I had the opportunity and good fortune to moderate a panel at the 2011 Symantec Government Symposium on the topic of “Continuous Monitoring… What’s Next?” The panel members included spokespersons from NSA and NIST and the CISO’s from IRS and HHS. We agreed prior to the session that the goal of the panel was to communicate to our audience of approximately 100 or so attendees what our real world experiences were in designing and deploying technologies to achieve a state of continuous monitoring. It was all going according to plan until the moment we engaged the audience and started fielding questions.
In the spirit of interacting with today’s younger Internet savvy (a.k.a. teenagers) we polled the room and learned that, out of the 100 or so people in attendance, “continuous monitoring” had a different meaning to different organizations. It was very clear we have a long way to go to deliver on the promise of continuous monitoring from a standards and tools perspective.
Our session was scheduled to run for 75 minutes. Based upon the audience questions I suspect the conversations could have gone on for hours. The good news is the authoritative sources from organizations like NSA and NIST are working more closely with industry than ever before, and there is a plan to guide us towards the promise of continuous monitoring.
I left our session with one remaining question still lingering in my mind: When will we see technology be used to continuously monitor our government systems AND demonstrate we can save substantial investment in the certification and accreditation process that is done manually today?
Ned Miller, Symantec Director of Public Sector Strategy