Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > TECHNOLOGIES FOR ENABLING ISCM

CAPEC

Common Attack Pattern Enumeration & Classification

CVSS

Common Vulnerability Scoring System

CVE

Common Vulnerabilities and Exposures

FDCC

Federal Desktop Core Configuration

FISMA

Federal Information Security Management Act of 2002

IDPS

Intrusion Detection and Prevention System

ISCM

Information Security Continuous Monitoring

ISSO

Information System Security Officer

OCIL

Open Checklist Interactive Language

OVAL

Open Vulnerability and Assessment Language

PII

Personally Identifiable Information

SCAP

Security Content Automation Protocol

SIEM

Security Information and Event Management

SISO

Senior Information Security Officer

SP

Special Publication
SwAAP
Software Assurance Automation Protocol

USGCB

United States Government Configuration Baseline

XCCDF

eXtensible Configuration Checklist Description Format
Extensible Markup Language

TECHNOLOGIES FOR ENABLING ISCM

rganizations can make more effective use of their security budgets by implementing
technologies to automate many of the ISCM activities in support of organizational risk
management policy and strategy, operational security, internal and external compliance,
reporting, and documentation needs. Organizations may choose to follow a reference architecture,
such as NIST CAESARS Framework Extension, to implement ISCM technologies.44
•
Ongoing assessments of security control effectiveness;
There are a
variety of tools and technologies available that an organization can use to efficiently and
effectively gather, aggregate, analyze, and report data ranging from continuously monitoring the
security status of its enterprise architecture and operating environment(s) down to components of
individual information systems. These tools and technologies can enable and assist automated
monitoring in support of a variety of organizational processes including but not limited to:
•
Reporting of security status at the appropriate level of granularity to personnel with security
responsibilities;
•
Management of risk and verification and assessment of mitigation activities;
•
Assurance of compliance with high-level internal and external requirements; and
•
Analysis of the security impact of changes to the operational environment.
The tools and technologies discussed in this appendix leverage the strategies, policies, and roles
and responsibilities of the overall ISCM program, and can assist organizations in their efforts to
automate the implementation, assessment, and monitoring of many NIST SP 800-53 security
controls. Though these tools and technologies lend themselves primarily to the continuous
monitoring of technical security controls that can be automated, they can provide evidence, in an
automated manner, to support the existence and effectiveness of nontechnical security controls or
parts of technical security controls that cannot be easily automated. Automation is achieved
through a variety of commercial off-the-shelf (COTS) and government off-the-shelf (GOTS)
products, built-in operating system capabilities, and custom tools and scripting that use
standardized automation specifications.
It is important to understand and appreciate the need to assess the effectiveness of all security
controls, particularly nontechnical security controls, periodically. Data collected from automated
tools may not provide feedback on the existence and the effectiveness of nontechnical security
controls. It may be possible in some cases to make certain inferences about the effectiveness of
nontechnical security controls based on data collected from automated tools. While it may not be
possible to use automated tools and technologies to monitor adherence to policies and procedures,
it may be possible to monitor associated security objectives in an automated fashion.
44 For more information, please refer to DRAFT NISTIR 7756, as amended, CAESARS Framework Extension: An
Enterprise Continuous Monitoring Technical Reference Architecture.
O