http://www.gcn.com/online/vol1_no1/44331-1.html
By William Jackson
GCN Staff
05/22/07
The National Institute of Standards and Technology has released a suite
of tools to help automate vulnerability management and evaluate
compliance with federal IT security requirements.
The Security Content Automation Protocol is an expansion of the National
Vulnerability Database. It is an automated checklist that using a
collection of recognized standards for naming software flaws and
configuration problems in specific products. It can help test for the
presence of vulnerabilities and rank them according to severity of
impact. The checklist files are mapped to NIST specifications for
compliance with the Federal Information Security Management Act, so that
the output can be used to document FISMA compliance.
FISMA is a very thorough and comprehensive framework for security
computers, said Peter Mell, NVD program manager. But it doesnt deal with
diving down at low level configurations and settings where
vulnerabilities are exploited. Its been difficult to go from the high
level framework to actually flipping bits on computers to secure them.
SCAP is intended to help make the step from FISMA compliance to
operational IT security.
Because much of government is standardized on Microsoft products, the
initial SCAP release checks for vulnerabilities in Windows Vista, XP and
Server 2003 operating systems as well as Office 2007 and Internet
Explorer 7.0. It is being rapidly expanded to encompass additional
vendors and products, Mell said.
SCAP currently uses six open standards for enumerating, evaluating and
measuring the impact of software problems and reporting the results:
* Common Vulnerabilities and Exposures, CVE, from MITRE Corp.; standard
identifiers and dictionary for security vulnerabilities related to
software flaws.
* Common Configuration Enumeration, CCE, from MITRE; standard
identifiers and dictionary for system security configuration issues.
* Common Platform Enumeration, CPE, from MITRE; standard identifiers and
dictionary for platform and product naming.
* eXtensible Configuration Checklist Description Format, XCCDF, from the
National Security Agency and NIST; a standard XML for specifying
checklists and reporting results.
* Open Vulnerability and Assessment Language, OVAL, from MITRE; a
standard XML for security testing procedures and reporting.
* Common Vulnerability Scoring System, CVSS, from the Forum of Incident
Response and Security Teams; a standard for conveying and scoring the
impact of vulnerabilities.
_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com
This archive was generated by hypermail 2.1.3 : Tue May 22 2007 - 22:25:33 PDT