[ISN] XML security standard touted at show

From: InfoSec News (isnat_private)
Date: Sat Apr 12 2003 - 01:03:48 PDT

  • Next message: InfoSec News: "[ISN] Secunia Security Advisories Mailing List Information"

    http://www.nwfusion.com/news/2003/0411standorgan.html
    
    By Paul Roberts
    IDG News Service
    04/11/03
    
    A group of application security vendors affiliated with the
    Organization for the Advancement of Structured Information Standards
    (OASIS) will next week announce a proposal for an XML standard for
    application vulnerabilities. The announcement will be made at the RSA
    Conference being held in San Francisco.
    
    The group, made up of Citadel Security Software, GuardedNet,
    NetContinuum, SPI Dynamics and Teros, is promoting the development of
    the Application Vulnerability Description Language (AVDL), which is
    intended to standardize information about application vulnerabilities,
    enabling different products to share vulnerability information in a
    heterogenous network environment, according to a statement released by
    the five companies.
    
    The AVDL group submitted its idea to OASIS for study. In turn, OASIS
    has created a technical committee to develop an XML definition for
    exchanging information on the security vulnerabilities of applications
    exposed to networks.
    
    A draft specification from the AVDL Technical Committee is scheduled
    for September, with a final specification due in December, according
    to OASIS.
    
    If widely adopted, the AVDL standards will enable customers to deploy
    diverse "best of breed" security technology to protect their network
    without having to sacrifice integration and interoperability,
    according to Wes Wasson, chief security strategy officer at
    NetContinuum.
    
    Though initially intended to foster interoperability among the
    products of the five sponsoring companies, AVDL has the potential to
    be adopted by additional product platforms and to move further up the
    development chain, according to Brian Cohen, CEO of SPI Dynamics.
    
    AVDL backers hope that development platform vendors and OASIS members
    such as Microsoft, BEA Systems and IBM will join the AVDL Technical
    Committee and help shape the development of the AVDL standard so that
    it can be easily integrated with their development environments,
    according to Cohen.
    
    Asked about the potential of resistance from those large companies, or
    from companies that are wary of more standards, Wasson and Cohen said
    that demand from their customers was driving them to promote the AVDL
    standard.
    
    "Customers are drowning in the complexity of the application security
    problem," Wasson said. "Our customers are driving this. They see it as
    a real business solution to real business problems."
    
    Also at the conference, the Information Security Systems Association
    (ISSA) is making what it calls a "historic announcement." The group,
    an international non-profit organization made up of information
    security professionals and practitioners, will announce its intention
    to take over and complete development of the Generally Accepted
    Information Security Principles (GAISP).
    
    The announcement is quite significant, according to Mike Rasmussen,
    vice president of marketing for ISSA and an analyst at Forrester
    Research.
    
    "What GAAP (Generally Accepted Accounting Principles) is for the
    accounting world, (GAISP) is trying to be for the security world,"  
    Rasmussen said.
    
    Originally formulated as the Generally Accepted System Security
    Principles (GASSP) in response to Recommendation No. 1 of the 1990
    U.S. National Research Council report, "Computers at Risk," the
    standards were managed by the International Information Security
    Foundation (IISF) and are based on other existing guidelines such as
    those created by the Organization for Economic Cooperation and
    Development, according to information provided by ISSA.
    
    IISF published so-called "pervasive principles" in 1992 that provided
    high-level recommendations on information security standards,
    accountability and ethics to business executives. Despite updating
    those principles again in 2002, the GASSP effort was flagging,
    according to Rasmussen.
    
    By taking over the project and renaming the standards to the GAISP,
    ISSA hopes to breathe new life into the project.
    
    The ISSA hopes to finish specific management guidelines and tactics
    for CIOs and chief information security officers that build on a set
    of pervasive principles. It will follow those with detailed principles
    that recommend activities for risk management and step-by-step
    instructions for IT staff.
    
    In addition, ISSA will be working to bring the GAISP standards in line
    with ISO 17799 standards, which many companies are using to guide
    their security architectures, according to Rasmussen.
    
    The GAISP project will be a massive undertaking, intended to provide
    security administrators with a single security framework that they can
    use to measure compliance with a wide range of international security
    standards and regulations, in addition to specific steps that can be
    followed to achieve and maintain compliance.
    
    If successful, the GAISP project could help stem the confusion
    concerning security management, according to Rasmussen.
    
    "Information security is becoming like OSHA," Rasmussen said,
    referring to the notoriously complicated rules of the U.S.  
    Occupational Safety and Health Administration. "It's a management
    nightmare. These are practical standards for building and managing
    information security."
    
    RSA will be the "formal kickoff" of the project, according to
    Rasmussen.
    
    "We want to communicate a message to let people know that we are
    working," he said.
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Sat Apr 12 2003 - 03:37:26 PDT