Instructor: Continuous monitoring. 2 2
Now, in every organization, we do some kind of monitoring. 3 3
Unfortunately, not all of us do continuous monitoring. 4 4
Oftentimes, an organization may take weekly measurements 5 5
or monthly measurements, 6 6
or they'll rely on assessment once a year. 7 7
That is not continuous monitoring, 8 8
that is monitoring over time, 9 9
and it's not nearly as effective. 10 10
So instead, we want to focus on doing continuous monitoring. 11 11
This is the technique of constantly evaluating 12 12
an environment for changes. 13 13
That way new risk can be more quickly detected 14 14
and business operations can be improved upon. 15 15
By doing continuous monitoring, 16 16
we are constantly looking at our systems 17 17
and figuring out exactly what they're doing 18 18
and what they're reporting to us. 19 19
Now, continuous monitoring is an ongoing effort 20 20
to obtain information that is vital in managing risk 21 21
within your organization. 22 22
It has a lot of benefits. 23 23
For instance, by doing continuous monitoring 24 24
you're going to gain more situational awareness. 25 25
You'll know what systems are in use, 26 26
what systems are having issues 27 27
and how you can act on those quicker. 28 28
Another benefit of continuous monitoring 29 29
is you have the ability to do routine audits 30 30
because you don't have to wait 31 31
for a quarterly or an annual assessment. 32 32
You can do an audit whenever you need to. 33 33
You can pull out the logs from that system. 34 34
You can generate automated logs in that system 35 35
and pull out that information 36 36
and do the audit anytime you want. 37 37
Additionally, you can have realtime analysis 38 38
by doing continuous monitoring. 39 39
By continually monitoring those systems, 40 40
you're going to be able to do that realtime analysis 41 41
and see those alerts when things happen. 42 42
Instead of looking back a week, two weeks, 43 43
a month or even six months later, 44 44
you're getting realtime analysis when things happen 45 45
and that helps minimize your risk posture too. 46 46
Now, continuous monitoring 47 47
can help transform your organization 48 48
from using reactive processes into proactive processes. 49 49
This way, you can get out ahead of these incidents 50 50
and you can figure out what's going on much more quickly. 51 51
Now, one of the things I see a lot of organizations do 52 52
with continuous monitoring that is a bad thing 53 53
is they rely way too much on metrics 54 54
and don't have the metrics properly defined. 55 55
When you're looking at metrics 56 56
and you start setting up things like a SIEM, 57 57
that can have lots of different information 58 58
being sent into it, 59 59
but it's not necessarily a continuous monitoring 60 60
if nobody's looking at that data. 61 61
So a lot of organizations will set up a dashboard. 62 62
If you're going to do that, 63 63
you need to make sure that data is being sent in 64 64
and it's being analyzed and assessed. 65 65
This way, you can create actionable metrics 66 66
that represent your risk to your organization. 67 67
Because certain metrics might be easy to collect, 68 68
but they may not actually tell you anything valuable 69 69
about the security of your network. 70 70
So you want to make sure whatever you're using 71 71
is your metrics, these are things you've thought about 72 72
and they're actually going to have benefit to your organization 73 73
because if you're collecting data just to collect data 74 74
you're really not doing continuous monitoring. 75 75
Now, an effective implementation 76 76
and maintenance of a continuous modern capability 77 77
is complex and time consuming, 78 78
and that's why a lot of people don't do it. 79 79
For instance, 80 80
if you want to have 24/7 coverage of your system, 81 81
that means you have to have people who are working 24/7 82 82
and that costs money. 83 83
And so these are things you have to think about 84 84
in your organization is do you need continuous monitoring? 85 85
And if so, how many hours a day 86 86
are you continuously going to be monitoring? 87 87
If you're only going to have people there from nine to five 88 88
that's only eight hours a day, 89 89
you're missing 16 hours a day, so you're really 90 90
not doing continuous monitoring in that case. 91 91
But if your organization determines that's okay 92 92
and you're willing to accept that risk 93 93
because of your risk appetite, 94 94
that is something you can consider. 95 95
So these are the things you have to weigh 96 96
and it's all a risk management decision. 97 97
Now, one of the things that's come 98 98
out recently from the US Department of Homeland Security 99 99
is a program known as CDM. 100 100
This stands for the Continuous Diagnostics and Mitigation. 101 101
Now, it is required by the US government 102 102
that governmental agencies adopt a program 103 103
of continuous security monitoring, 104 104
and to do that a lot of them are using CDM. 105 105
So it's important for you to understand this. 106 106
A lot of us who work in cybersecurity 107 107
do work for the government or for a government contractor 108 108
and so you may be using CDM in the real world as well. 109 109
Now, CDM is going to provide us government agencies 110 110
and departments with capabilities and tools 111 111
to identify cybersecurity risks on an ongoing basis. 112 112
They're then going to prioritize these risks 113 113
based on the potential impacts 114 114
and enable cybersecurity personnel 115 115
to mitigate the most significant problems first, 116 116
that is the whole concept of CDM. 117 117
Now, if you log in to look at CDM 118 118
normally the first thing you're going to see is a dashboard. 119 119
This dashboard is going to aggregate data 120 120
and display it in a way that is useful for people 121 121
at the agency and federal levels to make sense of. 122 122
This gives them that situational awareness 123 123
we're talking about. 124 124
Then inside of that, we have different tiers. 125 125
Underneath that we have asset management. 126 126
This helps answer the question, what is on our network? 127 127
We have to know what's on the network 128 128
so we can secure it, right? 129 129
Then inside of that, we have who is on the network? 130 130
Which is identity and access management. 131 131
Then we start thinking about 132 132
what is happening on the network? 133 133
And that's network security management. 134 134
And then finally, we start thinking 135 135
about how is our data protected? 136 136
And that is done through data protection management. 137 137
Each of these circles 138 138
is comprised of different systems and sensors 139 139
that aggregate data together 140 140
and then roll that up into this overall dashboard 141 141
so that managers, analysts and executives 142 142
can look at that information 143 143
and know the status of their networks.