Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

These challenges can be met through the use of a reference model that describes the types of tools
needed, their relationships, and their required roles in fulfilling ISCM functionality. The model
either leverages or provides interface specifications that enable integration of these tools in order
for an organization to compose an ISCM technical implementation. The model also provides
specifications for each tool type so that the tools perform their roles appropriately in
implementing organization wide ISCM.
One example of an ISCM reference model that promotes this consistent integration is the
CAESARS Framework Extension, described in NIST Interagency Report (NISTIR) 7756,
CAESARS Framework Extension: An Enterprise Continuous Monitoring Technical Reference
Architecture (Draft). NISTIR 7756 provides a foundation for a continuous monitoring reference
model that aims to enable organizations to aggregate collected data from across a diverse set of
security tools, analyze that data, perform scoring, enable user queries, and provide overall
situational awareness.
The model is based on a set of high level workflow that describe necessary data movement within
an ISCM technical implementation. These workflow are realized through the model's subsystem
specifications (i.e., requirements for types of tools) and interface specifications for tool
communication. One ability to leverage the model is dependent in part on the available
infrastructure and the maturity of the organization's measurement program. 57
In the model, data is collected (for predefined metrics or in response to a user query) to include
those related to security control implementation and effectiveness. The types of data sources
include people, processes, technologies, and the computing environment, (including security
control assessment results). A variety of methods, both automated and manual, can be used to
collect data. Organizations consider utilizing standards-based methods within tools for
performing data collection to reduce integration costs, to enable interoperability of diverse tools
and technologies, and to enable data to be collected once and reused many times. Data generated
by humans can be collected using mechanisms that use automation and that leverage standardized
methods. Collection methodologies are standardized and automated where possible to enable
intra- and inter-tier information exchange, correlation and analysis.
The functional
capabilities of an architecture implemented to support ISCM include data collection, storage,
querying, analysis, retrieval, propagation to higher tiers, and presentation.
Collected data is tagged with metadata when stored in ways that maximize reuse of collected
data. Data is normalized for purposes of aggregation, correlation, and consistent use in metrics.
Care is taken to store data that has been normalized or otherwise processed with its relevant
attributes so as to minimize the possibility of contamination of one metric by cleansing
algorithms used in support of another.
The model enables an ISCM infrastructure that has retrieval, analysis, and presentation
capabilities sufficient to support reporting and risk-based decision making at all tiers. Metrics are
calculated in accordance with the ISCM strategy and the established program. All security-related
information is presented to those with ISCM roles and responsibilities as well as other
stakeholders including consumers of monitoring information who use it to control operations
within organizational risk tolerances in accordance with ISCM strategy (e.g., individuals
57 See NIST SP 800-55, as amended, for more information on measurement programs.