Traffic Analysis
What is Traffic Analysis?
The examination of network communication patterns, volumes, and metadata to identify anomalies, security threats, or intelligence without necessarily reading content.
Terms that appear alongside traffic analysis
Each of these is named in at least one of the same controls as traffic analysis. The number is how many controls name both.
- network traffic analysis 3 shared controls
- network monitoring 3 shared controls
- integrity 2 shared controls
- authorization 2 shared controls
- authentication 2 shared controls
- security operations 2 shared controls
- log retention 2 shared controls
- security operations centre soc 2 shared controls
Frameworks that govern traffic analysis
What the standards actually require on traffic analysis
Requirements naming traffic analysis across 6 standards, quoted from the control text.
Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
NIST800-SI-4(25) · SI-4(25) System Monitoring | Optimize Network Traffic Analysis →Agencies should perform a traffic analysis to confirm their network and architecture can carry all VoIP, media and UC traffic; that analysis should also identify any high availability requirements.
new-zealand-information-security-manual-nzism::19.5.26.C.07 · 19.5.26.C.07 Traffic analysis for VoIP and UC capacity →X.805 Clause 8 defines 5 Threat Categories that the X.805 Security Architecture is designed to mitigate + provides a Threat-Dimension Countermeasure Matrix linking each threat to specific Dimensions.
X805-Threats-Destruction-Corruption-Removal-Disclosure-Interruption-72Cell-Matrix-Application · ITU-T X.805 5 Threat Categories - Destruction + Corruption + Removal + Disclosure + Interruption + Threat-Dimension Countermeasure Matrix + 72-Cell Matrix Application + STRIDE + MITRE ATT and CK + Network Modular Risk Assessment →NSS-17 + NSS-42-G require continuous monitoring + detection + incident response + recovery aligned with CSL. Logging: all CBS log security-relevant events (authentication + authorization + privileged action + configuration change + network connection + system...
IAEA-NSS17-Detect-Monitor-Logging-IR-Recovery-Exercises · IAEA NSS-17 - Detection + Monitoring + Logging + Incident Response + Recovery + Computer Security Exercises →The authentication mechanism for IEC 60870-5 and its derivatives (DNP3 among them) addresses only spoofing, tampering, replay and, with the 2023 edition's encryption option, eavesdropping, as defined in part 2;
iec-62351-power-systems-communication-security::5:5.2 · Part 5, 5.2: threats addressed (spoofing, tampering, replay, eavesdropping) →Apply D3FEND DETECT tactic to identify malicious activity occurring within an environment through observation of digital artifacts. D3-FA File Analysis (D3-FC File Carving + D3-FCR File Content Rules + D3-FH File Hashing + D3-DA Dynamic Analysis + D3-SAA Stati...
MITRE-D3FEND-Detect-Tactic-File-Process-Network-Identifier-Message-Platform-Analysis-SIEM-EDR · MITRE D3FEND Detect Tactic + File + Process + Network + Identifier + Message + Platform Analysis + SIEM + EDR →Questions people ask about traffic analysis
What is Traffic Analysis?
Why is Traffic Analysis important for compliance?
Which compliance frameworks address Traffic Analysis?
Where can I learn more about Traffic Analysis?
See how Traffic Analysis applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.