Subject: [sacm] Continuous Compliance in lieu of Continuous Monitoring

From: [email-masked]
Date: Sun, 26 Aug 2012 13:54:27 -0500 (CDT)

To all:

I have followed the discussion about the "continuous monitoring" term and am surprised about the amount of controversy is has caused.

Perhaps replacing it with  the expression "Contiinuous Compliance" does not generate as much debate.

David Oliva

---

From: David Solin <[email-masked]>
Date: Sun, 26 Aug 2012 14:05:30 -0500

David, I wholly agree!  I made precisely this same recommendation to 
Dave Waltermire (NIST) in July; see my email, attached!

On 8/26/2012 1:54 PM, [email-masked] wrote:
> To all:
> I have followed the discussion about the "continuous monitoring" term 
> and am surprised about the amount of controversy is has caused.

-- 

jOVAL.org: OVAL implemented in Java.
/Scan any machine from any machine. For free!/
Learn More <http://www.joval.org> | Features 
<http://www.joval.org/features/> | Download 
<http://www.joval.org/download/>

Subject: Continuous Monitoring
From: David Solin <[email-masked]>
To: "Waltermire, David A." <[email-masked]>
Date: Wed, 11 Jul 2012 10:06:40 -0500

Hi Dave,

 From a naming perspective, I think that the use of the word 
"Monitoring" is very unfortunate, and is likely a source of a lot of the 
confusion in the community.  The word monitoring has been tied for 
decades specifically with event monitoring software solutions like HP 
Open-View, Marcury interactive, and BMC PATROL.  Analysts now use the 
word "assurance" to describe this market, but monitoring has stuck.

I think that, given all the use-cases covered by CM, a much better name 
would be something like "continuous compliance".  That's a term that BMC 
has been using for several years to describe its solutions that (1) 
detect configuration deviations, (2) open tickets, and (3) close those 
tickets when fixes are deployed.  It might resonate much more with the 
community, and even alleviate a lot of the contention around the word 
"continuous".

Just my $.02.

Regards,
--David Solin

---

From: Dorian Cougias <[email-masked]>
Date: Mon, 27 Aug 2012 10:34:44 -0700

I don't think the controversy is over monitoring, I think the controversy is over "continuous".

So whether to call it monitoring or compliance isn't the case.

Dorian J. Cougias
Compliance Scientist
Unified Compliance Framework

---- On Sun, 26 Aug 2012 11:54:27 -0700  &lt;[email-masked]&gt; wrote ---- 

To all:

David Oliva

 _______________________________________________ 
sacm mailing list 
[email-masked] 
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Mon, 27 Aug 2012 13:45:28 -0400

Would Compliance Monitoring work?

Thanks,
Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of Dorian Cougias
Sent: Monday, August 27, 2012 1:35 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [sacm] Continuous Compliance in lieu of Continuous Monitoring

Dorian J. Cougias
Compliance Scientist

---- On Sun, 26 Aug 2012 11:54:27 -0700 <[email-masked]<mailto:[email-masked]>> wrote ----

To all:

David Oliva
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: David Solin <[email-masked]>
Date: Mon, 27 Aug 2012 15:40:04 -0500

My reason for not piping up earlier is that I don't personally care.  
It's a rose by any other name, right?  The name doesn't offend me.  But 
clearly the name is causing indigestion.  I believe that the reason is 
what I have described -- that companies selling billions of dollars of 
products, and analysts from which customers who buy those products seek 
guidance, have together trained the marketplace to respond to certain 
keywords in certain ways.

In our case, I think it's the gerund (verb functioning as a noun) -- 
monitoring -- that is causing angst.  When people hear the word 
monitoring they have been conditioned to expect to see a solution that 
processes certain types of events.  Then adjective continuous takes on a 
real-time connotation, that has little to do with SCAP.

I believe that what SCAP standards address is the compliance market, 
because the standards let you make assertions about the configuration 
state of an environment.  So I would make compliance our noun.  The 
adjective we pick is just additional branding.  Do we want to be 
pigeon-holed into security?  If so, we could call it security 
compliance.  Do we want it to seem timely and all-encompassing?  Then we 
should keep the adjective continuous.

Google "continuous monitoring" (~7 million results), and you'll see why 
people who have spent a long time working with the US government think 
it's a good fit for what we're talking about.

Google "continuous compliance" (~48 million results), and you'll see why 
people who have spent a long time working with commercial enterprise 
software think it's a good fit for what we're talking about.  You'll 
also notice a lot of the same links from the first list.

And that's why I think "continuous compliance" is a better fit.  It also 
has the benefit of being in current use by vendors and analysts, and so 
the marketplace wouldn't need to be trained to understand it.

However, Kathleen's suggestion of compliance monitoring is also quite 
descriptive, and I believe differentiates itself sufficiently from the 
unadorned word "monitoring" that it could also probably work just fine.

Regards.
--David Solin

On 8/27/2012 12:45 PM, Moriarty, Kathleen wrote:
> *From:[email-masked] [mailto:[email-masked]] *On Behalf 
> Of *Dorian Cougias
> *Sent:* Monday, August 27, 2012 1:35 PM
> *To:* [email-masked]
> *Cc:* [email-masked]
> *Subject:* Re: [sacm] Continuous Compliance in lieu of Continuous 
> Monitoring
>
> ---- On Sun, 26 Aug 2012 11:54:27 -0700 *<[email-masked] 
> <mailto:[email-masked]>>* wrote ----
>
>     To all:
>
>     I have followed the discussion about the "continuous monitoring"
>     term and am surprised about the amount of controversy is has caused.
>
>     [email-masked] <mailto:[email-masked]>

--