[Autogenerated] principle requirements 1 to 9 in P.
C.
I.
D.
S.
S generally consists of protective for preventative controls
Requirement 10 and 11 also include detective responsive and
assurance controls and there are a couple of major changes in these
areas Moving to principal requirement 10 and that's the one that
deals generally with logging.
There's a subtle change here that really won't affect what you do.
But the requirement now acknowledges that logs are gathered for two purposes,
firstly for real time detection and analysis of attacks and then secondly,
to be able to support forensic investigation after an incident.
But the big change in requirement 10 supports the first use case of
logging that of detecting an attack because it now requires that log
files are reviewed by automated techniques.
So essentially requiring a seam, You know,
practically I guess this won't be a major challenge
for most organizations because well,
manual log reviews have not been feasible for what?
10 years.
So most people have already moved to an automated system that
correlate and analyze logs looking for attacker behavior So
although it looks like a new change,
it's probably something that everyone is already doing.
There is however,
a massive change to internal vulnerability scanning and that
is that all internal vulnerability scans now have to be
authenticated and by authenticated, the standard means given credentials.
So this means the scanner won't just scan the external interfaces as an
unauthenticated user but will actually perform its scanning after.
It's provided credentials to authenticate the scanner
against the system that's being scanned.
The reason for this is pretty obvious when you think about it,
because typically attacks now involve a remote attacker
who is able to get user credentials.
And then we'll try to use vulnerabilities in the system to escalate their
privileges to am to an administration level type of account.
So our vulnerability scanner now needs to emulate an attacker with some
credentials who wants to be able to escalate their privilege.
And so see vulnerabilities from a credentialed
user's perspective in my experience,
moving from unauthenticated scans to authenticated scans
will discover many more vulnerabilities than an organization
has the capacity to deal with.
And so, even though this is not a requirement until 2025,
I'd urge you to start planning your transition to authenticate
his scanning as soon as possible because in a big enterprise it
actually might take you three years