From: GCN
By William Jackson
Managing risk in a network requires knowing your assets and prioritizing defenses, says the National Institute of Standards and Technology’s Ron Ross. Complexity is the enemy, and moving to the cloud can help simplify.
“You can reduce the complexity of your infrastructure by 5 to 40 percent by moving to the public cloud,” said Ross. “Without reducing that complexity, we’re going to be doing what technicians call thrashing — a lot of activity with few results.”
Ross, who is NIST’s Federal Information Security Management Act implementation lead, made his comments in a discussion on risk management at last month’s RSA Conference in San Francisco. The potential security benefits of the cloud included not only off-loading assets and processes, but also the opportunity to automate the task of monitoring IT systems. Meeting requirements for continuous monitoring of government systems cannot be done manually, said John Streufert, director of network resilience at the Homeland Security Department.
“Use computers for what can be automated,” freeing up humans for those things that can’t, Streufert said.
With that in mind, DHS is planning to offer continuous monitoring for agencies as a vendor service. The offering is intended to improve automation, ensure consistency and take advantage of the economies of scale in a government-wide service hosted by a service provider.
DHS issued a request for quotes in December under its Continuous Diagnostics and Mitigation program, also known as Continuous Monitoring as a Service. It is seeking a blanket purchase agreement from a contractor under the General Services Administration’s Schedule 70, which includes a wide variety of IT products and services, including cloud services and security services. The BPA would have a base period of one year with four one-year options, with an expected value of $6 billion over all five years. It would include sensors for monitoring and a central dashboard for authorizing changes and fixes, as well as consulting services.
The agreement would include hardware and software asset management capabilities, configuration and vulnerability management, management of access controls and identity management, monitoring of user activity, as well as incident planning and response. Although it is intended for use primarily for civilian .gov networks, DHS also expects it also will be used by Defense Department networks in the .mil domain.
Leave a Reply