UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities 7.5-HUNT: Proactive abnormality and attack discovery

The dutyholder detects malicious activity that evades signature-based tools, or where those tools cannot be deployed, by understanding normal system behaviour and defining abnormalities drawn from past attacks and threat intelligence, kept current as systems and threats change. It routinely searches for such abnormalities, generates alerts from the results, has justified confidence in the searches, and routinely tests monitoring against new and existing threats.