Got your security monitoring game in gear?

Agencies will have to up their cybersecurity games under a recent memo from the Office of Management and Budget that requires formal plans for Information Security Continuous Monitoring (ISCM) by Feb. 28.

OMB Memo M-14-03, Enhancing the Security of Federal Information and Information Systems, released in November, includes requirements to move to standardized technology and the use of automated feeds to a yet-to-be-developed dashboard for showing the status of government IT systems. 

The focus on continuous monitoring — or continuous diagnostics and mitigation, or continuous measurement and management — is not new in government. But the latest guidelines introduce new elements, says Patrick Howard of Kratos Defense and Security Solutions.

“I’m sure most agencies have a documented plan in place,” said Howard, formerly chief information security officer at the Nuclear Regulatory Commission and the Department of Housing and Urban Development. “But they need to look at it again in light of these new requirements.”

Fully continuous monitoring of federal IT systems is an ideal that is unlikely to be realized because of the complexity of real-time scanning of all aspects of system security. Nor is such monitoring necessary for every element. But the trend in government is to shrink the period of security assessments from years to months, days or even hours where appropriate.

The OMB memo is the latest step in this evolution, from the certification and accreditation of systems under the Federal Information Security Management Act every three years through requirements for data feeds — first quarterly, then monthly — into the Homeland Security Department’s CyberScope. This step will leverage commercial tools available through blanket purchase agreements (BPA) under the DHS Continuous Diagnostics and Mitigation program.

The General Services Administration in August awarded BPAs to 17 companies, who in turn are partnering with dozens more vendors to provide a wide array of off-the-shelf tools for monitoring of the status of agency IT systems. These tools have been developed to comply with the Security Content Automation Protocols (SCAP), a collection of specifications developed by the National Institute of Standards and Technology that allows products from various to vendors to communicate and interoperate. The requirement for agencies to use SCAP compliant tools when available has spurred development by vendors of interoperable products to automate security tasks, making continuous monitoring practical.

“I think the products on the market today are adequate to protect the overwhelming majority of government data,” said Howard, who is the CDM program manager for Kratos, one of the 17 companies included in the BPA.

But having the products available does not ensure a successful continuous monitoring program, Howard said. “I don’t think technology is the problem. Where the program falls down with agencies is with the implementation.”

This is why close attention to new requirements set out by OMB is necessary. Not only must agency plans be consistent with earlier OMB policy and NIST guidelines, such as those in Special Publication 800-137, they also must conform to the Concept of Operations for Information Security Continuous Monitoring (CONOPS) developed by the Joint Continuous Monitoring Working Group. Plans should be agencywide, when practical, and must be standardized on tools available under the BPA.

All of this means that agencies will have to make decisions on what systems and what security controls need to be evaluated on what schedule, and which ones can be automated and which will be done manually. Because of the broad nature of the requirements and the quickened pace of assessments, more stakeholders will be involved in the process.

“This is going to be substantially different, because they are going to be involved in a more frequent basis,” Howard said.

The transition to standardized toolsets under the BPAs as current contracts expire and legacy equipment is replaced could be the greatest challenge for the CISO. IT and security administrators happy with the status quo often are reluctant to replace tools and vendors they are familiar with. “They don’t think it’s broken,” Howard said. “They have to be convinced it needs to be fixed.”

The ISCM plan will have to address the challenges of educating and getting buy-in from the broad range of stakeholders who will be affected by its requirements.

ISCM strategies must be completed by all agencies by Feb. 28, and all requirements in the memorandum must be met by Sept. 30, 2017. Some other key deadlines include:

• Begin procuring products and services to support initial continuous monitoring requirements by Feb. 28 and begin deploying products by May 30, 2014.
• Identify managers for the ISCM program and identify resource and skill gaps that must be filled by April 30, 2014.
• Perform initial authorization of information systems to operate before implementing the ISCM plan for those systems by May 30.
• Inspectors general to begin annual evaluations of ISCM plans and their implementation by Nov. 15, 2014.