The Importance of Continuous Security Monitoring (CSM)

Cybercrime has escalated. Small and medium-sized businesses and associations are now prime targets for attack. Cybersecurity Ventures forecasts that global ransomware damage costs will reach $265 billion annually by 2031, with a new attack every two seconds as ransomware software matures and extortion techniques, including social engineering, are refined by bad actors.

Currently, the average cost of a cyber attack on a small or medium business is around $200,000. Consequentially, companies without a cybersecurity plan are often not able to recover, with recent data showing that 60% of SMBs fold within half a year of a cyber-attack.

It is no longer a case of “what if” when it comes to cyber-attack. Instead, it is now a matter of “when” you will be attacked. American Technology Services (ATS) is positioned to help you develop your security strategy to identify and mitigate threats your organization faces.

What is CSM?

Continuous security monitoring (CSM) is a real-time, fully managed threat intelligence approach. As exposure to cybercrime like ransomware or data hacking increases in frequency and severity, businesses need real-time visibility and the ability to act when there are indicators of compromise, misconfigured security parameters, or vulnerability in the systems infrastructure.

The National Institute of Standards and Technology (NIST) defines continuous security monitoring as “maintain ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.” Simply put, CMS is the uninterrupted monitoring of critical assets to detect and mitigate potential threats in real-time as bad actors look to exploit your systems. A good CMS system blends human detection and operations oversite with a powerful suite of tools to automate monitoring of cyber threats, vulnerabilities, and information security controls.

This juxtaposition of tools and human talent is where proper design, implementation, and continuous monitoring of the infrastructure and company networks are able to provide just-in-time data about users, devices, networks, and behavior. In addition, CSM enables a supervised environment of the organization’s systems, which helps identify intrusions and real-time threat landscape monitoring.

According to the NIST white paper, NIST SP 800-137 information security continuous monitoring (ISCM) works through:

• Creating an environment of situational awareness and maintaining it through all systems across the organization and its vendor ecosystem
• Understanding the range of threats and threat activities present in today’s cyber landscape
• Limiting access and assessing all security controls in place
• Aggregating and analyzing all security-related information (Security information and event management, otherwise known as SIEM)
• Organizational executive buy-in with active risk management protocols

There is increased importance on preventing data breaches in real-time when employee continuous security monitoring. As a general trend, the increasing frequency of digitization of sensitive data such as medical records or personally identifiable information for clients and customers puts small and medium-size businesses at risk for extortion or ransomware. Another consideration is data breach notification laws, coupled with general data protection laws, that massively impact the reputational impact of security incidents.

How does continuous security monitoring work?

The fully managed threat management system should centralize, search, and visualize the monitored company’s security data to quickly identify an attack on any device and stay ahead of new or unusual threats. The CSM team collects information with intelligent, standardized metrics, utilizes implemented security control information and automated scanning. This process of monitoring, data aggregation, and real-time analysis should be conducted regularly.

The monitoring strategy should be routinely updated to increase visibility into assets, awareness of potential risks, and should include education of company employees that act as end-users. This comprehensive approach mitigates exposure and vulnerability for the system as a whole and shifts the organization from compliance-driven risk management to data-driven risk management.

A managed security service provider (MSSP) can provide continuous security monitoring and address the security alerts so internal IT doesn’t have to provide everything necessary to detect and respond to threats.

The CMS team captures, correlates, analyzes, and archives events from anywhere there are assets, including Microsoft Azure or Amazon Web Services or in-cloud applications like Office365 and Google G Suite. A strong CMS team is comprised of top-ranking security analysts that automate and improve the detection of threats with advanced correlation. A CSM system also eliminates false positives by providing a Security Operations Center (SOC) to respond to alerts and filter out the noise.

CMS systems coverage should include:

• Cloud Apps – Office365, G Suite, and Okta
• Private Cloud – VMware and Hyper-V
• Public Cloud – Azure, AWS, and Hosted VPC Infrastructure
• Physical Infrastructure: On-Premises Servers and Machines

Cybersecurity Checklist

1. Keep your Operating Systems and devices set for automated patches and updates
2. Have an expert cybersecurity team perform a risk assessment through Vulnerability and Penetration Testing (VAPT)
3. Create a cybersecurity framework NIST- detect, protect, identify, recover, respond https://www.nist.gov/cyberframework
4. Update your antivirus frequently and automate scans for antivirus protection
5. Train staff and end-users to be on the lookout for social engineering attacks and potential cyber security breaches
6. Set up a strong password policy with frequent password changes (4 times per year) and require Multi-Factor Authentication (MFA)
7. Use automatic screen locks for computers and devices such as tablets and phones
8. Dispose of data/equipment properly and use basic cyber hygiene
9. Encrypt backup data and use a VPN to connect securely
10. Limit user and administrator access permissions for risk management
11. Outsource IT security with a Managed Security Services Provider (MSSP) to perform Continuous Security Monitoring (CSM)
12. Have a breach response plan that includes security incident response plans and disaster recovery plans
13. Utilize the FINRA Cybersecurity Checklist https://www.finra.org/compliance-tools/cybersecurity-checklist