NIST SP 800-137

From: NIST

From August 8th:

NIST Special Publication 800-53, Revision 4 -and-
The Fundamentals of Continuous Monitoring
(NOTE:  Continuous Monitoring slides start at slide #55)
Ron Ross, NIST

Risk Management Framework – Case Studies
(NOTE: Slides are not available for this panel.)
Leo Scanlon, NARA, Moderator
Tim Ruland, Census
Pete Gouldmann, State Department
Earl Crane, Promotory Financial Group
Melinda Rogers, USDOJ
Peter Williams, BAH

Ongoing Authorization – Case Studies
Jeff Eisensmith, DHS, Moderator
Emery Csulak, DHS
Sharon Jurado, TSA
Alex Ruiz, ICE

From: BankInfoSecurity.com

A Replacement for Checklist Compliance?

By Eric Chabrow

Continuous monitoring – continuous diagnostics in the new lingo of the federal government – is getting a lot more attention these days, as it should.

The idea is that the automated scrutiny of computer networks and systems to identify vulnerabilities not only will make them safer, but it could prove to be a money saver as well.

Still, most organizations in the United States and Britain have yet to implement continuous monitoring, according to a new Ponemon Institute survey conducted for the risk management software provider Tripwire.

From: Dark Reading

CDM Program moves the nation’s networks to a more real-time approach for the combat of advanced threats

ARMONK, NY – August 14, 2013 — IBM today announced its industry leading security software and services offering will be part of the Department of Homeland Security’s (DHS) Continuous Diagnostics and Mitigation (CDM) program.

The CDM Program will provide specialized Information Technology (IT) tools and Continuous Monitoring as a Services (CMaaS) to combat cyber threats in the civilian and “.gov” networks including various network endpoints and mobile devices. The CDM Program moves the nation’s networks to a more real time approach for the combat of advanced threats from the legacy historical compliance reporting model.

From: FCW

By Mark  Rockwell

Contracts that will provide continuous monitoring capabilities for federal agencies mark an “important milestone” in combating cyberattacks against the .gov domain, according to the General Services Administration.

GSA is the Department of Homeland Security’s partner in offering Continuous Diagnostics and Mitigation and Continuous Monitoring as a Service (CMaaS) under newly unveiled blanket purchase agreements. Agency officials wrote on the new CDM webpage that the BPAs used multiple award IT Schedule 70 pricing as a benchmark to establish the initial discounts in the contracts.

From: FCW

By Mark Rockwell

More than a dozen companies will provide continuous monitoring and diagnostics capabilities for the Homeland Security Department’s recently announced blanket purchase agreement designed to bolster civilian agency cyber defenses.

DHS made the awards under a continuous-monitoring-as-a-service (CMaaS) BPA that could be worth up to $6 billion for the 17 companies that will provide hardware and software under the contract.

The agency declined comment on the announcement.

The contract shows DHS is committed to stepping up cybersecurity capabilities for civilian agencies, moving beyond Federal Information Security Management Act (FISMA) requirements, said those familiar with the effort.

From: FCW

By Amber Corrin

The Homeland Security Department went live this week with its Einstein 3 automated intrusion detection system, the latest iteration of a continuous monitoring program designed to protect government agencies from malicious cyber activities.

Einstein 3 builds on the two previous versions of the DHS-managed security service, now offering capabilities that go beyond observing network information flow and signature-based threat detection. The new form of the program works with Internet service providers to detect malicious traffic and stop it. The program additionally provides officials with key decision-making information shared among participating organizations.

From: InformationWeek/Government

Patience  Wait

CIA’s investment arm cuts deal with HyTrust, maker of virtual appliance that monitors virtualized and cloud-based environments to spot insider abuses.

The actions of Edward Snowden, the National Security Agency contract employee who has been leaking information on vast classified data-gathering programs carried out by the agency, has raised fresh questions about how to guard against risks from insiders exposing government secrets.

Agencies might take a cue from In-Q-Tel, the investment arm of the U.S. intelligence community, which said it is investing in a strategic partnership with HyTrust. The California firm offers a virtual appliance that acts as a gateway between systems administrators and their virtualized and cloud-based systems that can help identify the risk of insider abuses.