Page 20 - GCN, Oct/Nov 2017

CYBERSECURITY
SPONSORED CONTENT
EXPERIENCE THE MANY BENEFITS OF
MANAGING COMPLIANCE
Agencies can ensure tigGOVERNMENT AGENCIES FACE daunting challenges to maintain
hter compliance by automating data management tasks.
KEVIN DAVIS
VICE PRESIDENT OF PUBLIC SECTOR, SPLUNK
compliance with policies, regulations and laws that govern data protection, cybersecurity and a host of other
mandates. The barriers to compliance are compounded by the geographically dispersed operations, complex IT environments and advanced cyberdefense programs managed by most agencies.
To overcome these hurdles and keep up with evolving standards, audit requirements and mission priorities, government professionals must have practical, manageable ways to continuously evaluate their compliance programs and security controls. They need to know what’s happening across their enterprise systems in real-time.
The key to this kind of situational awareness is the ability to aggregate and analyze all agency data, regardless of its location or source. Whether collected in the cloud, accessed on mobile devices or resident in legacy systems, data must be available to support an effective, informed and timely decision-making process.
This level of visibility into ongoing enterprise activity is the single-most empowering way for public sector managers to understand if their agency is meeting its mission and compliance objectives. It also provides a data-driven analytics approach to determine corrective actions when necessary. Not only is enterprise- level assessment an essential cornerstone of an effective compliance program, it also facilitates optimized IT operations and risk management.
How can agencies best leverage and exploit their data assets? Relying on an automated approach that helps manage data collection
and visualization across whatever systems and technologies they are using is the most effective way. By deploying an automated solution, public sector professionals can collect, analyze and report on the volumes of data.
An effective compliance program—for cybersecurity monitoring, defense of Personally Identifiable Information (PII) or data and
asset tracking—must be flexible, scalable and extensible. It should operate in real-time and
be data source agnostic, centrally managed
and federated to enable organization-wide use through role-based access control.
Why implement an automated compliance monitoring system? The main benefits are removing the tedium of manual and ad hoc data collection processes; liberating staff from time- consuming and error-plagued ventures by cutting across operational silos and automating data collection, aggregation and correlation. Reliance on automation can overcome the traditional challenges of ingesting and normalizing data by eliminating the need to fit incoming data into predefined schemas.
Once data is collected in an automated solution, it can be used to address multiple compliance mandates and emerging IT and security initiatives. For example, it can be adapted to monitor specialized compliance requirements such as those mandated in the Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry (PCI) standards, Criminal Justice Information Services (CJIS) system and others.
Whether agency professionals need to follow the guidance in the NIST Risk Management Framework (RMF) or other important mandates, the tangible benefits of monitoring and understanding the comprehensive and current state of enterprise systems and networks is undeniable. The ever-expanding universe of machine information being generated makes automation the only feasible strategy to meet the demands for continuous monitoring and compliance—today and tomorrow.
Kevin Davis is vice president of public sector at Splunk.
S-20