The Risk Communicator: May 2011

Continuous Monitoring: Risk Management the

Right Way

by Bruce Brody

For the past decade, the Federal Information Security Management Act (FISMA) was the process by which federal departments and agencies were required to assess the risk to their information systems, put controls in place to manage the risk, and authorize those systems to operate in a risk-based, cost-effective manner. Unfortunately, the actual implementation of FISMA devolved into a static, paper-based compliance process; billions of dollars were expended on notebooks of paper that constituted certification and accreditation (C&A) packages, and those notebooks sat on shelves for three years until the process began all over again. Nearly a decade of FISMA -- the legislation, its oversight and its implementation -- did very little to improve security among executive-branch agencies.

Instead, the culture of paper-based compliance drills, checklists and scorecards enriched the vendor community and generated executive bonuses, but the security of our federal networks and systems did not appreciably improve. Thankfully, both Congress and the executive branch now understand the shortcomings of FISMA and have begun the process of transitioning to continuous monitoring of security controls. At least that's their intention.

But what exactly is continuous monitoring? We first caught a glimpse of the new concept in one of the earliest of many bills over the past two years, drafted by Delaware Sen. Tom Carper's staff on the Senate Homeland Security and Governmental Affairs Committee. It contained the first attempt at a legal definition for continuous monitoring:

"The term 'automated and continuous monitoring' means monitoring at a frequency and sufficiency such that the data exchange requires little to no human involvement and is not interrupted" (S.B. 3480 in the 111th Congress and S.413 in the 112th Congress)

The Office of Management and Budget (OMB) followed, anticipating the new legislation by issuing the reporting requirements that would begin the transition away from the paper-based compliance and meaningless scorecards that characterized the former FISMA process. The new OMB reporting requirements were presented in OMB Memorandum 10-15, signed on April 21, 2010:

"Agencies need to be able to continuously monitor security-related information from across the enterprise in a manageable and actionable way."

As agencies scratched their collective heads to figure out continuous monitoring, the Department of Homeland Security (DHS) followed with its Continuous Asset Evaluation, Situational Awareness and Risk Scoring (CAESARS) Reference Architecture Report, which came out in September. DHS decided to examine the programs already emerging at the Departments of State and Justice and the Internal Revenue Service. While these programs are good starts, they are not yet fully realized continuous monitoring programs. Even more unfortunately, CAESARS did not consider the most mature and robust of the federal continuous monitoring programs: that of the House of Representatives. While it may be difficult to appreciate why the House has the best current example of continuous monitoring in government, one of the obvious reasons, other than a deep understanding of real security, is that the House is exempt from the distractions and resource drains of the FISMA albatross.

Then followed NIST Special Publication 800-137, released in December 2010 and in public comment period until March 2011. It defined information security continuous monitoring as:

"...maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk decisions."

Thanks to NIST, we now have an acknowledgement that continuous monitoring is all about effective risk management. But let's take stock of where we stand in the midst of all of these activities: Congress has not yet passed a FISMA Reform bill, so a legal definition of continuous monitoring does not yet exist, and no two other definitions of continuous monitoring precisely match. DHS's review of existing continuous monitoring programs failed to take into account the only one really doing it right. And if you were to ask every agency today what they are doing in continuous monitoring, the miraculous answer is that they are all doing it! But then, they all claimed to be secure in the FISMA process, so most of them are merely FISMA-izing continuous monitoring.

What's missing is something practical that can be implemented within a large federal enterprise. At the heart of the FISMA Reform movement that started all of this progress are three very important concepts that, if they can be implemented correctly by federal departments and agencies, will significantly improve the status of information security throughout the federal enterprise. To put it simply, agencies will be required to put in place risk-based security controls and perform continuous monitoring of these controls against measures of effectiveness.

Continuous monitoring against measures of effectiveness is a whole new challenge for almost every department and agency. Measures of effectiveness require an assessment that the security controls are not just in place but they are operating effectively. No longer can an agency check to see if one-third of its controls every year are merely in place. From now on, all controls, at all times, are to be in place and operating effectively in the context of the risk profile of the department or agency. This requirement will be a huge leap from where most departments and agencies are today. This will also require a complete reassessment of the agency's workforce, skill sets, contractor support and overall security posture.

Yet to be exposed in all of this will be the agencies who previously misrepresented their security posture with absurd or meaningless metrics, or failed to verify adequately the false reporting of subordinate components, or a myriad of other disingenuous activities that were allowed to exist under the previous FISMA processes. The real power of the continuous monitoring processes is its focus on the true security posture of the enterprise with little human involvement to tamper with the results. That shift alone is a good thing.

In the end, federal information security is all about protecting our nation's systems and networks from those who wish to do them harm. Risk-based continuous monitoring against measures of effectiveness will go much farther than FISMA in achieving this noble goal.

This time, let's get it right.

Bruce Brody is the former Chief Information Security Officer at the Departments of Energy and Veterans Affairs. He is currently an executive in the information security industry supporting the federal market.