Continuous monitoring is improving cybersecurity, but not without challenges
By
Frank Konkel
Federal networks produce an astounding amount of data. Agencies are now trying to figure out how much of it to save, and for how long.
Continuous monitoring sounds like a simple solution to combat cyber-intruders.
In theory -- and with unlimited technological capabilities, funding and human talent -- it is. All an agency must do is configure its networks and applications to automatically report in real-time all their connections and other various bytes of machine-generated data to logs for analysis, continuously compute these connections and wait for the signals of bad actors to show up in the noise.
In practice, where real budgetary and technological constraints raise their heads, agencies have made strides in implementing technologies that allow for continuous monitoring, but face significant challenges in doing so. This is especially true at the agency level, where networks produce an astounding amount of data and log files grow exponentially in size.
At that level, cybersecurity becomes "a big data issue," according to Rod Turk, chief information security officer for the Commerce Department. Turk, speaking during a March 5 cybersecurity webinar hosted by Federal News Radio, said gleaning insights from increasingly large log files is not easy.
"Finding a needle in the haystack of all the data or systems you may have is a difficult proposition," Turk said. "Also, being able to identify it and then being able to do something about it. Malicious activities morph quickly."
As part of its continuous monitoring efforts, Commerce is looking at implementing a "kill-chain methodology," whereby the department implements a combination of tools within a system to examine the lifecycle of entities with malicious intent – how an adversary gets in and traverses a system, exfiltrates data and then leaves. Security improves as patterns are recognized. Yet an agency as large as the Commerce Department, with tens of thousands of active end-users at any given time, faces data-storage concerns. Most agencies that come to rely on continuous monitoring will face the same challenge: How long should data be stored?
"As we get better and better at [analysis], we will probably keep less data," said Frank Konieczny, chief technology officer for the Air Force.
Konieczny said the Air Force keeps most traffic data for three months or less, although he hinted that some records – likely tied to potential breach attacks – could be kept for much longer.
The military is on the forefront of continuous monitoring technologies, and Konieczny sees the next advances in intrusion detection systems coming through the addition of a layer of defense at the application level. The Air Force wants to one-up collecting network data and tag all the applications used within its systems. Such a system would compare what ports a given application is supposed to use and compare that to the application's actual flow traffic.
Tagging applications works even through virtual machines, but the log files build up a lot faster because of the multitude of additional connections that are made. Storage space, even for the military, can be an issue, Konieczny said, but he added that filtering can reduce the data deluge.
The Air Force is developing an offline analytical cloud with the Defense Information Systems Agency that will be charged with receiving and processing all this transaction data. At some point in the near future, Konieczny hopes that when suspicious activity is detected, the Air Force can send out alerts at the regional level.
Despite the rapid evolution of technology, Turk said agencies should think about cyber-security first from a basic human and tech perspective. Commerce trains its employees to avoid common phishing scams and other attempts to introduce malware to their systems. These scams are increasingly difficult to detect, with scammers able to near-perfectly replicate an email from a high-level agency official.
In addition, Turk said, Commerce "keeps control of its patch levels closely." It also keeps careful tabs on its computer inventory, as any device connected to the network is a potential gateway into that system. Through its monitoring efforts, Commerce takes a snapshot of near real-time activity every "three to four hours" regarding a few sets of controls, but Turk said it wouldn't matter much if the agency did not nail down the basics first.
"You can't secure what you don't know you have," Turk said. "It only takes one instance, one infiltration, to ruin your day."
Note: This article was updated on March 6 to clarify and link to the webinar in question.