NIST encourages agencies to adopt SCAP

The National Institute of Standards and Technology has new guidelines out for using an automated cybersecurity settings compliance method called SCAP--pronounced ess-cap--or Security Content Automation Protocol. Technical specifications for SCAP Version 1.0 were published in November 2009.

Before the July publication of the guidelines, NIST Special Publication 800-117, there was little guidance on how the new protocol should be applied.

"SCAP is designed to organize, express, and measure security-related information in standardized ways, as well as related reference data, such as identifiers for post-compilation software flaws and security configuration issues," explains NIST in it's latest guidance.

"SCAP can be used to maintain the security of enterprise systems, such as automatically verifying the installation of patches, checking system security configuration settings, and examining systems for signs of compromise," it adds.

SCAP is not a replacement for the security software that agencies and contractors are using, but a suite of specifications that existing software should be configured to support. In the guidance, NIST recommends that organizations:

• Improve and monitor IT security by using SCAP's security configuration checklists;
• use SCAP to demonstrate compliance with high-level security requirements that originate from mandates, standards and guidelines, by using SCAP-enabled tools along with SCAP-expressed checklists.
• standardized SCAP enumerations--Common Configuration Enumeration (CCE) and Common Platform Enumeration (CPE)--such as identifiers and product names; and
• reference SCAP for vulnerability measurement and scoring--Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS).

NIST also recommends that product vendors and developers of standards checklists incorporate SCAP into their practices.

For more:
- see NIST's latest guidance Special Publication 800-117 (.pdf)
- see SCAP version 1.0 technical specifications Special Publication 800-126 (.pdf)

Related Articles:
NIST promotes common cybersecurity controls
NIST: Continuous monitoring can lead to false sense of security
Cloud computing standards and procurement processes take shape
Ross: Defense only goes so far, real cybersecurity is agile