Monetary Authority of Singapore Technology Risk Management Guidelines 12.2: 12.2 Cyber Event Monitoring and Detection

The FI should establish a security operations centre or acquire managed security services, with defined processes and roles, for continuous monitoring of cyber events (exploits, intrusions, privilege escalation, unauthorised access, exfiltration, command-and-control connections); collect, process, review, retain and protect security, application, database, network and operating system logs; baseline each system's routine activity and analyse against it, reviewing the profiles; consider user behavioural analytics; correlate events across logs to find suspicious patterns; and escalate suspicious activity or behaviour promptly to the relevant stakeholders.