendor-specific security logs Third-party API Access

☐ Changes to API access permissions ☐ OAuth certificate activity ☐ OAuth token activity

APPENDIX 1: MONITORING CHECKLIST