Just Getting Started

Federal agencies still have a long way to go in implementing continuous monitoring. Only 29% of agencies have the tools in place to continuously monitor their IT systems in a meaningful way, an Office of Management and Budget report in March found.

Most agencies are still in the information-gathering stage of continuous monitoring programs, says Mike Yaffe, product marketing manager for Core Security Technologies.

Slow adoption is to be expected, considering where agencies are coming from, says Mike Lloyd, chief scientist for RedSeal Systems. Most "don't even know how many hosts are on the network," he says. Half of agencies have only limited visibility of their networks, and another quarter have better knowledge of what's happening in their environments, but are still overwhelmed by all of their data feeds, due to insufficient automation.

Only about a quarter of agencies have the kind of visibility and automatic number crunching necessary to break down security data into a continuous and comprehensible metric that can effect meaningful change in the organization, Lloyd says.