Subject: [sacm] Perception of the term "Monitoring"

From: [email-masked]
Date: Wed, 29 Aug 2012 07:01:27 -0500 (CDT)

Hello all

After David Solin’s Google query about the term monitoring, it occurred to me to run a couple of academic queries on my university’s research database.

A large number of hits associate monitoring with employee monitoring, ethical monitoring, telephone-use employee monitoring, performance monitoring, computer behavior monitoring, etc.

Perhaps it is not a bad idea to dissociate the SACM effort from the perceived impression that we are building tools for a “Big Brother” kind of society.

David Oliva

On 08/27/12, David Solin<[email-masked]> wrote:

My reason for not piping up earlier is that I don't personally care.  It's a rose by any other name, right?  The name doesn't offend me.  But clearly the name is causing indigestion.  I believe that the reason is what I have described -- that companies selling billions of dollars of products, and analysts from which customers who buy those products seek guidance, have together trained the marketplace to respond to certain keywords in certain ways.

In our case, I think it's the gerund (verb functioning as a noun) -- monitoring -- that is causing angst.  When people hear the word monitoring they have been conditioned to expect to see a solution that processes certain types of events.  Then adjective continuous takes on a real-time connotation, that has little to do with SCAP.

I believe that what SCAP standards address is the compliance market, because the standards let you make assertions about the configuration state of an environment.  So I would make compliance our noun.  The adjective we pick is just additional branding.  Do we want to be pigeon-holed into security?  If so, we could call it security compliance.  Do we want it to seem timely and all-encompassing?  Then we should keep the adjective continuous.

Google "continuous monitoring" (~7 million results), and you'll see why people who have spent a long time working with the US government think it's a good fit for what we're talking about.

Google "continuous compliance" (~48 million results), and you'll see why people who have spent a long time working with commercial enterprise software think it's a good fit for what we're talking about.  You'll also notice a lot of the same links from the first list.

And that's why I think "continuous compliance" is a better fit.  It also has the benefit of being in current use by vendors and analysts, and so the marketplace wouldn't need to be trained to understand it.

However, Kathleen's suggestion of compliance monitoring is also quite descriptive, and I believe differentiates itself sufficiently from the unadorned word "monitoring" that it could also probably work just fine.

Regards.
--David Solin

On 8/27/2012 12:45 PM, Moriarty, Kathleen wrote:

Would Compliance Monitoring work?

Thanks,

Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of Dorian Cougias
Sent: Monday, August 27, 2012 1:35 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [sacm] Continuous Compliance in lieu of Continuous Monitoring

I don't think the controversy is over monitoring, I think the controversy is over "continuous".

So whether to call it monitoring or compliance isn't the case.

Dorian J. Cougias

Compliance Scientist

Unified Compliance Framework

---- On Sun, 26 Aug 2012 11:54:27 -0700 <[email-masked]> wrote ----

To all:

I have followed the discussion about the "continuous monitoring" term and am surprised about the amount of controversy is has caused.

Perhaps replacing it with  the expression "Contiinuous Compliance" does not generate as much debate.

David Oliva

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

_______________________________________________sacm mailing [email-masked]://www.ietf.org/mailman/listinfo/sacm

--

jOVAL.org: OVAL implemented in Java.
Scan any machine from any machine. For free!
Learn More | Features | Download

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Adam Montville <[email-masked]>
Date: Wed, 29 Aug 2012 12:08:10 +0000

Responding on vacation - copying a personal address for off-thread
contact, if needed.

Remaining comments inline.

On 8/29/12 5:01 AM, "[email-masked]" <[email-masked]>
wrote:

> 
> 
> 
>
>A large number of hits associate monitoring with employee monitoring,
>ethical monitoring, telephone-use employee monitoring, performance
>monitoring, computer behavior monitoring,
> etc.
>Perhaps it is not a bad idea to dissociate the SACM effort from the
>perceived impression that we are building tools for a ³Big Brother² kind
>of society.

Thanks for the additional insight, David - I think it bolsters the case
nicely.

>Google "continuous monitoring" (~7 million results), and you'll see why
>people who have spent a long time working with the US government think
>it's a good fit for what we're talking about.
>
>Google "continuous compliance" (~48 million results), and you'll see why
>people who have spent a long time working with commercial enterprise
>software think it's a good fit for what we're talking about.  You'll also
>notice a lot of the same links from the first
> list.
>
>And that's why I think "continuous compliance" is a better fit.  It also
>has the benefit of being in current use by vendors and analysts, and so
>the marketplace wouldn't need to be trained to understand it.

It's the "continuous" part that matters to the effort, not the
"monitoring" part. 

To me, it's 100% acceptable to drop the term "monitoring" in favor of a
replacement, and I would, in fact, prefer to do so.

Others?

---

From: Stephen Hanna <[email-masked]>
Date: Wed, 29 Aug 2012 08:18:58 -0400

I agree. Many users are uncomfortable with the idea of having
someone or something monitoring their *activities*, which is
what people often think when they think of monitoring.

However, there's not much problem with taking existing systems
for checking security compliance of corporate-owned devices and
moving that from periodic and occasional compliance assessments
to continuous ones. I think that's what we're talking about here.

So I think that "continuous compliance" or "continuous assessment"
would be a good terms. Let's drop the word "monitoring" altogether
since it is often misunderstood.

Thanks,

Steve

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Adam Montville
> Sent: Wednesday, August 29, 2012 8:08 AM
> To: [email-masked]; [email-masked]
> Cc: Adam W. Montville
> Subject: Re: [sacm] Perception of the term "Monitoring"
>