5.5: Implement Automated Configuration Monitoring Systems

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalog approved exceptions, and alert when unauthorized changes occur.

Asset Type

Security Function

Implementation Groups

Applications

Detect

2, 3

Dependencies

  • Sub-control 1.4: Maintain Detailed Asset Inventory

  • Sub-control 2.4: Track Software Inventory Information

  • Sub-control 5.1: Establish Secure Configurations

Inputs

  1. The organization’s configuration monitoring system

  2. The list (maintained by NIST) of SCAP-validated tools

  3. The list of endpoints

  4. The inventory and mappings of secure configuration policy(ies) to the list of endpoints

  5. The list of approved exceptions, mapped to the endpoints on which they are approved (i.e. some endpoints may be excepting certain configurations, but others under the same configuration policy may not).

  6. The organization’s approved configuration scanning interval (at least weekly)

Operations

  1. (Manual) Ensure the configuration scanning tool (Input 1) is present in the list of SCAP-validated tools (Input 2).

  2. For each endpoint, obtain the configuration assessment results using Input 1

  3. For each assessment result in Operation 2, obtain the list of recommendations which map to the catalog of approved exceptions for that endpoint.

  4. Following the time period specified by Input 6, re-assess to obtain a comparative assessment result

Measures

  • M1 = 1 if Operation 1 indicates the organization’s scanning tool is present in the list of SCAP-validated tools; 0 otherwise

  • M2 = (For each endpoint) The number of non-compliant recommendations resulting from Operation 2

  • M3 = (For each endpoint) The number of non-compliant recommendations that do not map to the catalog of approved exceptions for the endpoint

  • M4 = (For each endpoint) The number of non-compliant recommendations resulting from Operation 4

  • M5 = (For each endpoint) The number of non-compliant recommendations that do not map to the catalog of approved exceptions for the endpoint

  • M6 = (For each endpoint) The number of recommendations assessed

  • M7 = (For each endpoint) The number of approved configuration policy exceptions

  • M8 = The number of the organization’s SCAP-validated tools

  • M9 = The number of the organization’s configuration management tools

Metrics

Tooling Compliance

Metric
Are SCAP-validated configuration scanning tool(s) being used?

Calculation

M1 == 1

Tooling Compliance Coverage

Metric
The ratio of SCAP-validated tools to the total number of configuration management tools

Calculation

M8 / M9

Initial Non-Compliance (Per Endpoint)

Metric
Per endpoint, the ratio of non-compliant recommendations to the total recommendations
assessed.

Calculation

M2 / M6

Initial Exception Coverage (Per Endpoint)

Metric
Per endpoint, the ratio of non-compliant recommendations with approved exceptions, to
the total recommendations assessed.

Calculation

(M7 - M3) / M7

Subsequent Non-Compliance (Per Endpoint)

Metric
Per endpoint, the ratio of non-compliant recommendations to the total recommendations
assessed.

Calculation

M4 / M6

Subsequent Exception Coverage (Per Endpoint)

Metric
Per endpoint, the ratio of non-compliant recommendations with approved exceptions, to
the total recommendations assessed.

Calculation

(M7 - M5) / M7