ezesecops/rmf-ato-core huggingface dataset:
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

In addition to malware detection, a variety of technologies and methods exist to limit or eliminate
the effects of malicious code attacks. Used in conjunction with configuration management and
control procedures and strong software integrity controls, malware detection mechanisms can be
even more effective in preventing execution of unauthorized code. Additional risk mitigation
measures, such as secure coding practices, trusted procurement processes, and regular monitoring
of secure configurations, can help to ensure that unauthorized functions are not performed.
The implementation and effective use of malware detection technologies can assist organizations
in automating the implementation, assessment, and continuous monitoring of several NIST SP
800-53 security controls, including CA-2, Security Assessments; CA-7, Continuous Monitoring;
IR-5, Incident Monitoring; RA-3, Risk Assessment; SA-12, Supply Chain Protection; SA-13,
Trustworthiness; SI-3, Malicious Code Protection; SI-4, Information System Monitoring; SI-7,
Software and Information Integrity; and SI-8, Spam Protection. Malware detection technologies
may also provide supporting data to assist organizations in meeting US-CERT incident reporting
requirements and in responding to OMB and agency CIO reporting requirements related to
incident management, remote access, and boundary protections.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

Identity and account configuration management tools allow an organization to manage
identification credentials, access control, authorization, and privileges. Identity management
systems may also enable and monitor physical access control based on identification credentials.
Identity and account configuration management tools often have the ability to automate tasks
such as account password resets and other account maintenance activities. These systems also
monitor and report on activities such as unsuccessful login attempts, account lockouts, and
resource access.
There are a wide variety of configuration management tools available to support an
organization's needs. When selecting a configuration management tool, organizations should
consider tools that can pull information from a variety of sources and components. Organizations
should choose tools that are based on open specifications such as SCAP; that support
organization-wide interoperability, assessment, and reporting; that provide the ability to tailor and
customize output; and that allow for data consolidation into SIEM tools and management
dashboards.
The implementation and effective use of configuration management technologies can assist
organizations in automating the implementation, assessment, and continuous monitoring of
several NIST SP 800-53 security controls including AC-2, Account Management; AC-3, Access
Enforcement; AC-5, Separation of Duties; AC-7, Unsuccessful Login Attempts; AC-9, Previous
Logon (Access) Notification; AC-10, Concurrent Session Control; AC-11, Session Lock; AC-19,
Access Control for Mobile Devices; AC-20, Use of External Information Systems; AC-22,
Publicly Accessible Content; CA-2, Security Assessments; CA-7, Continuous Monitoring; CM-2,
Baseline Configuration; CM-3, Configuration Change Control; CM-5, Access Restrictions for
Change; CM-6, Configuration Settings; CM-7, Least Functionality; IA-2, Identification and
Authentication (Organizational Users); IA-3, Device Identification and Authentication; IA-4,
Identifier Management; IA-5, Authenticator Management; IA-8, Identification and Authentication
(Non-Organizational Users); IR-5, Incident Monitoring; MA-5, Maintenance Personnel; PE-3,
Physical Access Control; RA-3, Risk Assessment; SA-7, User Installed Software; SA-10,
Developer Configuration Management; and SI-2, Flaw Remediation. Organization-wide security
configuration management and engineering technologies may also provide supporting data to
assist organizations in responding to higher-level compliance reporting requirements in the areas
of configuration and asset management.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

•
Trustworthiness - No exploitable vulnerabilities exist, either of malicious or unintentional
origin
•
Predictable Execution - Justifiable confidence that software, when executed, functions as
intended."
There are several automation specifications that can assist with continuous monitoring of
software assurance, including the emerging Software Assurance Automation Protocol (SwAAP)
that is being developed to measure and enumerate software weaknesses and assurance cases.
SwAAP uses a variety of automation specifications such as the Common Weakness Enumeration
(CWE), which is a dictionary of weaknesses that can lead to exploitable vulnerabilities (i.e.,
CVEs) and the Common Weakness Scoring System (CWSS) for assigning risk scores to
weaknesses. SwAAP also uses the Common Attack Pattern Enumeration & Classification
(CAPEC), which is a publicly available catalog of attack patterns with a comprehensive schema
and classification taxonomy, to provide descriptions of common methods for exploiting software
and the Malware Attribute Enumeration & Characterization (MAEC), which provides a
standardized language for encoding and communicating information about malware based upon
attributes such as behaviors, artifacts, and attack patterns.
There are a number of software assurance tools and technologies that are now incorporating many
of these automation specifications to provide software security throughout the software
development life cycle. The implementation and effective use of software assurance technologies
can assist organizations in automating the implementation, assessment, and continuous
monitoring of several NIST SP 800-53 security controls including CA-7, Continuous Monitoring;
SA-4, Acquisitions; SA-8, Security Engineering Principles; SA-11, Developer Security Testing;
SA-12, Supply Chain Protection; SA-13, Trustworthiness; SA-14, Critical Information System
Components; and SI-13, Predictable Failure Prevention.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D

SIEM products usually include support for many types of audit record sources, such as operating
systems, application servers (e.g., Web servers, email servers), and security software, and may
even include support for physical security control devices such as badge readers. An SIEM server
analyzes the data from all the different audit record sources, correlates events among the audit
record entries, identifies and prioritizes significant events, and can be configured to initiate
responses to events.
For each supported audit record source type, SIEM products typically can be configured to
provide functionality for categorization of the most important audit record fields (e.g., the value
in field 12 of application XYZ's logs signifies the source IP address) which can significantly
improve the normalization, analysis, and correlation of audit record data. The SIEM software can
also perform event reduction by disregarding those data fields that are not significant to
information system security, potentially reducing the SIEM software's network bandwidth and
data storage usage.
The implementation and effective use of SIEM technologies can assist organizations in
automating the implementation, assessment, and continuous monitoring of several NIST SP 800-
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
in an integrated manner to architect an ISCM technical implementation that

D.4 REFERENCE MODEL

Organizations can use the technologies, specifications, and reference data sources discussed in

in an integrated manner to architect an ISCM technical implementation that

maximizes the use of security-related information and promotes consistency in the planning and
implementation of ISCM. Where possible, this ISCM technical implementation automates the
collection, aggregation and analysis, and reporting and presentation of data that is necessary to
support organization-defined metrics.
However, organizations face significant challenges in integrating these technologies to enable
ISCM. Organizations typically use a diverse set of security products from multiple vendors. Thus
it is necessary to extract security-related information (ideally in the form of raw system state data)
from these tools and to normalize that data so that it is comparable (at tier 3 level and at tiers 2
and 1). A tier 3 capability is created to enable querying and reporting on the data aggregated from
multiple tools covering multiple ISCM security automation domains. Since there are often many
local tier 3 repositories covering different parts of a large enterprise, the tier 3 ISCM repositories
regularly report data to tier 2 repositories, likely following a hierarchical architecture. The tier 2
repositories in turn report data to tier 1 repositories that may report data to even higher level
users. As this data is passed up the ISCM hierarchy, it is abstracted since it is not usually possible
or advisable to replicate all low level security-related information at all tiers in the hierarchy.
Higher tier users query the lower level tiers to retrieve data. One challenge is the need for a
technical mechanism to allow a higher tier query to be passed to lower tier ISCM instances for
fulfillment. Another challenge is that in conducting query fulfillment, the lower tier ISCM
instances may need to perform analysis of raw data to generate the results. These results may be
findings (comparison of raw data against policy) or scores (numerical evaluation of a set of
findings) and so a mechanism in the query by which to convey the desired analysis that is to be
performed is needed. Ideally, if the requested data is not available at tier 3, then the tier 3 ISCM
instance tasks its diverse security tools to collect the requested data.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Appendix III5

1.1 BACKGROUND

The concept of monitoring information system security has long been recognized as sound
management practice. In 1997, Office of Management and Budget (OMB) Circular A-130,

The Federal Information Security Management Act (FISMA) of 2002 further emphasized the
importance of continuously monitoring information system security by requiring agencies to
conduct assessments of security controls at a frequency appropriate to risk, but no less than
annually.
required agencies to review their information systems' security controls and to
ensure that system changes do not have a significant impact on security, that security plans
remain effective, and that security controls continue to perform as intended.
Most recently, OMB issued memorandum M-11-33, FY 2011 Reporting Instructions for the
Federal Information Security Management Act and Agency Privacy Management.6
Tools supporting automated monitoring of some aspects of information systems have become an
effective means for both data capture and data analysis. Ease of use, accessibility, and broad
applicability across products and across vendors help to ensure that monitoring tools can be
readily deployed in support of near real-time, risk-based decision making.
The
memorandum provides instructions for annual FISMA reporting and emphasizes monitoring the
security state of information systems on an ongoing basis with a frequency sufficient to make
ongoing, risk-based decisions.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
describes the process of ISCM, including implementation guidelines; and

1.5 ORGANIZATION OF THIS SPECIAL PUBLICATION

The remainder of this special publication is organized as follows:
•

Chapter 2 describes the fundamentals of ongoing monitoring of information security in

support of risk management;
•

describes the process of ISCM, including implementation guidelines; and

•
Supporting appendices provide additional information regarding ISCM including: (A) general
references; (B) definitions and terms; (C) acronyms; and (D) descriptions of technologies for
enabling ISCM.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
Appendix D. > 2.4 ISCM ROLES AND RESPONSIBILITIES > Common Control Provider.23

Common Control Provider.23

Information System Security Officer (ISSO). The ISSO supports the organization's ISCM
program by assisting the ISO in completing ISCM responsibilities and by participating in the
configuration management process.
The common control provider establishes processes and procedures
in support of ongoing monitoring of common controls. The common control provider develops
and documents an ISCM strategy for assigned common controls; participates in the organization's
configuration management process; establishes and maintains an inventory of components
associated with the common controls; conducts security impact analyses on changes that affect
the common controls; ensures security controls are assessed according to the ISCM strategy;
prepares and submits security status reports in accordance with organizational policy/procedures;
conducts remediation activities as necessary to maintain common control authorization;
updates/revises the common security control monitoring process as required; updates critical
security documents as changes occur; and distributes critical security documents to individual
information owners/information system owners, and other senior leaders in accordance with
organizational policy/procedures.
Security Control Assessor. The security control assessor provides input into the types of security-
related information gathered as part of ISCM and assesses information system or program
management security controls for the organization's ISCM program. The security control assessor
develops a security assessment plan for each security control; submits the security assessment
plan for approval prior to conducting assessments; conducts assessments of security controls as
defined in the security assessment plan; updates the security assessment report as changes occur
during ISCM; and updates/revises the security assessment plan as needed.
Organizations may define other roles (e.g., information system administrator, ISCM program
manager) as needed to support the ISCM process.
23 Organizations may have multiple common control providers.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
CHAPTER THREE > Continuous Monitoring

Continuous Monitoring

maximizes efficiencies and leveragability of security-related data. As changes occur, the ISCM
strategy is reviewed for relevance, accuracy in reflecting organizational risk tolerances,
correctness of measurements, and applicability of metrics. An inherent part of any ISCM strategy
is the inclusion of criteria describing the conditions that trigger a review or update of the strategy,
in addition to the preestablished frequency audit. Likewise, the organization defines criteria and
procedures for updating the ISCM program based on the revised ISCM strategy.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1 TECHNOLOGIES FOR DATA GATHERING

D.1 TECHNOLOGIES FOR DATA GATHERING

Data gathering technologies are those that provide the capability to observe, detect, prevent, or
log known security threats and vulnerabilities, and/or remediate or manage various aspects of
security controls implemented to address those threats and vulnerabilities. These technologies are
primarily implemented at the information systems level (Tier 3). However, they can be
configured to support an organization's ongoing security monitoring needs up through
mission/business processes and information security governance metrics. Implementing a tool
across an organization allows systems within that organization to inherit and leverage said
capability.
A security automation domain is an information security area that includes a grouping of tools,
technologies, and data. Data within the domains is captured, correlated, analyzed, and reported to
present the security status of the organization that is represented by the domains monitored.
Security automation provides standardized specifications that enable the interoperability and flow
of data between these domains. Monitoring capabilities are achieved through the use of a variety
of tools and techniques. The granularity of the information collected is determined by the
organization, based on its monitoring objectives and the capability of the enterprise architecture
to support such activities.
45 Examples of such controls that lend themselves to full or partial automation through security engineering or the
use of proprietary/third party software and log management tools include account management, security training
records, incident reporting, and physical access control.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.1 VULNERABILITY AND PATCH MANAGEMENT

APPENDIX D

PAGE D-4
Figure D-1. Security Automation Domains

D.1.1 VULNERABILITY AND PATCH MANAGEMENT

A vulnerability is a software flaw that introduces a potential security exposure. The number of
vulnerabilities discovered and patches developed to address those vulnerabilities continues to
grow, making manual patching of systems and system components an increasingly difficult task.
To the extent possible, organizations should identify, report, and remediate vulnerabilities in a
coordinated, organization-wide manner using automated vulnerability and patch management
tools and technologies.
Vulnerability scanners are commonly used in organizations to identify known vulnerabilities on
hosts and networks and on commonly used operating systems and applications. These scanning
tools can proactively identify vulnerabilities, provide a fast and easy way to measure exposure,
identify out-of-date software versions, validate compliance with an organizational security policy,
and generate alerts and reports about identified vulnerabilities.
Patch management tools scan for vulnerabilities on systems and system components participating
in an organization's patching solution, provide information regarding needed patches and other
software updates on affected devices, and allow an administrator to decide on the patching
implementation process. Patch management tools and utilities are available from various vendors
to assist in the automated identification, distribution, and reporting of software patches. It is
critical to understand the impact of patches before applying and to deploy them within the context
of a defined patch management policy, providing assurance that systems will not lose critical
functionality due to an unintended side effect of a patch. In some cases where a patch cannot be
deployed, other compensating security controls may be necessary.
The implementation and effective use of vulnerability assessment and patch management
technologies46
46 For more information, please refer to NIST SP 800-40, as amended, Creating a Patch and Vulnerability
can assist organizations in automating the implementation, assessment, and
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.3 MALWARE DETECTION

D.1.3 MALWARE DETECTION

Malware detection49
Malware detection mechanisms can be configured to perform periodic scans of information
systems, as well as real-time scans of files from external sources as the files are downloaded,
opened, or executed in accordance with organizational security policy. Malware detection
mechanisms can frequently take a predetermined action in response to malicious code detection.
provides the ability to identify and report on the presence of viruses, Trojan
horses, spyware, or other malicious code on or destined for a target system. Organizations
typically employ malware detection mechanisms at information system entry and exit points (e.g.,
firewalls, email servers, Web servers, proxy servers, remote access servers) and at endpoint
devices (e.g., workstations, servers, mobile computing devices) on the network to detect and
remove malicious code transported by electronic mail, electronic mail attachments, Web accesses,
removable media or other means, or inserted through the exploitation of information system
vulnerabilities.
48 For more information, please refer to NIST SP 800-94, as amended, Guide to Intrusion Detection and Prevention
Systems (IDPS).
49 For more information, please refer to NIST SP 800-83, as amended, Guide to Malware Incident Prevention and
Handling.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.4 ASSET MANAGEMENT

D.1.4 ASSET MANAGEMENT

Asset management tools help maintain inventory of software and hardware within the
organization. This can be accomplished via a combination of system configuration, network
management, and license management tools, or with a special-purpose tool. Asset management
software tracks the life cycle of an organization's assets and provides tools such as remote
management of assets and various automated management functions.
The implementation and effective use of asset management technologies can assist organizations
in automating the implementation, assessment, and continuous monitoring of several NIST SP
800-53 security controls including CA-7, Continuous Monitoring; CM-2, Baseline Configuration;
CM-3, Configuration Change Control; CM-4, Security Impact Analysis; CM-8, Information
System Component Inventory; and SA-10, Developer Configuration Management.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX D > D.1.5 CONFIGURATION MANAGEMENT

D.1.5 CONFIGURATION MANAGEMENT

Configuration management tools allow administrators to configure settings, monitor changes to
settings, collect setting status, and restore settings as needed. Managing the numerous
configurations found within information systems and network components has become almost
impossible using manual methods. Automated solutions may lower the cost of configuration
management efforts while enhancing efficiency and improving reliability.
System configuration scanning tools provide the automated capability to audit and assess a target
system to determine its compliance with a defined secure baseline configuration. A user may
confirm compliance with, and identify deviations from, checklists appropriate for relevant
operating systems and/or applications.
If an information system or system component is unknowingly out of synchronization with the
approved secure configurations as defined by the organization's baseline configurations and the
System Security Plan, organization officials and system owners may have a false sense of
security. An opportunity to take actions that would otherwise limit vulnerabilities and help protect
the organization from attack would subsequently be missed. Monitoring activities offer the
organization better visibility into the state of security for its information systems, as defined by
the security metrics being monitored.