Loading...
Organizations are constantly subject to threat and breach of their information security from outside sources, such as malware, hacking, spear phishing, cyber threats, etc. As well, one of their greatest threats actually comes from inside sources: the employees themselves! The damage that a disgruntled employee can inflict can become extremely costly for an organization. In order to defend an IT infrastructure against security threats, organizations need real-time security intelligence, the ability to detect and mitigate attacks, and respond rapidly to incidents.
What is continuous monitoring?
Continuous monitoring is a process by which online/real time systems are used to manage on a real-time basis the performance of corporate processes. IT managers face a number of challenging tasks to complete the transition to a continuous monitoring security approach. In order to implement continuous monitoring, IT managers must create the risk management governance structure which aligns with a continuous monitoring plan. As well, they must priorities what assets are necessary to monitor, and what assets are unnecessary, what parameters and metrics are necessary to collect and what is the ultimate goal and purpose of implementing continuous monitoring as it relates to the overall goals of the organization. What makes continuous monitoring an important activity for an organization is that it assesses the security impacts on an information system resulting from planned and unplanned changes to the hardware, software, firmware or environment of operation, as well as threats.
This allows high-level managers to make risk-based decisions regarding the IT infrastructure based on:
- Automation control strategy
- Establish measures and metrics for continuous monitoring and collection/use of data
- Analyze security-related information and report findings
- Respond with mitigation actions and rules (reject/avoid. Transfer or accept risk)
- Review and update monitoring strategy and monitoring program on on-going basis.
Ideally, there are five different categories of elements which a company should consider including in the continuous monitoring program. These include, but are not limited to: software assets, computing assets, connectivity assets, vulnerabilities and cyber threats. Typical technologies that are used to implement a continuous monitoring program include security engineering and direct data gathering, aggregation and analysis and automation and data sources, such as Security Content Automation Protocol (SCAP).
What can continuous monitoring do for you?
The possibilities are limitless with real-time monitoring! There is a number of industries who make use of real-time continuous monitoring as part of their infrastructure programs, as the benefits to be reaped outweigh the investment, such as reduction of human-led error, increased security and maintenance, and the ability to give high-level managers transparency through the organization and the ability to make risk-based decisions. Some different examples of how continuous monitoring is already being implemented include:
- Real-time continuous monitoring of Rail system controls to ensure maximum safety and minimum human-led error.
- Real-time continuous monitoring of water systems to minimize pollution.
- Real-time continuous monitoring of auditing systems to minimize financial risk and compliancy.
- Real-time continuous monitoring of security infrastructures to maximize defense against cyber threats.
- Real-time continuous monitoring of engineering maintenance cycles for machinery to insure up-to-date and consistent maintenance and safety.
- Real-time continuous monitoring of Home Security to protect against outside threats.
Is real-time continuous monitoring a good fit for my organization?
Certainly there are many benefits to advice for implementing real-time continuous monitoring. If you are in an industry that makes use of IT, engineering or machinery, real-time continuous monitoring is definitely worth looking into. However, that being said, it must be mentioned that a real-time continuous monitoring program is only advantageous if you know exactly what to monitor, what risk and controls you want to implement and what you plan to do with the data. Collecting data just for the sole purpose of collecting data is a worthless exercise and a timewasting activity. Catching risks and issues in time, is a result of good risk-management, proactive data collection, proper protocols and controls, and an intelligent real-time continuous monitoring program.
