Continuous Monitoring - Telos

More documents

Recommendations

Info

Continuous MonitoringBest-of-breed Approaches and Technologies For Continuous MonitoringTelos adheres to established IT security processes and frameworks to ensure the continuous monitoringand management of security postures. Our services and solutions reflect the recommendations of theNIST Risk Management Framework; the Continuous Asset Evaluation, Situational Awareness, and RiskScoring (CAESARS) model for continuous asset evaluation and risk scoring; the emerging FedRAMPrequirements for assessing and authorizing cloud computing services and products and others.NIST Risk Management FrameworkThe NIST Risk Management Framework (RMF) laid out inSP 800-37 provides a structured approach to managing riskthroughout a system’s life cycle. It identifies the elementsessential to a successful organization-wide continuousmonitoring program, including:• Configuration management and change control• Security impact analyses• (Ongoing) assessment of system security controls• Security status monitoring and reporting• Active involvement of organizational officials in the ongoingmanagement of information system security-related risksThe sixth and final step of the RMF calls for themonitoring of security controls by determining thesecurity impact of system changes, assessing a system’ssecurity controls in accordance with defined strategies,conducting remediation actions when indicated, updatingsecurity plans based on the results of continuousmonitoring, and reporting and reviewing security status.The RMF also operates at Tier 3 (system level) of NISTSP 800-39 as well as interacting with Tier 1 (governancelevel) and Tier 2 (process level) by providing feedbackfrom authorization decisions to the risk executive functionand disseminating updated risk information to authorizingofficials, common control providers, and informationsystem owners.CAESARS: Risk Scoring Best PracticesThe DHS Federal Network Security Branch issued theCAESARS detailed reference architecture that offersbest-practices and an integrated approach with end-toendprocesses for:• Assessing the state of each IT asset under an organization’smanagement• Determining the gaps between the current state andaccepted security baselines• Expressing in quantitative measures the relative risk of eachgap or deviation• Providing letter grades that reflect the aggregate risk of sitesand systems• Ensuring that the responsibility for every system and site isassigned• Providing targeted information for security and systemmanagers to use in taking the actions necessary to makechanges needed to reduce risk• Inspiring and encouraging competition among agencymanagers through measured and recognized improvementTelos integrates new frameworks and standards intoour work as they are available, tailoring each one to ourcustomer’s specific circumstances.Federal Risk and Authorization Management Program (FedRAMP)FedRAMP is designed to establish a unified risk management framework for cloud computing. This emergingstandard set of controls and defined processes will result in cost savings and help to eliminate the discrepanciesamong agencies authorization processes by:• Providing a framework that is compatible with FISMA security requirements and has been vetted by various governmentagencies and industry• Offering effective and consistent assessment of cloud services• Focusing continuous monitoring on near real time data feeds from cloud service providers• Using the “approve once, use many” conceptTelos integrates new frameworks and standards into our work as they are available, tailoring each one to ourcustomer’s specific circumstances.
Xacta automation tools to streamline processes for continuous monitoring.Human judgment is essential in sound cybersecurity assessment and monitoring. But automation toolscan also streamline processes and help eliminate errors and oversights. As NIST SP 800-137 suggests,“Real‐time monitoring of implemented technical controls using automated tools can provide anorganization with a much more dynamic view of the security state of those controls.”Telos began automating security-related tasks through its Xacta IA Manager enterprise software offeringover a decade ago and continues to support continuous monitoring and related activities withautomation capabilities wherever they improve accuracy and efficiency.®Xacta IA Manager: Take control of your risk andcompliance posture for continuous monitoringand security risk assessment.Xacta IA Manager offers continuous assessment capabilities thatenable organizations to track the security state of a wide rangeof information systems on an ongoing basis and maintain thesecurity authorization for the systems over time. Its elementswork together to provide CISOs and other senior leaders with adynamic view into the current status of security controls.Xacta Continuous Assessment automatically detects changesto the IT environment so you always have situation awarenessof potential risks and threats. Its automatic vulnerability updateservice delivers the right guidance at the right time about whatactions to take in response to potential threats.Its tightly integrated, complementary components include:Xacta Asset Manager: Organize your IT asset data asactionable information. Xacta Asset Manager is the centralrepository for asset and configuration management information.It automatically imports asset data from systems and enterprisemanagement platforms and offers a central repository to organizeyour IT asset data as actionable information.Telos: A deep legacy inContinuous MonitoringTelos Corporation has been an advocateof continuous assessment, monitoring,and enforcement for more than adecade. We first conceived of continuousassessment in 1999 as part of our longtermstrategy to make the C&A processmore meaningful — less about documentationand paperwork drills, moreabout understanding risk posture on anongoing, continuous basis.Telos introduced its patented continuousassessment functionality in Xacta IAManager in February 2003. Today ourcybersecurity personnel continue tomonitor and protect some of the largestnetworks in the world and continuallyenhance the capabilities of Xacta IAManager for today’s continuousmonitoring requirements.
Page 2 and 3: Continuous MonitoringContinuous mon
Page 6 and 7: Continuous MonitoringXacta Detect:
Page 8: Advanced technology solutionsthat p

Continuous Monitoring - Telos

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?