ITM527 The Challenges in Continuous Monitoring of Information Systems Security

The Challenges in Continuous Monitoring of Information Systems Security
Name
Institutional Affiliation
The Challenges in Continuous Monitoring of Information Systems Security
Monitoring information security systems pose various challenges to an organization. According to NSIS (2011), problems with the use of the Information Security Continuous Monitoring (ISCM) sprout from the fact that organizations have many systems to patch and configure while maintaining a secure environment (11). Key challenges are experienced in implementing, operating, and management (NSIS, 2011, P.9). DHS (2011) continuous monitoring initiative the Continuous Asset Evaluation, Situational Awareness, and Risk Scoring (CAESARS) identifies various limitations in its performance (16). The limitations are also relatable to the shortcomings of the ISCM model. Collectively, the following are the main challenges in continuous monitoring of information systems security.
One of the challenges faced by the two monitoring initiatives is the absence of an interface specification. In this context, the approach does not specify the machine-level interaction with other subsystems to facilitate communication. CAESARS lack these abilities and consequently limit the capabilities of plug and play (DHS, 2011, P. 16). The ISCM allows sophisticated workflow through the model’s subsystem specifications. Despite this, the ability of this performance is dependent on the available infrastructure and the level of the company’s maturity program (NSIS, 2011, P.17).
The aspect of describing subsystem capabilities poses challenges in the CAESARS model. According to DHS (2011), the model lacks detailed specifications that are necessary to facilitate procurement activities, to enable individuals to customize it to suit their subsystem capabilities, and allow the development of validation programs (17). For the ISCM, the aspects are described at the system level (NSIS, 2011, 9). The model does not define subsystem capabilities. Rather, it recommends that system owners should consider identification of the particular parts of the system that may be deemed critical in the business (NSIS, 2011, P. 28).

References
DHS. (2011). Continuous Asset Evaluation, Situational Awareness, ...