Automating Compliance with Security Content Automation Protocol

Transcription

1 Automating Compliance with Security Content Automation Protocol presented by: National Institute of Standards and Technology

2 Agenda Information Security Current State Security Content Automation Protocol Introduction Current Stakeholders Use Cases Validation Program Background and Status Possible Future Directions for SCAP Summary

3 Current State Security Operations Governance Body Compliance Management Vulnerability Management Configuration Management Asset Management Audit Team OCIO Compliance Management Vulnerability Management Configuration Management Asset Management Standards Body Vulnerability + Threat Increased annual vulnerabilities Increased zero day attacks Decreased exploit timelines Continued mis-configuration Continued exfiltration Continued weak links Operations Team Product Provider Service Provider

4 What is SCAP? How Standardizing the format by which we communicate What Standardizing the information we communicate Protocol Content CVE OVAL CVSS CPE SCAP XCCDF CCE 70 million hits per year 20 new vulnerabilities per day, over 6,000 per year Mis-configuration cross references Reconciles software flaws from US CERT and MITRE repositories Produces XML feed for NVD content

5 Convergent Evolution of Post-Compilation Software Maintenance 2008: NVD will become production-ready for SCAP version : OMB mandates use of SCAP validated tools for assessing Federal Desktop Core Configuration (FDCC) 2007: NCP legacy checklists become available through NVD Web site 2007: NCP promotes SCAP as the preferred format for all new checklists : Announcements that the following guidelines will be available in SCAP format: DISA Security Technical Implementation Guides (STIG) JTF-GNO Information Assurance Vulnerability Management (IAVM) alerts RedHat Security Guides 2006: NVD becomes reference data for SCAP 2006: SCAP reaches Beta formulation with publication of the NIST Draft Interagency Report (IR) : icat becomes NVD 2002: NCP established through Cyber Security R&D Act of : icat established NVD SCAP NCP

6 National Checklist Program Hosted at National Vulnerability Database Website

7 How SCAP Works Report Checklist XCCDF Platform CPE Misconfiguration CCE General Impact CVSS Software Flaw CVE General Impact CVSS Specific Impact CVSS Results Specific Impact CVSS Results Commercial Government Tools Test Procedures OVAL Patches OVAL

8 Linking Configuration to Compliance Keyed on SP <Group id="ia-5" hidden="true"> Security Controls <title>authenticator Management</title> <reference>iso/iec 17799: , </reference> <reference>nist : , , , , , , , , </reference> <reference>gao FISCAM: AC-3.2</reference> Traceability to Mandates <reference>dod : IAKM-1, IATS-1</reference> <reference>dcid 6/3: 4.B.2.a(7), 4.B.3.a(11)</reference> </Group> <Rule id="minimum-password-length" selected="false" weight="10.0"> <reference>cce-100</reference> <reference>disa STIG Section </reference> <reference>disa Gold Disk ID 7082</reference> <reference>pdi IAIA-12B</reference> <reference> Section Table A-1.4</reference> <reference>nsa Chapter 4 - Table 1 Row 4</reference> <requires idref="ia-5"/> [pointer to OVAL test procedure] </Rule> Rationale for security configuration Traceability to Guidelines

9 Federal Risk Management Framework SP / SP A Monitor Security Controls Continuously track changes to the information system that may affect security controls and reassess control effectiveness SP Authorize Information System Determine risk to agency operations, agency assets, or individuals and, if acceptable, authorize information system operation SP A Assess Security Controls Determine security control effectiveness (i.e., controls implemented correctly, operating as intended, meeting security requirements) Starting Point FIPS 199 / SP Categorize Information System Define criticality /sensitivity of information system according to potential impact of loss SP Implement Security Controls Implement security controls; apply security configuration settings FIPS 200 / SP Select Security Controls Select baseline (minimum) security controls to protect the information system; apply tailoring guidance as appropriate SP / SP Supplement Security Controls Use risk assessment results to supplement the tailored security control baseline as needed to ensure adequate security and due diligence SP Document Security Controls Document in the security plan, the security requirements for the information system and the security controls planned or in place

10 Integrating IT and IT Security Through SCAP Common Vulnerability Enumeration Common Platform Enumeration Common Configuration Enumeration extensible Checklist Configuration Description Format Open Vulnerability and Assessment Language Common Vulnerability Scoring System Vulnerability Management CVE OVAL CVSS Misconfiguration Asset Management CPE SCAP CCE Configuration Management XCCDF Compliance Management

11 Agility in a Digital World Organization One Information System Business / Mission Information Flow Organization Two Information System System Security Plan Security Assessment Report Plan of Action and Milestones Security Information System Security Plan Security Assessment Report Plan of Action and Milestones Determining the risk to the first organization s operations and assets and the acceptability of such risk Determining the risk to the second organization s operations and assets and the acceptability of such risk The objective is to achieve visibility into prospective business/mission partners information security programs BEFORE critical/sensitive communications begin establishing levels of security due diligence and trust.

12 Stakeholder and Contributor Landscape: Industry Product Teams and Content Contributors Ai Metrix

13 Stakeholder and Contributor Landscape: Federal Agencies SCAP Infrastructure, Beta Tests, Use Cases, and Early Adopters DHS NSA OSD DOJ Army OMB IC DISA EPA NIST DOS

14 Use Case: The Office of Secretary of Defense Computer Network Defense Data Pilot CND Data Model Overview IP CPE Vuln Asset Config IDs Env Info HW SW net CPE CCE IP MAC EIN FQDN cert owner MAC location IP CPE location Category DHCP Event IP Vulnerability CVSS Remedy CCE CVE CPE MAC Event NAT Event IP CPE CVE CCE Sig Event CVE CPE CEE Event IP/MAC CPE CVE CCE CPE Event IP CPE Assessment Incident Threat IDs Technique Exploit Actor IP Actor Asset IP IP CPE CME CVE Vuln CME Exploit Vuln CME Anomaly Evnt CEE Flow Event IP Log Event CEE

15 Use Case: The Office of Management and Budget Federal Desktop Core Configuration OMB 31 July 2007 Memo to CIOs: Establishment of Windows XP and VISTA Virtual Machine and Procedures for Adopting the Federal Desktop Core Configurations As we noted in the June 1, 2007 follow-up policy memorandum M-07-18, Ensuring New Acquisitions Include Common Security Configurations, a virtual machine would be established to provide agencies and information technology providers access to Windows XP and VISTA images. The National Institute of Standards and Technology (NIST), Microsoft, the Department of Defense, and the Department of Homeland Security have now established a website hosting the virtual machine images, which can be found at: Your agency can now acquire information technology products that are self-asserted by information technology providers as compliant with the Windows XP & VISTA FDCC, and use NIST s Security Content Automation Protocol (S-CAP) to help evaluate providers self-assertions. Information technology providers must use S-CAP validated tools, as they become available, to certify their products do not alter these configurations, and agencies must use these tools when monitoring use of these configurations.

16 SCAP Validation Labs and Products Validated Products: 5 vendors 6 products 7 capabilities-based validations 2 standards-based validations Accredited Laboratories: Electronic Warfare Associates (EWA) Canada ICSA Labs - an independent division of Verizon Business Science Applications International Corporation (SAIC) ATSEC Information Security Corporation COACT Incorporated, CAFE Laboratory

17 SCAP Validation In-Progress and Potential

18 Where Can SCAP Go? Continue to reduce the boundary between written specifications and action Expand to implementation and remediation of vulnerabilities and security configurations Extend into additional security technologies (e.g., IDS/IPS, firewall) and into other IT technologies (e.g., asset and configuration management) We are open to additional use cases

19 Summary SCAP gives us a transparent, interoperable, repeatable, and ultimately automated way to assess security software flaws and misconfiguration in the enterprise Efficiencies gained through SCAP give our IT security teams additional cycles to address other important aspects of IT security By linking compliance to configuration, SCAP makes compliance reporting a byproduct of good security, allowing IT security teams to focus on securing the enterprise

20 More Information National Checklist Program National Vulnerability Database SCAP Checklists or SCAP Capable Products SCAP Events NIST FDCC Web Site FDCC SCAP Checklists FDCC Settings Virtual Machine Images Group Policy Objects NIST SCAP Mailing Lists

21 Contact Information 100 Bureau Drive Mailstop 8930 Gaithersburg, MD USA Steve Quinn Peter Mell (301) (301) Karen Scarfone Murugiah Souppaya (301) (301) Matt Barrett Information and Feedback (301) Web: Comments:

22 Additional Information

23 Current State: Compliance and Configuration Management FISMA HIPAA SOX DCID COMSEC 97 DoD ISO Vendor 3 rd Party SP Title III??? DCID6/3 NSA Req DoD IA Controls 17799/ Compliance Management SP Security Agency Guides NSA Guides DISA STIGS & Checklists??? Guide Guide Finite Set of Possible Known IT Risk Controls & Application Configuration Options Agency Tailoring Mgmt, Operational, Technical Risk Controls Windows XP SP1 SP2 Enterprise Mobile Stand Alone SSLF High Moderate Low Millions of settings to manage Configuration Management OS or Application Version/ Role Major Patch Level Environment Impact Rating or MAC /CONF

24 Current State: Vulnerability Trends 9,000 8,000 7,000 6,000 5,000 4,000 3,000 2,000 1,000 0 CERT/CC NVD OSVDB Symantec A 20-50% increase over previous years Decreased timeline in exploit development Increased prevalence of zero day exploits Three of the SANS Top 20 Internet Security Attack Targets 2006 were categorized as configuration weaknesses. Many of the remaining 17 can be partially mitigated via proper configuration.

25 Security Content Automation Protocol (SCAP) Standardizing How We Communicate CVE Common Vulnerability Enumeration Standard nomenclature and dictionary of security related software flaws CCE Common Configuration Enumeration Standard nomenclature and dictionary of software misconfigurations CPE Common Platform Enumeration Standard nomenclature and dictionary for product naming XCCDF extensible Checklist Configuration Description Format Standard XML for specifying checklists and for reporting results of checklist evaluation OVAL Open Vulnerability and Assessment Language Standard XML for test procedures Cisco, Qualys, Symantec, Carnegie Mellon University CVSS Common Vulnerability Scoring System Standard for measuring the impact of vulnerabilities

26 Existing Federal Content Standardizing What We Communicate In response to NIST being named in the Cyber Security R&D Act of 2002 Encourages vendor development and maintenance of security guidance Currently hosts 114 separate guidance documents for over 141 IT products Translating this backlog of checklists into the Security Content Automating Protocol (SCAP) Participating organizations: DISA, NSA, NIST, Hewlett-Packard, CIS, ITAA, Oracle, Sun, Apple, Microsoft, Citadel, LJK, Secure Elements, ThreatGuard, MITRE Corporation, G2, Verisign, Verizon Federal, Kyocera, Hewlett-Packard, ConfigureSoft, McAfee, etc. Over 70 million hits per year 29,000 vulnerabilities About 20 new vulnerabilities per day Mis-configuration cross references to: NIST SP Security Controls (All 17 Families and 163 controls) DoD IA Controls DISA VMS Vulnerability IDs Gold Disk VIDs DISA VMS PDI IDs NSA References DCID ISO Reconciles software flaws from: US CERT Technical Alerts US CERT Vulnerability Alerts (CERTCC) MITRE OVAL Software Flaw Checks MITRE CVE Dictionary Produces XML feed for NVD content

27 SCAP Validation Program Capabilities Capability FDCC SCAP CVE CCE CPE XCCDF OVAL CVSS FDCC Scanner X X X X X X X X Authenticated Configuration Scanner X X X X X X Authenticated Vulnerability and Patch Scanner X X X X X Unauthenticated Vulnerability Scanner X X X X Intrusion Detection/Prevention Systems X X X X Patch Remediation X X X X Mic-Configuration Remediation X X X X Asset Management X X X Asset Database X X X Vulnerability Database X X X X Mis-Configuration Database X X X X Malware Tool X X X X NOTE: Xs indicate some degree of testing, but not necessarily all-inclusive testing, for the indicated standard NOTE: Grey font indicates capabilities that are not yet available for test

28 SCAP Value Feature Standardizes how computers communicate vulnerability information the protocol Standardizes what vulnerability information computers communicate the content Based on open standards Uses configuration and asset management standards Applicable to many different Risk Management Frameworks Assess, Monitor, Implement Detailed traceability to multiple security mandates and guidelines Keyed on NIST SP security controls Benefit Enables interoperability for products and services of various manufacture Enables repeatability across products and services of various manufacture Reduces content-based variance in operational decisions and actions Harnesses the collective brain power of the masses for creation and evolution Adapts to a wide array of use cases Mobilizes asset inventory and configuration information for use in vulnerability and compliance management Reduces time, effort, and expense of risk management process Automates portions of compliance demonstration and reporting Reduces chance of misinterpretation between Inspector General/ auditors and operations teams Automates portions of FISMA compliance demonstration and reporting