Download presentation
Presentation is loading. Please wait.
1
Information System Continuous Monitoring (ISCM)
FITSP-M Module 7 Information System Continuous Monitoring (ISCM) FITSP-M Module 6 - Continuous Monitoring
2
Leadership “Continuous monitoring is the backbone of true security.”
-Vivek Kundra Federal CIO FITSP-M Module 6 - Continuous Monitoring
3
FITSP-M Exam Module Objectives
Audit and Accountability Manage controls in a system that facilitate the creation, protection, and retention of information system audit records to the extent needed to enable the monitoring, analysis, and investigation of the system Security Assessments and Authorization Supervise processes that facilitate the monitoring of information system security controls on an ongoing basis to ensure the continued effectiveness of the controls System and Communication Protection Oversee processes that monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems System and Information Integrity Direct mechanisms that monitor information system security alerts and advisories that take appropriate actions in response FITSP-M Module 6 - Continuous Monitoring
4
Continuous Monitoring Overview
Section A: Continuous Monitoring Trends RMF Step 6 – Monitor Security Controls Redefining Risk Management DHS CM Reporting Metrics Cyberscope Section B: CM Guidelines, SP ISCM Fundamentals Organization-wide Approach Elements of Organization-wide CM Program Continuous Monitoring Process Section C: Automation Automation Domains SCAP & OCIL Continuous Asset Evaluation, Situational Awareness and Risk Scoring (CEASARS) Section D: CM Implementation FITSP-M Module 6 - Continuous Monitoring
5
Continuous Monitoring Trends
Section A Continuous Monitoring Trends FITSP-M Module 6 - Continuous Monitoring
6
RMF Step 6 – Monitor Security Controls
Information System And Environment Changes Ongoing Security Control Assessments Ongoing Remediation Actions Key Updates Security Status Reporting Ongoing Risk Determination And Acceptance Information System Removal And Decommissioning FITSP-M Module 6 - Continuous Monitoring
7
Risk Management Redefined OODA Loop
FITSP-M Module 6 - Continuous Monitoring
8
DHS Cyberscope Monthly Data Feeds to DHS
Inventory Systems and Services Hardware Software External Connections Security Training Identity Management and Access Government-wide benchmarking on security posture Agency-specific interviews FITSP-M Module 6 - Continuous Monitoring
9
DHS FY12 Reporting Metrics 1. Continuous Monitoring
FITSP-M Module 6 - Continuous Monitoring
10
Knowledge Check Name the components of the new risk management model.
Name the reporting tool, which automates Agency FISMA reporting directly to the DHS. What 3 Continuous Monitoring metrics will DHS expect agencies to report for FY2012? FITSP-M Module 6 - Continuous Monitoring
11
The CM Guidelines SP 800-137 Section B
FITSP-M Module 6 - Continuous Monitoring
12
NIST SP Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations Information security continuous monitoring (ISCM) is defined as: Maintaining Ongoing Awareness of Information Security, Vulnerabilities, and Threats Support Organizational Risk Management Decisions Begins With Leadership Defining A Comprehensive ISCM Strategy Encompassing technology processes procedures operating environments people FITSP-M Module 6 - Continuous Monitoring
13
ISCM Fundamentals Define the ISCM strategy Establish an ISCM program
Implement the ISCM program Analyze and Report findings Respond to findings Review and Update ISCM strategy and program FITSP-M Module 6 - Continuous Monitoring
14
Mission/Business Processes
ISCM Criteria Tier 1 Tier 2 Tier 3 Organization Mission/Business Processes Information Systems Automated/Manual Data Feeds (Security-related Information, POAMs, SARs) Data Tools Risk Management Strategy: How the organization plans to assess, respond to, and monitor risk Oversight required to ensure effectiveness of RM strategy Program Management Defined by how business processes are prioritized Types of information needed to successfully execute those business processes Monitoring System Level Controls and Security Status Reporting Security Alerts Security Incidents Identified Threat Activities FITSP-M Module 6 - Continuous Monitoring
15
The CM Process Define an ISCM Strategy Establish an ISCM Program
Implement an ISCM Program Determining Appropriate Response Mitigating Risk Review and Update the Monitoring Program FITSP-M Module 6 - Continuous Monitoring
16
Interrelationships to the CM Process
Risk Tolerance Enterprise Architecture Security Architecture Security Configurations Plans for Changes to Enterprise Architecture Available Threat Information FITSP-M Module 6 - Continuous Monitoring
17
Section C Automation FITSP-M Module 6 - Continuous Monitoring
18
Role of Automation in ISCM
Consideration is given to ISCM tools that: Pull information from a variety of sources (Specifications, Mechanisms, Activities, Individuals) Use open specifications such as SCAP Offer interoperability with other products (help desk, inventory management, configuration management, and incident response solutions) Support compliance with applicable federal laws, regulations, standards, and guidelines Provide reporting with the ability to tailor output Allow for data consolidation into Security Information and Event Management (SIEM) tools and dashboard products. SP FITSP-M Module 6 - Continuous Monitoring
19
Security Automation Domains
Vulnerability & Patch Management Event & Incident Management Malware Detection Asset Management Configuration Management Network Management License Management Information Management Software Assurance SP FITSP-M Module 6 - Continuous Monitoring
20
Tools and Technologies
Automation Domain Tools and Technologies NIST Guidelines 1 - Vulnerability Management Vulnerability scanners NIST SP Creating a Patch and Vulnerability Management Program 2 - Patch Management Patch management tools 3 - Event Management Intrusion detection/ prevention systems and logging mechanisms NIST SP , Computer Security Log Management 4 - Incident Management NIST SP , Guide IDPS 5 - Malware Detection Antivirus/ Malware detection mechanisms NIST SP , Malware Incident Prevention and Handling 6 - Configuration Management SCAP, SEIM, Dashboards NIST SP r2 The Technical Specification for SCAP Version 1.2 SP FITSP-M Module 6 - Continuous Monitoring
21
Tools and Technologies
Automation Domain Tools and Technologies 7 - Asset Management System configuration, network management, and license management tools 8 - Network Management Host discovery, inventory, change control, performance monitoring, and other network device management capabilities 9 - License Management License management tools 10 - Information Management Data Loss Prevention (DLP) Tools: network analysis software, application firewalls, and intrusion detection and prevention systems SP FITSP-M Module 6 - Continuous Monitoring
22
Software Assurance Technologies Security Automation Domain #11
Software Assurance Automation Protocol (SwAAP -measure and enumerate software weaknesses): CWE Common Weakness Enumeration Dictionary of weaknesses that can lead to exploitable vulnerabilities CWSS Common Weakness Scoring System Assigning risk scores to weaknesses CAPEC Common Attack Pattern Enumeration & Classification Catalog of attack patterns MAEC Malware Attribute Enumeration & Characterization Standardized language about malware, based on attributes such as behaviors and attack patterns SP FITSP-M Module 6 - Continuous Monitoring
23
Knowledge Check What is the document that provides guidelines for developing a CM program? What is the first step in the CM Process? Name an automation specification, which is a dictionary of weaknesses that can lead to exploitable vulnerabilities? What is defined as an information security area that includes a grouping of tools, technologies, and data? Data within the domains is captured, correlated, analyzed, and reported to present the security status of the organization that is represented by the domains monitored. FITSP-M Module 6 - Continuous Monitoring
24
Automation and Reference Data Sources
Security Content Automation Protocol (SCAP) What Can Be Automated With SCAP How to Implement SCAP Partially Automated Controls Reference Data Sources National Vulnerability Database (NVD) Security Configuration Checklists FITSP-M Module 6 - Continuous Monitoring
25
NVD SCAP Program NVD Primary Resources Scan Data Feed
Vulnerability Search Engine National Checklist Program SCAP Compatible Tools SCAP Data Feeds (CVE, CCE, CPE, CVSS, XCCDF, OVAL) Product Dictionary (CPE) Impact Metrics (CVSS) Common Weakness Enumeration (CWE) SCAP Program Scan NVD Data Feed FITSP-M Module 6 - Continuous Monitoring
26
SCAP: What Can Be Automated?
Vulnerability and Patch Scanners Authenticated Unauthenticated Baseline Configuration Scanners Federal Desktop Core Configuration (FDCC) United States Government Configuration Baseline (USGCB) FITSP-M Module 6 - Continuous Monitoring
27
How to Implement SCAP with SCAP-validated Tools
FITSP-M Module 6 - Continuous Monitoring
28
… and SCAP-expressed Checklists
FITSP-M Module 6 - Continuous Monitoring
29
Partially Automated Controls
Open Checklist Interactive Language (OCIL) Define Questions (Boolean, Choice, Numeric, Or String) Define Possible Answers to a Question from Which User Can Choose Define Actions to be Taken Resulting from a User's Answer Enumerate Result Set Used in Conjunction with eXtensible Configuration Checklist Description Format (XCCDF) FITSP-M Module 6 - Continuous Monitoring
30
Technologies for Aggregation and Analysis
Management Dashboards Meaningful And Easily Understandable Format Provide Information Appropriate to Roles And Responsibilities Security Information and Event Management (SIEM), analysis of: Vulnerability Scanning Information, Performance Data, Network Monitoring, System Audit Record (Log) Information Audit Record Correlation And Analysis FITSP-M Module 6 - Continuous Monitoring
31
CAESARS Framework FITSP-M Module 6 - Continuous Monitoring
32
FITSP-M Module 6 - Continuous Monitoring
33
IR 7756 FITSP-M Module 6 - Continuous Monitoring
34
CM Documents FITSP-M Module 6 - Continuous Monitoring
35
Knowledge Check Name the set of specifications used to standardize the communication of software flaws and security configurations. What is the name of the U.S. government repository of standards-based vulnerability management data represented using the SCAP specifications? What is the name of the program designed to test the ability of products to use the features and functionality available through SCAP and its component standards? Name an ISCM reference model that provides a foundation for a continuous monitoring reference model that aims to enable organizations to aggregate collected data from across a diverse set of security tools, analyze that data, perform scoring, enable user queries, and provide overall situational awareness. FITSP-M Module 6 - Continuous Monitoring
36
Section D CM Implementation FITSP-M Module 6 - Continuous Monitoring
37
FITSP-M Module 6 - Continuous Monitoring
38
FITSP-M Module 6 - Continuous Monitoring
Component Abbre-viation What is Scored Source Vulnerability VUL Vulnerabilities detected on a host Foundstone Patch PAT Patches required by a host SMS Security Compliance SCM Failures of a host to use required security settings Policy Auditor Anti-Virus AVR Out of date anti-virus signature file Unapproved OS UOS Unapproved operating systems AD Cyber Security Awareness Training CSA Every user who has not passed the mandatory awareness training within the last 365 days DoS Training Database SOE Compliance SOE Incomplete/invalid installations of any product in the Standard Operating Environment (SOE) suite AD Computers ADC Computer account password ages exceeding threshold AD Users ADU User account password ages exceeding threshold (scores each user account, not each host) SMS Reporting Incorrect functioning of the SMS client agent Vulnerability Reporting VUR Missed vulnerability scans Security Compliance Reporting SCR Missed security compliance scans FITSP-M Module 6 - Continuous Monitoring
39
Monitoring Tool Data Sources
Component ID What is Scored Source Vulnerability VUL Vulnerabilities detected on a host Foundstone (McAfee) Patch PAT Patches required by a host SMS (System Center) Security Compliance SCM Failures of a host to use required security settings McAfee Policy Auditor Anti-Virus AVR Out of date anti-virus signature file Unapproved OS UOS Unapproved operating systems AD Cyber Security Awareness Training CSA Every user who has not passed the mandatory awareness training within the last 365 days DoS Training Database SOE Compliance SOE Incomplete/invalid installations of any product in the Standard Operating Environment (SOE) suite AD Computers ADC Computer account password ages exceeding threshold AD Users ADU User account password ages exceeding threshold (scores each user account, not each host) SMS Reporting SMS Incorrect functioning of the SMS client agent Vulnerability Reporting VUR Missed vulnerability scans Security Compliance Reporting SCR Missed security compliance scans FITSP-M Module 6 - Continuous Monitoring
40
Risk Scoring FITSP-M Module 6 - Continuous Monitoring
41
Remediation FITSP-M Module 6 - Continuous Monitoring
42
CM Challenges The Organization of the SP 800-53
Emerging CM Technologies SCAP OCIL The Limitations of CAESARS Department of State’s iPost and Risk Scoring Program FITSP-M Module 6 - Continuous Monitoring
43
CM Discussion Section Optional
FITSP-M Module 6 - Continuous Monitoring
44
Organization of Security Controls
18 Families 198 Controls 892 Control Items (Parts/Enhancements) FITSP-M Module 6 - Continuous Monitoring
45
Control Catalog Redundancies Evident in USGCB
FITSP-M Module 6 - Continuous Monitoring
46
DoD Solution: Mapping STIG to 800-53
FITSP-M Module 6 - Continuous Monitoring
47
DoS Solution: Using Fishbone to Find Root Controls
FITSP-M Module 6 - Continuous Monitoring
48
DoS Solution: Proposed Structure of Security Control Catalog
FITSP-M Module 6 - Continuous Monitoring
49
The Limitations of CAESARS
Lack of Interface Specifications Reliance on an Enterprise Service Bus Incomplete Communication Payload Specifications Lack of Specifications Describing Subsystem Capabilities Lack of a Multi-CM Instance Capability Lack of Multi-Subsystem Instance Capability CM Database Integration with Security Baseline Content Lack of Detail on the Required Asset Inventory Requirement for Risk Measurement FITSP-M Module 6 - Continuous Monitoring
50
GAO Report on Scope of iPost Risk Scoring Program
Addresses windows hosts but not other IT assets on its major unclassified network Covers a set of 10 scoring components that includes some, but not all, information system controls that are intended to reduce risk State could not demonstrate the extent to which scores are based on risk factors such as threat, impact, or likelihood of occurrence that are specific to its computing environment FITSP-M Module 6 - Continuous Monitoring
51
Minimum Security Controls (FIP 200) Controls Monitored by iPost
Access Control Security Compliance (AD Group check) Awareness and Training Awareness Training Audit and Accountability Reporting Security Assessment and Authorization Configuration Management Patching, SOE, Reporting(Inventory) Contingency Planning Identification and Authentication AD Computers & Users Incident Response Maintenance Media Protection Physical and Environmental Protection Planning Personnel Security Risk Assessment Vulnerabilities System and Services Acquisition System and Communications Protection System and Information Integrity Patching, Antivirus FITSP-M Module 6 - Continuous Monitoring
52
Challenges with Implementation of iPost
Overcoming limitations and technical issues with data collection tools Identifying and notifying individuals with responsibility for site-level security Implementing configuration management for iPost Adopting a strategy for continuous monitoring of controls Managing stakeholder expectations for continuous monitoring activities FITSP-M Module 6 - Continuous Monitoring
53
Continuous Monitoring Key Concepts & Vocabulary
Role in the RMF Process RMF Step 6 – Monitor Security Controls Characteristics of Continuous Monitoring organization-wide approach Elements of Organization-wide CM Program Continuous Monitoring Process Role of Automation Continuous Asset Evaluation, Situational Awareness and Risk Scoring (CEASARS) FITSP-M Module 6 - Continuous Monitoring
54
Questions? FITSP-M Module 6 - Continuous Monitoring
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.