1. Information System Continuous Monitoring (ISCM)
FITSP-M Module 7
Information System Continuous Monitoring (ISCM)
FITSP-M Module 6 - Continuous Monitoring

2. Leadership “Continuous monitoring is the backbone of true security.”
-Vivek Kundra
Federal CIO
FITSP-M Module 6 - Continuous Monitoring

3. FITSP-M Exam Module Objectives
Audit and Accountability
Manage controls in a system that facilitate the creation, protection, and retention of information system audit records to the extent needed to enable the monitoring, analysis, and investigation of the system
Security Assessments and Authorization
Supervise processes that facilitate the monitoring of information system security controls on an ongoing basis to ensure the continued effectiveness of the controls
System and Communication Protection
Oversee processes that monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems
System and Information Integrity
Direct mechanisms that monitor information system security alerts and advisories that take appropriate actions in response
FITSP-M Module 6 - Continuous Monitoring

4. Continuous Monitoring Overview
Section A: Continuous Monitoring Trends
RMF Step 6 – Monitor Security Controls
Redefining Risk Management
DHS CM Reporting Metrics
Cyberscope
Section B: CM Guidelines, SP
ISCM Fundamentals
Organization-wide Approach
Elements of Organization-wide CM Program
Continuous Monitoring Process
Section C: Automation
Automation Domains
SCAP & OCIL
Continuous Asset Evaluation, Situational Awareness and Risk Scoring (CEASARS)
Section D: CM Implementation
FITSP-M Module 6 - Continuous Monitoring

5. Continuous Monitoring Trends
Section A
Continuous Monitoring Trends
FITSP-M Module 6 - Continuous Monitoring

6. RMF Step 6 – Monitor Security Controls
Information System And Environment Changes
Ongoing Security Control Assessments
Ongoing Remediation Actions
Key Updates
Security Status Reporting
Ongoing Risk Determination And Acceptance
Information System Removal And Decommissioning
FITSP-M Module 6 - Continuous Monitoring

7. Risk Management Redefined OODA Loop
FITSP-M Module 6 - Continuous Monitoring

8. DHS Cyberscope Monthly Data Feeds to DHS
Inventory
Systems and Services
Hardware
Software
External Connections
Security Training
Identity Management and Access
Government-wide benchmarking on security posture
Agency-specific interviews
FITSP-M Module 6 - Continuous Monitoring

9. DHS FY12 Reporting Metrics 1. Continuous Monitoring
FITSP-M Module 6 - Continuous Monitoring

10. Knowledge Check Name the components of the new risk management model.
Name the reporting tool, which automates Agency FISMA reporting directly to the DHS.
What 3 Continuous Monitoring metrics will DHS expect agencies to report for FY2012?
FITSP-M Module 6 - Continuous Monitoring

11. The CM Guidelines SP 800-137 Section B
FITSP-M Module 6 - Continuous Monitoring

12. NIST SP Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Information security continuous monitoring (ISCM) is defined as:
Maintaining Ongoing Awareness of Information Security, Vulnerabilities, and Threats
Support Organizational Risk Management Decisions
Begins With Leadership Defining A Comprehensive ISCM Strategy Encompassing
technology
processes
procedures
operating environments
people
FITSP-M Module 6 - Continuous Monitoring

13. ISCM Fundamentals Define the ISCM strategy Establish an ISCM program
Implement the ISCM program
Analyze and Report findings
Respond to findings
Review and Update ISCM strategy and program
FITSP-M Module 6 - Continuous Monitoring

14. Mission/Business Processes
ISCM Criteria
Tier 1
Tier 2
Tier 3
Organization
Mission/Business Processes
Information Systems
Automated/Manual Data Feeds (Security-related Information, POAMs, SARs)
Data
Tools
Risk Management Strategy:
How the organization plans to assess, respond to, and monitor risk
Oversight required to ensure effectiveness of RM strategy
Program Management
Defined by how business processes are prioritized
Types of information needed to successfully execute those business processes
Monitoring System Level Controls and Security Status Reporting
Security Alerts
Security Incidents
Identified Threat Activities
FITSP-M Module 6 - Continuous Monitoring

15. The CM Process Define an ISCM Strategy Establish an ISCM Program
Implement an ISCM Program
Determining Appropriate Response
Mitigating Risk
Review and Update the Monitoring Program
FITSP-M Module 6 - Continuous Monitoring

16. Interrelationships to the CM Process
Risk Tolerance
Enterprise Architecture
Security Architecture
Security Configurations
Plans for Changes to Enterprise Architecture
Available Threat Information
FITSP-M Module 6 - Continuous Monitoring

17. Section C
Automation
FITSP-M Module 6 - Continuous Monitoring

18. Role of Automation in ISCM
Consideration is given to ISCM tools that:
Pull information from a variety of sources (Specifications, Mechanisms, Activities, Individuals)
Use open specifications such as SCAP
Offer interoperability with other products (help desk, inventory management, configuration management, and incident response solutions)
Support compliance with applicable federal laws, regulations, standards, and guidelines
Provide reporting with the ability to tailor output
Allow for data consolidation into Security Information and Event Management (SIEM) tools and dashboard products. SP
FITSP-M Module 6 - Continuous Monitoring

19. Security Automation Domains
Vulnerability & Patch Management
Event & Incident Management
Malware Detection
Asset Management
Configuration Management
Network Management
License Management
Information Management
Software Assurance SP
FITSP-M Module 6 - Continuous Monitoring

20. Tools and Technologies
Automation Domain
Tools and Technologies
NIST Guidelines
1 - Vulnerability Management
Vulnerability scanners
NIST SP Creating a Patch and Vulnerability Management Program
2 - Patch Management
Patch management tools
3 - Event Management
Intrusion detection/ prevention systems and logging mechanisms
NIST SP , Computer Security Log Management
4 - Incident Management
NIST SP , Guide IDPS
5 - Malware Detection
Antivirus/ Malware detection mechanisms
NIST SP , Malware Incident Prevention and Handling
6 - Configuration Management
SCAP, SEIM, Dashboards
NIST SP r2 The Technical Specification for SCAP Version 1.2 SP
FITSP-M Module 6 - Continuous Monitoring

21. Tools and Technologies
Automation Domain
Tools and Technologies
7 - Asset Management
System configuration, network management, and license management tools
8 - Network Management
Host discovery, inventory, change control, performance monitoring, and other network device management capabilities
9 - License Management
License management tools
10 - Information Management
Data Loss Prevention (DLP) Tools: network analysis software, application firewalls, and intrusion detection and prevention systems SP
FITSP-M Module 6 - Continuous Monitoring

22. Software Assurance Technologies Security Automation Domain #11
Software Assurance Automation Protocol (SwAAP -measure and enumerate software weaknesses):
CWE
Common Weakness Enumeration Dictionary of weaknesses that can lead to exploitable vulnerabilities
CWSS
Common Weakness Scoring System Assigning risk scores to weaknesses
CAPEC
Common Attack Pattern Enumeration & Classification Catalog of attack patterns
MAEC
Malware Attribute Enumeration & Characterization Standardized language about malware, based on attributes such as behaviors and attack patterns SP
FITSP-M Module 6 - Continuous Monitoring

23. Knowledge Check
What is the document that provides guidelines for developing a CM program?
What is the first step in the CM Process?
Name an automation specification, which is a dictionary of weaknesses that can lead to exploitable vulnerabilities?
What is defined as an information security area that includes a grouping of tools, technologies, and data? Data within the domains is captured, correlated, analyzed, and reported to present the security status of the organization that is represented by the domains monitored.
FITSP-M Module 6 - Continuous Monitoring

24. Automation and Reference Data Sources
Security Content Automation Protocol (SCAP)
What Can Be Automated With SCAP
How to Implement SCAP
Partially Automated Controls
Reference Data Sources
National Vulnerability Database (NVD)
Security Configuration Checklists
FITSP-M Module 6 - Continuous Monitoring

25. NVD SCAP Program NVD Primary Resources Scan Data Feed
Vulnerability Search Engine
National Checklist Program
SCAP Compatible Tools
SCAP Data Feeds (CVE, CCE, CPE, CVSS, XCCDF, OVAL)
Product Dictionary (CPE)
Impact Metrics (CVSS)
Common Weakness Enumeration (CWE)
SCAP Program
Scan
NVD
Data Feed
FITSP-M Module 6 - Continuous Monitoring

26. SCAP: What Can Be Automated?
Vulnerability and Patch Scanners
Authenticated
Unauthenticated
Baseline Configuration Scanners
Federal Desktop Core Configuration (FDCC)
United States Government Configuration Baseline (USGCB)
FITSP-M Module 6 - Continuous Monitoring

27. How to Implement SCAP with SCAP-validated Tools
FITSP-M Module 6 - Continuous Monitoring

28. … and SCAP-expressed Checklists
FITSP-M Module 6 - Continuous Monitoring

29. Partially Automated Controls
Open Checklist Interactive Language (OCIL)
Define Questions (Boolean, Choice, Numeric, Or String)
Define Possible Answers to a Question from Which User Can Choose
Define Actions to be Taken Resulting from a User's Answer
Enumerate Result Set
Used in Conjunction with eXtensible Configuration Checklist Description Format (XCCDF)
FITSP-M Module 6 - Continuous Monitoring

30. Technologies for Aggregation and Analysis
Management Dashboards
Meaningful And Easily Understandable Format
Provide Information Appropriate to Roles And Responsibilities
Security Information and Event Management (SIEM), analysis of:
Vulnerability Scanning Information,
Performance Data,
Network Monitoring,
System Audit Record (Log) Information
Audit Record Correlation And Analysis
FITSP-M Module 6 - Continuous Monitoring

31. CAESARS Framework
FITSP-M Module 6 - Continuous Monitoring

32. FITSP-M Module 6 - Continuous Monitoring

33. IR 7756
FITSP-M Module 6 - Continuous Monitoring

34. CM Documents
FITSP-M Module 6 - Continuous Monitoring

35. Knowledge Check
Name the set of specifications used to standardize the communication of software flaws and security configurations.
What is the name of the U.S. government repository of standards-based vulnerability management data represented using the SCAP specifications?
What is the name of the program designed to test the ability of products to use the features and functionality available through SCAP and its component standards?
Name an ISCM reference model that provides a foundation for a continuous monitoring reference model that aims to enable organizations to aggregate collected data from across a diverse set of security tools, analyze that data, perform scoring, enable user queries, and provide overall situational awareness.
FITSP-M Module 6 - Continuous Monitoring

36. Section D
CM Implementation
FITSP-M Module 6 - Continuous Monitoring

37. FITSP-M Module 6 - Continuous Monitoring

38. FITSP-M Module 6 - Continuous Monitoring
Component
Abbre-viation
What is Scored
Source
Vulnerability
VUL
Vulnerabilities detected on a host
Foundstone
Patch
PAT
Patches required by a host
SMS
Security Compliance
SCM
Failures of a host to use required security settings
Policy Auditor
Anti-Virus
AVR
Out of date anti-virus signature file
Unapproved OS
UOS
Unapproved operating systems AD
Cyber Security Awareness Training
CSA
Every user who has not passed the mandatory awareness training within the last 365 days
DoS Training Database
SOE Compliance
SOE
Incomplete/invalid installations of any product in the Standard Operating Environment (SOE) suite
AD Computers
ADC
Computer account password ages exceeding threshold
AD Users
ADU
User account password ages exceeding threshold (scores each user account, not each host)
SMS Reporting
Incorrect functioning of the SMS client agent
Vulnerability Reporting
VUR
Missed vulnerability scans
Security Compliance Reporting
SCR
Missed security compliance scans
FITSP-M Module 6 - Continuous Monitoring

39. Monitoring Tool Data Sources
Component ID
What is Scored
Source
Vulnerability
VUL
Vulnerabilities detected on a host
Foundstone (McAfee)
Patch
PAT
Patches required by a host
SMS (System Center)
Security Compliance
SCM
Failures of a host to use required security settings
McAfee Policy Auditor
Anti-Virus
AVR
Out of date anti-virus signature file
Unapproved OS
UOS
Unapproved operating systems AD
Cyber Security Awareness Training
CSA
Every user who has not passed the mandatory awareness training within the last 365 days
DoS Training Database
SOE Compliance
SOE
Incomplete/invalid installations of any product in the Standard Operating Environment (SOE) suite
AD Computers
ADC
Computer account password ages exceeding threshold
AD Users
ADU
User account password ages exceeding threshold (scores each user account, not each host)
SMS Reporting
SMS
Incorrect functioning of the SMS client agent
Vulnerability Reporting
VUR
Missed vulnerability scans
Security Compliance Reporting
SCR
Missed security compliance scans
FITSP-M Module 6 - Continuous Monitoring

40. Risk Scoring
FITSP-M Module 6 - Continuous Monitoring

41. Remediation
FITSP-M Module 6 - Continuous Monitoring

42. CM Challenges The Organization of the SP 800-53
Emerging CM Technologies
SCAP
OCIL
The Limitations of CAESARS
Department of State’s iPost and Risk Scoring Program
FITSP-M Module 6 - Continuous Monitoring

43. CM Discussion Section Optional
FITSP-M Module 6 - Continuous Monitoring

44. Organization of Security Controls
18 Families
198 Controls
892 Control Items (Parts/Enhancements)
FITSP-M Module 6 - Continuous Monitoring

45. Control Catalog Redundancies Evident in USGCB
FITSP-M Module 6 - Continuous Monitoring

46. DoD Solution: Mapping STIG to 800-53
FITSP-M Module 6 - Continuous Monitoring

47. DoS Solution: Using Fishbone to Find Root Controls
FITSP-M Module 6 - Continuous Monitoring

48. DoS Solution: Proposed Structure of Security Control Catalog
FITSP-M Module 6 - Continuous Monitoring

49. The Limitations of CAESARS
Lack of Interface Specifications
Reliance on an Enterprise Service Bus
Incomplete Communication Payload Specifications
Lack of Specifications Describing Subsystem Capabilities
Lack of a Multi-CM Instance Capability
Lack of Multi-Subsystem Instance Capability
CM Database Integration with Security Baseline Content
Lack of Detail on the Required Asset Inventory
Requirement for Risk Measurement
FITSP-M Module 6 - Continuous Monitoring

50. GAO Report on Scope of iPost Risk Scoring Program
Addresses windows hosts but not other IT assets on its major unclassified network
Covers a set of 10 scoring components that includes some, but not all, information system controls that are intended to reduce risk
State could not demonstrate the extent to which scores are based on risk factors such as threat, impact, or likelihood of occurrence that are specific to its computing environment
FITSP-M Module 6 - Continuous Monitoring

51. Minimum Security Controls (FIP 200) Controls Monitored by iPost
Access Control
Security Compliance (AD Group check)
Awareness and Training
Awareness Training
Audit and Accountability
Reporting
Security Assessment and Authorization
Configuration Management
Patching, SOE, Reporting(Inventory)
Contingency Planning
Identification and Authentication
AD Computers & Users
Incident Response
Maintenance
Media Protection
Physical and Environmental Protection
Planning
Personnel Security
Risk Assessment
Vulnerabilities
System and Services Acquisition
System and Communications Protection
System and Information Integrity
Patching, Antivirus
FITSP-M Module 6 - Continuous Monitoring

52. Challenges with Implementation of iPost
Overcoming limitations and technical issues with data collection tools
Identifying and notifying individuals with responsibility for site-level security
Implementing configuration management for iPost
Adopting a strategy for continuous monitoring of controls
Managing stakeholder expectations for continuous monitoring activities
FITSP-M Module 6 - Continuous Monitoring

53. Continuous Monitoring Key Concepts & Vocabulary
Role in the RMF Process
RMF Step 6 – Monitor Security Controls
Characteristics of Continuous Monitoring
organization-wide approach
Elements of Organization-wide CM Program
Continuous Monitoring Process
Role of Automation
Continuous Asset Evaluation, Situational Awareness and Risk Scoring (CEASARS)
FITSP-M Module 6 - Continuous Monitoring

54. Questions?
FITSP-M Module 6 - Continuous Monitoring