When you contemplate intelligent monitoring of security controls,
it's good to introduce ourselves to a standard out there from the
NIST Special Publications 800‑137 world called Information Security
Continuous Monitoring. Here we are focusing on the capability of a
continuous improvement process.
That means that your strategy for information security monitoring
should be grounded in the organizational risk tolerance and helps the
officials in the organization set priorities and manage risk
consistently throughout the organization.
If it's not being measured,
it most likely means it's not being managed effectively.
So metrics that provide meaningful indication of security status at all
organizational tiers is part of ISCM. Ensuring continued effectiveness of the
security controls is both an objective and also a motivation for being involved
in Information System Security Monitoring. Verifying that you are a compliant
is part of the monitoring process,
not just with some given policy or some given guideline,
but also aligning yourself to a greater degree at a mission
in a business function level.
The ISCM strategy says that it's going to create an environment that's
very transparent, so the measurability of what's going on with the
controls that you're monitoring should actually be publishable
internally to all levels of the organization.
You also need to make sure that anything that happens inside of your
monitoring world that represents a modification or a change goes
through the proper change management that was discussed in the
previous clips of the last module.
It also means that as you are carrying out your ISCM that you have
a continuous awareness of threats and vulnerabilities that are
evident in the operations of your world.
Next,
let's look at one of the items of monitoring that
includes log capture and analysis.