From: GCN
The National Institute of Standards and Technology has released final specifications for the latest version of the Security Content Automation Protocol (SCAP). NIST also has updated recommendations for using standardized naming schemes included in SCAP.
An increased emphasis on continuous monitoring and real-time awareness of the security status of federal IT systems makes the automation of security activities imperative. SCAP is intended to enable that automation by supporting automated checking of configuration, vulnerability and patch status of systems, as well as compliance with security requirements. It also includes protocols for security measurement.
SCAP comprises a suite of specifications for standardizing the format and nomenclature for identifying vulnerabilities and for communicating security information between commercial security products. Agencies are required to use, when available, products that have been validated as supporting SCAP.
NIST’s Special Publication 800-126, Revision 1, “The Technical Specification for the Security Content Automation Protocol Version 1.1,” http://csrc.nist.gov/publications/nistpubs/800-126-rev1/SP800-126r1.pdf defines the technical composition of the protocols. It describes the requirements and conventions used to ensure consistent and accurate exchange of SCAP content and the interoperability of SCAP-validated products.
“The U.S. federal government, in cooperation with academia and private industry, is adopting SCAP and encourages its use in support of security automation activities and initiatives,” the revised publication states. “The protocol is expected to evolve and expand in support of the growing needs to define and measure effective security controls, assess and monitor ongoing aspects of that information security, and successfully manage systems in accordance with risk management frameworks.”
SCAP v1.1 includes seven specifications:
- eXtensible Configuration Checklist Description Format (XCCDF).
- Open Vulnerability and Assessment Language (OVAL).
- Open Checklist Interactive Language (OCIL).
- Common Platform Enumeration (CPE).
- Common Configuration Enumeration (CCE).
- Common Vulnerabilities and Exposures (CVE).
- Common Vulnerability Scoring System (CVSS).
Major changes from SCAP Version 1.0 to 1.1 include the addition of Open Checklist Interactive Language and an upgrade to Open Vulnerability and Assessment Language Version 5.8.
SCAP uses standardized software flaw and security configuration data from the National Vulnerability Database, which is managed by NIST and sponsored by the Homeland Security Department. It provides a unique identifier for each reported software vulnerability. According to NIST, the database has grown from 6,000 listings in 2002 to about 46,000 listings currently.
One of the strengths of SCAP is the standardization of naming schemes for software vulnerabilities and weaknesses introduced by the configuration of software. An updated “Guide to Using Vulnerability Naming Schemes” (SP 800-51, Revision 1) http://csrc.nist.gov/publications/nistpubs/800-51-rev1/SP800-51rev1.pdf has been released by NIST to provide an introduction to SCAP’s CCE and CVE.
The publication makes recommendations for how end-user organizations such as agencies use names produced by the schemes, as well as recommendations for software and service vendors on using vulnerability names.
A naming scheme ensures that each vulnerability has a single unique name.
“Using standardized vulnerability naming schemes supports interoperability,” the publication states. “Organizations typically have many tools for system security management that reference vulnerabilities. If these tools do not use standardized names for vulnerabilities, it may not be clear that multiple tools are referencing the same vulnerabilities in their reports, and it may take extra time and resources to resolve these discrepancies and correlate the information.”
Ensuring interoperability can improve timeliness and consistency in security assessments and response, and help eliminate confusion. “This helps organizations to quickly identify the information they need, such as remediation information, when a new problem arises,” the publication says.
Leave a Reply