Security That Never Sleeps
Federal agencies have to shift from annual IT security assessments to continuous monitoring of their risks. Here's a framework for getting there.
Quarterly vs. real time. Static vs. dynamic. Manual vs. automated. All these considerations are relevant when evaluating approaches to managing cyberrisk in an evolving environment of threats and vulnerabilities.
Toward that end, the federal government has modified its guidance in support of these critical areas. One big change under way is the shift from annual security threat assessments to the use of real-time metrics, analysis, and evaluation, referred to as "continuous monitoring."
Federal CIO Vivek Kundra has called attention to the need for federal agencies to implement continuous monitoring, and has instructed agencies to include funding for the tools required to enable continuous monitoring in their budget submissions for fiscal 2012.
Agencies across government are at different stages of implementation, but most are still in the early stages. Many need to invest in new IT capabilities to get from a static security posture to this new continuous approach. As evidence of that, In-Q-Tel, the technology investment arm of the CIA, invested in RedSeal Systems, a developer of automation software for continuous monitoring. RedSeal's software monitors firewalls, routers, and load balancers, watching for unauthorized access and identifying risks.
In February 2010, the National Institute of Standards and Technology (NIST) issued its "Guide for Applying the Risk Management Framework to Federal Information Systems." NIST developed this publication in conjunction with the Department of Defense, Office of Director of National Intelligence, and Committee on National Security Systems. The report explains new federal guidelines and standards, tasks related to continuous monitoring, and key considerations for selecting the supporting tools for compliance.
The objective of this collaborative initiative is to provide a common framework that can be used across federal government to transform from static, discrete, point-in-time certification and accreditation to an approach based on a six-step risk management framework. One objective is to enable more dynamic, active management of an IT environment in which the threats and vulnerabilities are changing at an increasing pace.
The six-step risk management framework goes like this:
About the Author
You May Also Like
Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024