Continuous monitoring puts the emphasis on risk, not compliance

The Federal Information Security Management Act of 2002 created the process of assessing and securing federal information systems, and managing overall security risk. FISMA focused a great deal of attention on federal information security and succeeded, to some degree, in enabling resources to address system weaknesses. However, the reporting process under FISMA created onerous documentation requirements, resulting in compliance-driven paperwork exercises that many argue took the focus away from ensuring more effective security-driven initiatives.

Editor’s Note: This article was prepared collaboratively by members of the International Information Systems Security Certification Consortium's Government Advisory Board Executive Writers Bureau. The bureau includes federal IT security experts from government and industry. A full list of bureau members is available at www.isc2.org/ewb-usgov. 

Many have questioned what the FISMA process truly measures. In his testimony on June 7, 2007, before the House Committee on Oversight and Government Reform, Gregory Wilshusen, director of information security issues for the Government Accountability Office, stated that federal agencies are measuring performance rather than effectiveness, which causes agencies to delude themselves into a false sense of security. For example, when federal agencies measure the percentage of employees who have taken and completed an annual awareness refresher course, many agencies report 100 percent compliance. However, there is no measurement of the content, quality and effectiveness of that training. It only measures a count, not an outcome.

Another example of how agencies are measuring performance over effectiveness is FISMA’s requirement to certify and accredit information systems. Most agencies focus on completing the paper-driven exercise of performing certification and accreditation (C&A), when their emphasis should be on continuous identification and control over risks to ensure that appropriate security controls are employed and functioning. While an agency may have certified and accredited all of its systems as required, none of the systems may actually be secure.

New reporting process

Fortunately, the current FISMA legislation is undergoing a major revision under a new bill, the Information and Communications Enhancement (ICE) Act of 2009, also referred to as S.921. Specifically, the language of the bill will “recognize the interconnected nature of the Internet and agency networks, improve situational awareness of government cyberspace, enhance information security of the federal government, unify policies, procedures, and guidelines for securing information systems and national security systems, establish security standards for government purchased products and services, and for other purposes.” The final bill will incorporate the relevant features of other pieces of legislation introduced earlier this year, such as the Rockefeller-Snowe bill, and will thus become a consolidated bill with the backing of the entire Senate. The Senate anticipates final passage of this legislation during the summer of 2009.

At the same time, the White House Office of Management and Budget is setting into motion new security reporting requirements for agencies. Annual FISMA reporting requirements established by OMB are used by agencies not only to demonstrate compliance, but also to serve as the basis for budget formulation. There is every reason to believe that the new reporting requirements, under the supervision of the federal chief information officer, Vivek Kundra, will emphasize measures of effectiveness and continuous monitoring.

In his recent testimony to the House Committee on Oversight and Government Reform, Kundra was emphatic in acknowledging the critical importance of monitoring activities, people and programs on an on-going basis rather than continuing the static, paper-based approach from the past. It is likely that updated reporting guidance will incorporate emerging initiatives designed to measure effectiveness, such as the Consensus Audit Guidelines, which include 20 security controls that are relevant and meaningful for all federal information systems.

Arguably, FISMA reporting requirements have been more of an issue than the FISMA legislation itself, since agencies geared their information security programs to align with the annual reporting requirements. Improvements in both the legislation and the reporting requirements will be important in enabling the new world of federal information security.

More changes

Under the new legislation, chief information security officers will become more involved with the security programs and operations of the subordinate operating units and bureaus, which is a different model than espoused by many departments and agencies today. The ICE bill will thus require federal CISOs to meet program management, governance, training, oversight, and independent verification and validation challenges. Continuous monitoring of management, operational and technical controls will also be addressed under the new legislation.

The new legislation suggests several other powerful changes that will have a significant impact on how agencies secure federal systems. First, it will require agencies to buy products with security built-in rather than trying to add security components after the fact. This principle was proven with the Air Force's decision to purchase securely configured computers that resulted in a 30 percent reduction in overall hardware purchase costs.

Second, the new legislation will require attack-based metrics, making agencies demonstrate that their systems are effectively protected against known vulnerabilities, attacks and exploitations. The term, “attack-based metrics” means learning offensive strategies and using that knowledge to develop the defense.

Finally, the new legislation will require agencies to reach governmentwide agreement on identifying the attack-based metrics by establishing a baseline of information security measures and controls that can then be continuously monitored through automated mechanisms. The continuous monitoring requirement replaces the current C&A requirement under FISMA.

Conclusion

The move to continuous monitoring is not being driven entirely by new legislation and new reporting requirements. The National Institute of Standards and Technology recently advocated a move toward continuous monitoring, along with a corresponding de-emphasis on recertification of systems every three years. Although NIST’s definition of continuous monitoring might vary from how the new FISMA legislation defines the term, the shift in focus is still moving in the right direction. Now, the challenge will be for agencies to establish a disciplined approach to assessing information risks, and implementing tools and processes that address these risks through continuous monitoring.