Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Section 3.2.2 includes a more complete discussion of factors to consider when determining > 2.3 ROLE OF AUTOMATION IN ISCM

Section 3.2.2 includes a more complete discussion of factors to consider when determining

monitoring frequencies.

2.3 ROLE OF AUTOMATION IN ISCM

When possible, organizations look for automated solutions to lower costs, enhance efficiency,
and improve the reliability of monitoring security-related information. Security is implemented
through a combination of people, processes, and technology. The automation of information
security deals primarily with automating aspects of security that require little human interaction.
Automated tools are often able to recognize patterns and relationships that may escape the notice
of human analysts, especially when the analysis is performed on large volumes of data. This
includes items such as verifying technical settings on individual network endpoints or ensuring
that the software on a machine is up to date with organizational policy. Automation serves to
augment the security processes conducted by security professionals within an organization and
may reduce the amount of time a security professional must spend on doing redundant tasks,
thereby increasing the amount of time the trained professional may spend on tasks requiring
human cognition.
The ISCM strategy does not focus solely on the security-related information that is easy for an
organization to collect or easy to automate. When an ISCM program is first implemented, there
will likely be several aspects of the organization's security program that are manually monitored.
Organizations' monitoring capabilities will expand and mature over time. Metrics will evolve
with lessons learned and with increased insight into organizational security status and risk
tolerance. The focus of an ISCM strategy is to provide adequate information about security
control effectiveness and organizational security status allowing organizational officials to make
informed, timely security risk management decisions. Thus, implementation, effectiveness, and
adequacy of all security controls are monitored along with organizational security status.
When determining the extent to which the organization automates ISCM, organizations consider
potential efficiencies of process standardization that may be gained with automation, and the
potential value (or lack of value) of the automated security-related information from a risk
management perspective. Additionally, organizations consider intangibles such as the potential
value of personnel reassignment and more comprehensive situational awareness.
While automation of IT security has the potential to significantly reduce the amount of time a
human must spend doing certain tasks, it is not possible to fully automate all of an organization's
information security program functions. The technologies discussed in Appendix D, for example,
still require human analysis for implementation and maintenance of the tools as well as
appropriate interpretation of findings. Similarly, these tools operate within the context of
processes designed, run, and maintained by humans. If individuals carry out their responsibilities
insecurely, then the effectiveness of the technologies is compromised, and the security of the
systems and the mission/business or organizational processes supported by those systems is put in
jeopardy.
Automation makes security-related information readily available in an environment where
ongoing monitoring needs change. Therefore, during security control implementation (RMF Step
3), consideration is given to the capabilities inherent in available technology to support ISCM as
part of the criteria in determining how best to implement a given control.
Consideration is given to ISCM tools that:
•
Pull information from a variety of sources (i.e., assessment objects22
•
Use open specifications such as the Security Content Automation Protocol (SCAP);
);
•
Offer interoperability with other products such as help desk, inventory management,
configuration management, and incident response solutions;
•
Support compliance with applicable federal laws, Executive Orders, directives, policies,
regulations, standards, and guidelines;
•
Provide reporting with the ability to tailor output and drill down from high-level, aggregate
metrics to system-level metrics; and
•
Allow for data consolidation into Security Information and Event Management (SIEM) tools
and dashboard products.
Automation supports collecting more data more frequently and from a larger and more diverse
pool of technologies, people, processes, and environments. It can therefore make comprehensive,
ongoing control of information security practical and affordable. How effective the organization
is in utilizing the monitoring results (obtained in a manual or automated fashion) still depends
upon the organizational ISCM strategy, including validity and comprehensiveness of the metrics,
as well as the processes in place to analyze monitoring results and respond to findings.
Technologies for enabling automation of some ISCM tasks are discussed in greater detail in